What can we do about the vibe committer
I recently had a discussion on Mastodon that was sparked by a post of the Software Freedom Conservancy about the handling of LLM-gen-AI submissions. There are many people who are very opposed to letting LLM-generated code into their projects. This is an understandable standpoint given concerns like legality, unethical sourcing, resource usage, and concentration of power.
Apart from that, it is completely reasonable for a maintainer to set rules for submissions. A FOSS license doesn’t mean that a maintainer even has to interact with anyone. It just provides the source.
Still, it made me think about the impact these rules might have and in which cases they might turn into a net negative.
Consent is king
Maintainers make the rules. They are entrusted with maintaining a version of the code that others might want to contribute to. Often that is a single person who not only made something they wanted to share, but also took it upon themselves to help others improve it. For this we should be grateful for their work and respect their wishes.
But that is not how the world works. Through ignorance, entitlement, or malice, maintainers are often confronted with demands or hostility. Their boundaries get ignored, and frustrations rise. LLM-generated code is fertile ground for this. While some see it as the holy grail, others see it as the devil. This strong polarizing effect, combined with ignored boundaries, can easily lead to clashes.
Solid Snake and Benny Hill
Every clash can be very stressful for all sides. This is especially true if innocent people get caught in the crossfire. In my years as a software developer I have seen a lot of bad code. More recently, some code has triggered my vibe code sensor, but it was written by a human.
On the other hand, I believe I could probably hide the origin of a code submission. I would never do that, especially not to deceive. This makes me think that many people out there have the same knowledge and no problem with deception.
This could lead to some people sneaking their LLM code in like Solid Snake into a secret base, and others being chased away by an angry maintainer like in a Benny Hill sketch.
Distrust leads to anger, anger leads to a bad time for everyone
I am, of course, not the first person to think about nefarious actors trying to sneak past defenses. I am sure the most passionate maintainers are constantly aware of this, constantly on the lookout for the slightest hint of LLM involvement, always vigilant.
Or constantly concerned with the source of a submission in addition to the quality, always suspicious. From my observations, this can be coupled with anger - maybe anger about LLMs, about disregard of boundaries, or about the extra work they have to put in.
At this point, it begs the question of who is winning anything here. Even more, some people are definitely losing. The maintainers, new programmers, and the FOSS community as a whole are negatively affected, while vibe coders and LLM companies still get what they want a lot of the time.
Pragmatic principles
This all sounds very bad for people who have principles. Standing by principles might hurt someone innocent and even the maintainer, but abandoning principles might hurt just as much. My personal way out: pragmatic principles.
What I mean by that is searching specifically for the fights I can win and that are a net positive. Some of my guiding principles are:
- Don’t search for signs of LLM-generated code in a submission, but don’t ignore them
- If in doubt, either assume it’s human or communicate doubts
- Evaluate submissions primarily on code quality
- Assume people want to help
- Remember that we all make mistakes
- Concentrate on the positives
Afterword
I want to make it clear that I want everyone to set boundaries as they think right, and that everyone should respect those boundaries. I wish for a world where it is a given that the principles of others are respected.
The pragmatic approach is only my way to cope when I can’t protect my principles in a way that is healthy or even successful. I am aware that this is not easy if a project is run over by slop. It’s not a complete solution and not for everyone.
