A lot of it is very explicit definitions so there’s no ambiguity, and reasoning to explain why. None of the reasoning is quality of the code, which is what most people assume is the reason.
The SciActive Human Contribution Policy is a free, general contribution policy meant to safeguard projects from the inherent legal and security risks of AI generated contributions.
Boy it’s amazing how people ignore the security track record of human authored code over the last 30 years. One need only look at the recent explosion of discovered vulnerabilities by AI.
AI tends to “discover” previously discovered vulnerabilities, or obvious vulnerabilities. It also tends to hallucinate vulnerabilities. I’m not saying it’s useless at discovering vulnerabilities, just that a human audit is better.
The policy also doesn’t say you can’t use AI to audit a code base, or even a single diff, so that point is moot.
AI tends to “discover” previously discovered vulnerabilities,
Friend - your information is very out-of-date. It’s accelerating the discovery of vulnerabilities like crazy. I’m not saying we’ve hit singularity (or even that we will) but to brush it all off as “it only finds things we already knew about” is copium at this point.
I think you’re also missing the bigger point that the policy does not prevent you from auditing your code base with AI. That is completely, 100% allowed under this policy.
It sounds like their policy is basically the same as Human Contribution Policy 2-TR. That’s awesome.
I just skimmed over the text. That’s just a lot of words for saying “no ai”.
Personally, I like debian’s approach more. They put some granularity of levels as to when and how much ai assistance can you take.
But I can totally see that void, being the profile of users and devs they got, would prefer to be way more radical.
A lot of it is very explicit definitions so there’s no ambiguity, and reasoning to explain why. None of the reasoning is quality of the code, which is what most people assume is the reason.
Boy it’s amazing how people ignore the security track record of human authored code over the last 30 years. One need only look at the recent explosion of discovered vulnerabilities by AI.
This license is fud.
Nobody is ignoring anything.
It’s not a license, it’s a policy.
AI tends to “discover” previously discovered vulnerabilities, or obvious vulnerabilities. It also tends to hallucinate vulnerabilities. I’m not saying it’s useless at discovering vulnerabilities, just that a human audit is better.
The policy also doesn’t say you can’t use AI to audit a code base, or even a single diff, so that point is moot.
Friend - your information is very out-of-date. It’s accelerating the discovery of vulnerabilities like crazy. I’m not saying we’ve hit singularity (or even that we will) but to brush it all off as “it only finds things we already knew about” is copium at this point.
Well it’s a good thing I didn’t say that then. xD
I think you’re also missing the bigger point that the policy does not prevent you from auditing your code base with AI. That is completely, 100% allowed under this policy.
Reading comprehension is important.