linux-kernel - Re: Code of Conduct violation complaint

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250730030520.GD273706@mit.edu>
Date: Tue, 29 Jul 2025 23:05:20 -0400
From: "Theodore Ts'o" <tytso@....edu>
To: Shuah Khan <skhan@...uxfoundation.org>
Cc: Pavel Machek <pavel@....cz>, "conduct@...nel.org" <conduct@...nel.org>,
        kernel list <linux-kernel@...r.kernel.org>
Subject: Re: Code of Conduct violation complaint

Pavel, you might also want to consider that there is a range of ways
that autmation and/or AI can be used.

*) When coding a patch --- this might include Coccinelle, not just
   Large Language Models

*) When writing text in the body of the e-mail.  And again, it's not
   just LLM, but also scripts that might automate Pull requests, or
   replies that maintainers like Greg K-H use when people send
   malformed patches.

Accusing someone who is using Coccinelle to generate a patch is
somehow lacking ethics is hopefully self-evidently nonsense.  And I'd
argue that if someone uses some AI tool to generate patches, or to
help backport a patch to an LTS release, that is similarly a situation
where to claim that therefore the patch "lacks ethics" also just
does't make any sense.

And with both of these categories, there is a distinction regarding
*how* these tools might be used, and how much the human is in the
loop.  If a human uses a tool like Coccinelle, but spends a lot of
time verifying the result, that's quite different from a situation
where Skynet sends a T-1000 robot back in time which with instrctions
to kill without any human in the loop.

Developers have been using tools to help their work for decades,
starting with Emacs macros, perl and sed scripts, and then on to
Coccinelle, and more recently Large Language Models.  So in many ways,
this is nothing new.

It does seem that in your e-mail messages, that you seem to be
engaging in a bit of "all or nothing" thinking, where if someone is
using some kind of AI tool, that it is automatically the most extreme
end of the spectrum --- and so not only do you not know which e-mails
might have used LLM in some way, you don't know *how* LLM was used,
and how much a human being may have curated the output before sending
the e-mail or the patch.

There are discussions that perhaps people should disclose when LLM's
are used to generate patches, and that might make sense (although
people haven't made similar demands when Emacs macros were used to
help automate say, a global renaming of function or variable).

Regaerdless of how those discussions turn out, your making the
*assumption* that a fellow developer must be lacking in all ethics is
just not a great way to interact with each other.  Whether the tool
involved is a bash script sending patches or a pull request, Emacs, or
Coccinelle, or some Large Language Model, using tools is not grounds
for assuming that all messages sent by a particular person is "lacking
in ethics".

Cheers,

						- Ted