lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <eaf1366f-4b28-4312-a820-1cd04796ff1d@lucifer.local>
Date: Wed, 30 Jul 2025 18:23:14 +0100
From: Lorenzo Stoakes <lorenzo.stoakes@...cle.com>
To: Sasha Levin <sashal@...nel.org>
Cc: Steven Rostedt <rostedt@...dmis.org>, Greg KH <greg@...ah.com>,
        corbet@....net, linux-doc@...r.kernel.org, workflows@...r.kernel.org,
        josh@...htriplett.org, kees@...nel.org, konstantin@...uxfoundation.org,
        linux-kernel@...r.kernel.org,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        "Dr. David Alan Gilbert" <linux@...blig.org>
Subject: Re: [PATCH 0/4] Add agent coding assistant configuration to Linux
 kernel

On Wed, Jul 30, 2025 at 01:12:54PM -0400, Sasha Levin wrote:
> On Wed, Jul 30, 2025 at 05:59:25PM +0100, Lorenzo Stoakes wrote:
> > On Wed, Jul 30, 2025 at 12:36:25PM -0400, Sasha Levin wrote:
> > > On Wed, Jul 30, 2025 at 12:18:29PM -0400, Steven Rostedt wrote:
> > > > On Wed, 30 Jul 2025 16:34:28 +0100
> > > > Lorenzo Stoakes <lorenzo.stoakes@...cle.com> wrote:
> > > >
> > > > > > Which looked like someone else (now Cc'd on this thread) took it public,
> > > > > > and I wanted to see where that ended. I didn't want to start another
> > > > > > discussion when there's already two in progress.
> > > > >
> > > > > OK, but having a document like this is not in my view optional - we must
> > > > > have a clear, stated policy and one which ideally makes plain that it's
> > > > > opt-in and maintainers may choose not to take these patches.
> > > >
> > > > That sounds pretty much exactly as what I was stating in our meeting. That
> > > > is, it is OK to submit a patch written with AI but you must disclose it. It
> > > > is also the right of the Maintainer to refuse to take any patch that was
> > > > written in AI. They may feel that they want someone who fully understands
> > >
> > > This should probably be a stronger statement if we don't have it in the
> > > docs yet: a maintainer can refuse to take any patch, period.
> > >
> > > > what that patch does, and AI can cloud the knowledge of that patch from the
> > > > author.
> > >
> > > Maybe we should unify this with the academic research doc we already
> > > have?
> > >
> > > This way we can extend MAINTAINERS to indicate which subsystems are
> > > more open to research work (drivers/staging/ comes to mind) vs ones that
> > > aren't.
> > >
> > > Some sort of a "traffic light" system:
> > >
> > >  1. Green: the subsystem is happy to receive patches from any source.
> > >
> > >  2. Yellow: "If you're unfamiliar with the subsystem and using any
> > >  tooling to generate your patches, please have a reviewed-by from a
> > >  trusted developer before sending your patch".
> > >
> > >  3. No tool-generated patches without prior maintainer approval.
> >
> > This sounds good, with a default on red. Which would enforce the opt-in
> > part.
>
> I don't think we should (or can) set a policy here for other
> maintainers. Right now we allow tool-assisted contributions - flipping
> this would mean we need to get an ack from at least a majority of the
> MAINTAINERS folks.

Sasha, with respect this is totally crazy.

Assuming every maintainer accepts AI patches unless explicitly opted out is
very clearly not something that will be acceptable to people.

Assuming an LF policy most maintainers won't be aware of applies with the
kind of ramifications this will inevitably have seems very unreasonable to
me.

You might suggest presuming a policy for maintainers is inappropriate, but
you are doing so wrt the LF policy on the assumption everybody is aware and
agrees with it.

That same document says individual projects can _override_ this as they
please. So the introduction of this document can very well override that.

We at the very least need this to be raised at the maintainers summit with
a very clear decision on opt-in vs. opt-out, with the decision being
communicated clearly.

It's maintainers like me that'll have to deal with the consequences of
this.

Thanks, Lorenzo

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ