I have been using Linux for over 8 months now, and my primary distribution of choice was Debian.
Debian recently conducted a community vote on allowing AI contributions, and it ended up allowing responsible AI contributions.
What is this responsible? How can AI commits be responsible? There are thousands of reasons to not use AI, and the primary reason is AI is a thief.
How did you react to Debian’s decision? Did you switch distros? Which one was your option, and why?
Also, when the Linux kernel itself allows AI commits, is there any practicality in a Linux distribution strictly limiting or restricting AI commits?
I have no serious usability issue with Debian now but am concerned about the use of AI even in my Linux distribution. Should I keep going with Debian or consider any other distribution, as I only have 8+ months of experience as a daily Linux user? I tried almost all Linux distros and am comfortable with everything except Void Linux and highly complex ones like Gentoo.
Are Anti-AI Linux distributions practical?
No, because there’s no such thing as “AI”. It’s irrational to try to remove something that doesn’t exist. People will continue using computers to compute regardless.
On the other hand I don’t think developers should accept slop. I guess that’s what “responsible” means.
The linux kernel is compromised. Lets use NetBSD!
I hope this whole thing makes hurd grow.
Hurd’s tAInted too :/
Wait… WHAT!?
Yea, apparently AS is now being heavily used in its development. I need to look up the reference, but I read a while ago that AS-assisted ‘coding’ was used for making SMP work in Hurd.
I’ve spent quite some time pondering my options now that OpenBSD, my former OS of choice, has been slowly but surely giving in to the hype, and I can tell you that currently the most sensible option seems to be (I’m not joking) 9Front.
Unless you literally programmed every component yourself, you can’t get away from some level of LLM involvement, even if the distro itself bans it. There is no 100% certain way to check code for LLM use. So if a developer doesn’t disclose it, and the maintainers accept the code, it’s in the official codebase now.
There’s a deeper problem though, which is a problem of demarcation. What counts as an “AI contribution” to you? Obviously vibe-coding is. But what about more subtle uses?
What if a developer uses an LLM to read the code and suggest a way to make a certain contribution, but it never actually generates any code, the developer implements the LLM’s suggestion completely by hand. Does that count?
What about if a developer hand writes 95% of the code themselves, but that last 5% they aren’t as confident in, so they have the LLM generate it. Does that count?
What if an extremely experienced developer uses an LLM to generate 100% of the code, but spends hours going over ever single line making sure it is correct and making little tweaks before submitting the code?
What if a developer writes the initial code 100% by hand, and only uses an LLM to go through and optimize the formatting and performance before submitting it?
What if a developer writes 100% of the code by hand, but uses an LLM to generate a bunch of unit tests and documentation?
These are just some of the ways that LLMs can be involved in the process of software development, and most of these wouldn’t have any real chance of being caught by a maintainer doing some sort of scan to detect LLM usage.
I’m not saying these uses are or aren’t justifiable/acceptable, but my point is it’s often not clear what people consider to be “over the line”. Almost no experienced devs in the FOSS world are advocating for the 100% vibe-code/token-maxing approach. But lots of them are comfortable with using LLMs in similar ways to what I listed earlier.
The tough truth is that you’re almost certainly already using software that has LLM involvement at some level. Short of going full Amish mode, or using completely pre-LLM software in some kind of air gapped setup, you’re not going to be able to avoid it.
Man, my friend said he made a web app. He asked me if it would be secure to deploy. I check the front end and immediately check if his formatting was readable.
Two javascript blocks embedded: one was beautified, normal, tabbed out.
The other block was debeautified, which JS developers do so people can’t steal their code (as if that works these days).
I said, “You didn’t make this.”
“Yeah I did!”
“You used AI.”
“But I wrote the prompts!”
"To prompt a computer to steal two separate snippets of javascript from actual developers to achieve the goal.
"Man, this is fine for prototyping, just to demo an idea. But I wouldn’t release this to the public, because if I saw that, I am going to use the tools I already have, and my LLM to speed up the actions, and I will show you how hackable the app actually is.
“You didn’t make a steak. You ordered a steak and got a McRib with carrots.”
He responds, “Does it look ok?”
“Yeah, we can use the css, and we can adjust that as needed, but if your frontend is this sloppy, I wouldn’t release the backend and take customer data. Hell no.”
What if someone does a copy/paste of a code snippet from a google search and then modified it for their own purposes?
According to the grifters, this is “AI” but it’s not and nobody cares. There is no boundary for something that doesn’t exist (“AI”). That’s fundamental to the grift.
No. It’s not practical.
No matter how you feel about ai or how you think it is wrong, the increased tempo of bug fixes and security patches necessitates either manpower beyond what is feasible for volunteer projects or the use of ai tools.
It’s an arms race and you can’t opt out without just missing the patch schedule.
thanks, TrollAccount69, that’s genuinely what I thought too!
How about posting alongside a… friend?
Yeah, all the FOSS communities have been starving for labor since they started. Likely the best we could hope for is that the true experts at the top are maintaining a critical eye on what makes it in.
Even in that case we need to hope they’re using ai tools because they’ll be seeing a volume of cases too high for their previous workflow.
It’s a mix right?
In some cases, you have absolute neophyte coders trying to shove unvetted vibe code in. There needs to be some bars on entry for what is submitted. I’d like to see at least mid level code in the same style and verbosity and not something that’s on the fringe of the vibe where it failed 15 times and ended up shoving some great atrocity in for a lack of context. As long as the person asking for a PR isn’t trying to insert horrors, inspecting the input using tools isn’t the worst thing either.
Some of us learned how to code in the first place, and didn’t write overly complicated spaghetti code full of vulnerabilities for the AI to find.
The funny thing about making mistakes is you don’t recognize when you make them 🙃
That’s fair.
I just get tired of the assumption that AI will find serious vulnerabilities in everything, no matter how it was written.
Even if you’re a genious coder, you’ll still have vulnerabilities in your dependencies.
Are Anti-AI Linux distributions practical?
It’s not possible to have a 100% no-LLM-coding-involved Linux distro anymore now that the kernel itself is welcoming LLM-assisted contributions, but it’s still possible to say that everything which the distro produces itself will not use AI.
How can AI commits be responsible?
What Debian means is: by reading what it produces and not just blindly accepting it but having humans review it carefully. The quality of LLM-assisted software is highly variable. Experienced people like Debian and Linux kernel developers are much less likely to publish very bad slop than inexperienced developers who are newly able to make a thing work well enough to ship it.
I am concerned about the extent of Debian’s embrace of LLMs but I still have a lot more confidence in them than most other distros (especially small hardcore-anti-AI distro projects lacking sufficient developer capacity to even keep up with security updates).
I expect we’ll be seeing lots more things like this non-upstreamable-because-AI hardware enablement and distros like Nura (formerly postmarketOS) will either either adopt more nuanced LLM policies or be forked.
I am doubtful about if there will be any serious distros with hard LLM bans in a few years from now. But also, perhaps the bubble will have burst by then, so hosted inference won’t be so cheap and the use of LLMs will probably be quite different.
the primary reason is AI is a thief
This is not the primary reason for most people, I don’t think. I think the fact that it increases complexity while reducing human understanding is the biggest problem; it’s possible (easy even) now to produce mountains of good-enough-by-many-metrics source code which the person doing the prompting has very little comprehension of. The fact that it is also a plagiarism machine is far less of a problem than this. (There are a litany of other problems too of course, several others of which I would also rate as worse than the plagiarism aspect.)
Yeah the Debian Project’s position makes a lot of sense to me. They’re basically saying that they won’t be wasting a bunch of resources trying to seek out LLM generated code and purge it and will instead just focus on making sure ALL the code is up to their quality standards. This will likely mean they spend a lot of time sifting out slop anyway, and will allow them to keep just focusing on making the project do what it’s always done. Ship a stable, usable, and free distro.
Is most of the training data for popular LLM tools stolen? Yes, but the algorithms are not so from a theoretical perspective there’s nothing inherently wrong with developers using AI (which itself is a broad term covering frontier models to simple neural net classifiers) but it’s a matter of their tools which afaik is the responsibility of the developer. (Ex. Devs aren’t banned from using VS Code even though Microsoft is not a good company) (Ex. Dont upload user PII to online tools just to convert a pdf you’re responsible if they steal user data)
So really responsible AI means developers accept liability for any theft or plagarism these tools commit, just as they would if they plagarized code themselves which is less problematic for developers than introducing precedent for restricting developer tooling.
In theory you could revert the commits that are labelled AI-generated but given the scale and application of LLMs that’s a lot of code to rewrite that was already reviewed by maintainers for a lot of important processes and will have likely undergone far less scrutiny and correctness tests. Until AI companies are held responsible for training data that’s stolen and their generated outputs are held to legally be plagarism there is negative incentive to rewrite ai-generated code.
Sorry to bring this into the Linux discussion but OpenBSD is still here. even if the code were AI-generated it would have to go into the meat grinder of style, logic, and cleanliness that all human code goes through to get into release.
Maybe it’s time to consider your switch?
I heard that OpenBSD is not so friendly enough to daily drive as a primary operating system. Are you using it?
Yeah but i run it on an x220T. It definitely depends on what you wanna do, but i find it reliable.
Plus NetBSD has Anti AI contributor policy these two are safe haven for people that don’t want AI. Also Ironclad OS GPLv3 licensed also available for anyone wants to.
NetBSD! I am currently learning UVM and it’s really impressive to a memory newbie
thief
If you advocate for further expansion of “copyright” oppression, you deserve microsoft windows.
100%.
This. So much.
I am old enough to remember many people on the Internet questioning the entire concept of copyright and reacting to it with free licensing, defense of torrent sites, founding Pirate Parties.
Now I read that the primary reason to reject AI is that it is a “thief”??? In the era I described above, someone wrote a song with the lyrics: copying is not theft, stealing a thing leaves one less left, copying it makes one thing more, that’s what copying’s for…
Copying… is fuuuuuuuuun 🎶🎵
GPL may call itself “copyleft”, but legally it is dependent on copyright to be enforceable. In the first place, the whole point of licenses like GPL is to ensure that when people take from the commons, they also give back to the commons. The way AI gains its ability to generate shitty code undermines this, and so is ideologically very much at odds with Linux and the wider FOSS world.
GPL wields the copyright system against itself, like a virus. The goal is the complete destruction of the copyright system and the liberation of all software.
It won’t exactly be able to accomplish anything like that if it’s been undermined no matter what the mechanism of its enforcement is.
This is the GPL’s trap card. When it gets undermined, the “copyright” system loses its credibility.
That was the idea, at least. Seems like there’s people who double down on their belief in copyright in response. But that’s their own fault.
The usual saying applies: “It’s easier for them to imagine the end of the world, than the end of
capitalismthe copyright system.”
There will never be an AI free Linux distro again since it’s allowed in the kernel. I would certainly prefer to use a distro that doesn’t allow vibe coded programs though. That junk is unmaintainable and will be abandoned when the creator can no longer afford the tokens.
Most slopcode projects are abandoned and deleted within months of release – “Of the 120 unique repos, 32 were maintained and 88 were abandoned.”
maybe that could be because people do a small project then get bored and doesn’t apply to something like kernels?
Let’s see if the Kernel is abandoned in a few months, seems likely
There are a few distros that do reject all AI code, which you can find in these two lists:
https://noai.starlightnet.work/list.html
https://codeberg.org/ethical-foss/open-slopware#linux-based (under the ‘Alternative Linux-based operating systems’ section).
OpenBSD.
Come learn about computo.
Be free with us.
Can you share your experience with OpenBSD please?
Pour yourself a cup of coffee.
IN GENERAL: You will encounter much more friction in dealing with certain day to day tasks (until you configure everything) but unlike Linux you will find that the system is much easier to understand and therefore the fixes “stick” in your head a bit easier.
Overall, Linux is like going on a pleasant hike that has occasional 120° cliff faces you need to climb. OpenBSD is like hiking a mountain where you are at a consistent 45° angle. You’ll face challenges but the resolutions are understandable and internally consistent with each other, and you will find you’re own understanding of the system improves much more consistently through use.
USER EXPERIENCE: Desktop: You will be using X11 for the forseable future, particularly OpenBSD’s security oriented fork of Xorg. For the most part any knowledge of setting up an Xorg desktop will transfer with little issue and the applications one would expect to see in such a desktop are present. OpenBSD comes with a few built in window managers which all ere on the “classic” side of the house. Most notably is cwm (Calm Window Manager) which is somewhat inspired by plan9’s Rio.
Wayland is still experimental but there has been a good deal of progress here, DWL is at a point where it “mostly works” though it is far off from being the default. It is important to note that “being the default” actually means something in this space. The OpenBSD developers pride themselves on having and extremely secure and well maintained “base system” so the OS and it’s surrounding ecosystem encourages users to not deviate from defaults as much as possible. That being said Wayland will likely, eventually, become the default.
Applications: The ports tree is less comprehensive than FreeBSD and certainly less than Linux but there is a surprising amount of less commonly used software in there. Case in point, Librewolf is in the ports tree as of 8.0 current. For the most part you will find the tools you need with little issue though; Krita, Kicad, Emacs, etc. There is generally a tool to match your need, though you may need to adapt your workflow to the OS from time to time.
System Administration: This is where she really shines. OpenBSD is understandable; it presents a clean and comprehensible computing experience that invites you to fully grasp how your operating system works. Unlike Linux, which has to cater to a wide variety of use cases, OpenBSD’s tooling is simple and focused on a few specific tasks. In general OpenBSD leans heavily on being a UNIX-like and as a result understanding of Unix is directly transferrable to understanding of OpenBSD.
That being said, OpenBSD also suffers somewhat from being tied closely to its Unix roots so certain aspects of the base system can seem a bit “dated”. A few notable examples being limits on shared memory and concurrent processes being low by default and the default partitioning scheme not fully utilizing very large SSDs. Important to note here; all of these can be easily configured so it’s not that much of a headache.
Another area where OpenBSD is a bit behind, though it has not negatively impacted me, is its file system. FFS is serviceable but it is not a featureful or performant as the “cool kids” of FreeBSD and Linux (ZFS, btrfs). This is being remediated though (see below).
SECURITY: OpenBSD doesn’t have namespace or chroot based process isolation the way Linux or FreeBSD does. Instead it uses a novel approach in the form of two simple syscalls, pledge and unveil.
Pledge is used to limit the specific syscalls a process is allowed to make and when, unveil limits the portions of the file system that are accessible to the process.
Despite seeming less powerful than things like a Linux container these two primitives have proven to be remarkably capable of isolating and securing software used in OpenBSD.
That being said they do take some getting used to and can create certain headaches if you are not familiar. In general, whenever you download a package there will be a message about a new file in /use/local/doc/pkg-readme/; read it.
THE FUTURE: OpenBSD’s development is best described as communal. Users are somewhat tacitly expected to contribute in some way (bug reports, write ups, etc). Personally I like this as it creates a more tight knit and supportive community.
As a direct result of this, and the simplicity/understandability of the system there is a lot of “low hanging fruit” being attacked right now. As mentioned above Wayland is close to being stable and one of the developers for 9front (Ori Bernstein) is working on porting GEFS (the Good Enough File System) to OpenBSD which should bring OpenBSD much closer in performance to its peers in terms of file system. Vmm (the native hypervisor) just got multi-vcpu support in 8.0 and there are a slew of other minor improvements that are accruing.
THE COMMUNITY: The most concise way I can describe the OpenBSD community is “they respect your intelligence.” It is expected that you have read the man-pages and readmes for the software you are using, it’s expected you have an understanding of the guts of the system. This can seem gatekeepy or a bit conceited but allow me to present a counter argument. They don’t think you’re an idiot by default.
The community, as a result of its proximity to other areas in the “indie” computing scene, tends to carry a certain set of cultural markers. There is a lot of cross pollination from the 9front and Suckless communities and as a result you’ll interact more with that computing philosophy. In general the community appreciates simplicity, comprehensibility, and hackability.
CONCLUSION: It is fun, satisfying, comfy and, most importantly, AI free. Learning how the system works feels good partly because the barrier to learning the system and contributing to it is actually much lower than in other systems. I have come to love it, principally, because it has a certain degree of “humanity” that makes it a joy to use.
i love your mailing list, i learn so much about literally everything every single day from misc@
You may have me mistaken with someone else haha. That being said maybe I should start one lol
I’m talking about the openbsd mailing list lol
I’ve been using Debian for a long time and honestly, I’m not going to worry about this too much as of today. We got that decision, yes. But I don’t think I’ve seen any consequences, yet. And I always try to judge people by what they actually do. Less so by what they say.
I say that the last word hasn’t been said yet. On this whole AI thing. We still got many Linux people who don’t really appreciate AI. The entire community isn’t really fond of it. We got people who say there isn’t a way to make use of it responsibly. I have a hunch there’s more to this story. But only time will tell. Until then I’m going to continue using Debian, just like I have for the past 10-15 years. I trust the community distributions, they faced other challenges before. And usually they’re not half bad at facing challenges and ultimately doing the right thing.
Doesn’t have to be easy. Sometimes we’re headed the wrong direction for a while. But what matters IMO is the result. And I’m positive they’ll find some way to deal with this. I don’t think AI fits Debian’s identity at all. Would be a big surprise to me if they don’t realize it as well.
AI is a tool. You already trust the developers to build an operating system with the tools available.
From the Debian announcement
The Debian Project nevertheless expects that all contributions submitted to Debian, regardless of how and with which tools they were produced, satisfy the same standards of quality, correctness, maintainability, and legal compliance. The use of a generative AI tool does not diminish the contributor’s responsibility for the work they submit. Contributors are expected to understand, review, test, and, where appropriate, modify AI-assisted output before incorporating it into Debian. Blindly accepting or uploading AI-generated material without appropriate human review is inconsistent with Debian’s established development practices.
It’s quite clear they don’t allow vibe coding. As you say, the kernal itself allows AI contributions in a similar way.
If you’re worried about the ethical aspects of AI then you’ll probably have to move to NetBSD. If you’re only worried about quality this is a non issue.
What is this responsible? How can AI commits be responsible? There are thousands of reasons to not use AI, and the primary reason is AI is a thief.
I feel like you aren’t actually asking a legitimate question and are just trying to soapbox, but this is covered by Debian here: https://lists.debian.org/debian-devel-announce/2026/08/msg00005.html
As far as what the consequences of failing to follow that policy is, it would be covered under the Debian code of conduct: https://www.debian.org/code_of_conduct_interpretation.html
NOTE: I am not a Debian user. I just performed a basic search to find the answer to that question.
