Open Source Software Community - it's about ethics in Code of Conducts

  • 🔎 If you see an alert for analytics.usips.org, this is a self-hosted system I am running as a test. It is GDPR compliant and collects no invasive information.
  • Want to keep track of this thread?
    Accounts can bookmark posts, watch threads for updates, and jump back to where you stopped reading.
    Create account
dame dudi jench said:
I just did this at work the other day to liberate something we wanted to use from GPL. Vibe-coding is when you use code from a single naked prompt. our harness has like 30 subagents with a bunch of different skill files that you train recursively with an update skill-skill mid session. A code monkey did it in a weekend when it would have taken a month or more in beforetimes.

You do it in a clean room by having one LLM scan the project to come up with a requirements / features document, then you feed the requirements doc into a different model and session so it creates a project with the same functionality but it doesn't infringe any of the code. Then you manually review and clean up the code and it's as easy as maintaining any other piece of code. People have been shitting themselves about this all year.

The stupid thing is this whole kabuki dance is only needed if you're a law-abiding western company. Chinese and Indian devs just steal the GPL code and nobody ever finds out. Another way the GPL is communist, it transfers wealth and IP from the first world to the third world.


Click to expand...
The death of the GPL can't come soon enough!
 
I think the problem with coding via LLMs is that many vibecoders do not have the experience and knowledge required to even imagine how a project they instruct the LLM to do should actually look like in principle. LLMs can make reasonable decisions to a degree, but even the frontier models (at least right now) really struggle "seeing the bigger picture" and what is important and what isn't. They'll still try to do their best though and that's how you get these vibecoded projects that just seem to have turned unmaintainable past a point. LLMs are really powerful (I'd even say superhuman) at sheer brute-force problem solving a very set goal, but sometimes that's just not what's required.

If you can give the LLM a very detailed design document of what you want, how you want it done, what should be used to get it done, what pitfalls to look out for etc.. they do really, really well, especially if it can be broken up into smaller tasks. They can even knock out programs of medium complexity almost shockingly fast that way. Of course this requires knowledge and experience on your part. Can't write the design for something you don't really understand yourself and that's where the problem with the vast majority of viebecoded projects lies; the vibecoder has no idea what he's doing and even less idea what the LLM he instructed to do it is doing. That's a recipe for disaster.
 
Max Weber said:
Speaking of which, someone is vibe-cloning Adobe's suite: site, github. In Rust, naturally.

What happens first: the project dies on its own or Adobe rapes them into oblivion?
Click to expand...

Well, Gimp and Inkscape have been around forever, not to mention all of the closed-source image and vector editing apps. So I'm guessing Adobe will do nothing. It'd help if they didn't explicitly label these tools as "reimplementation of (Adobe tool)," though.

That said, the web site says they're "built the hard way" and "written from scratch." Are they actually vibe-coded, or do words have no fucking meaning anymore?

dame dudi jench said:
I just did this at work the other day to liberate something we wanted to use from GPL. Vibe-coding is when you use code from a single naked prompt. our harness has like 30 subagents with a bunch of different skill files that you train recursively with an update skill-skill mid session. A code monkey did it in a weekend when it would have taken a month or more in beforetimes.
Click to expand...

"Um akshually, it's not vibe-coded, because we used more than one robot and they edited a bunch of Markdown files too." :story:

Come on, bro. We know what you did. You know what you did.
 
AmpleApricots said:
If you can give the LLM a very detailed design document of what you want, how you want it done, what should be used to get it done, what pitfalls to look out for etc.. they do really, really well, especially if it can be broken up into smaller tasks. They can even knock out programs of medium complexity almost shockingly fast that way. Of course this requires knowledge and experience on your part. Can't write the design for something you don't really understand yourself and that's where the problem with the vast majority of viebecoded projects lies; the vibecoder has no idea what he's doing and even less idea what the LLM he instructed to do it is doing. That's a recipe for disaster.
Click to expand...
yeah, that's uniquely a problem for open source projects. now anyone trying to pad their github stats can toss slop grenades at projects and there's not much you can do unless you make contributors interview before they can submit code. we are seeing a lot of corporations ban use of AI in email b/c it is intolerable to wade through that shit. social shame and affirmative norm-setting about how AI is used is going to be much better than trying to resist it entirely.


Least Concern said:
Um akshually, it's not vibe-coded, because we used more than one robot and they edited a bunch of Markdown files too." :story:

Come on, bro. We know what you did. You know what you did.
Click to expand...
it's vibe coding if you don't know what you're doing. it's a far cheaper way of having a team of 10-15 poles or viet cong outsourced competent but unimaginative coders executing on your instructions if you do.
 
Last edited:
A bizarre situation went down between Photopea and a new "vibe coded" clone of it (which is, in turn, a web browser clone of Photoshop, but predating modern LLMs), we're talking a near 1:1 clone with practically identical UI, features, et cetera where most of the effort went into mechanically shuffling code around and rebranding. Unfortunately much about it was not archived, but it's interesting as a case study about what's happening (and is going to become much more frequent for both FOSS *and* proprietary programs of all kinds being trivially reverse-engineered through the assistance, or total autonomy besides an initial prompt by anyone, of LLMs). GitHub eventually took the repository down (archive), the issue where discussion went down between the Photopea author and some bots (and/or clueless vibecoders) deployed to defend the author is also not archived in its entirety (archive) and was deleted by the clone's author before the takedown anyway. Parallel to that, there was discussion on HN (post 1, post 2), and in a very funny and petty move someone deployed bots analyzing Photopea's source code in search of any violations to report after the situation went down (direct link, archive).

Photopea is notoriously "nagware" or "begware": it would restrict access to users using ad blockers (github issue), after claiming he would be "tolerating" them despite "losing 1k a day" (github issue #2).
Meanwhile, while the above situation was developing, a new project has popped up by a reddit user going as "ai_art_is_art" (reddit link to one of his posts), with his motto being " To AI haters: AI is just a tool. It can be used by real artists to make real art. It's all in how the tool is used. We used to hate CGI, digital music, and even photography. Now they're normal. Adapt.", and the project being Adobe Creative "cleanroom" ports to Rust (github page).

We're already past the inflection point where even casual users can trivially replicate any piece of software running on their machine and re-implement it in their language of choice with one singular prompt, and it's already being done with games getting the most attention, being ported to bevy, etc. What does it mean for free and open source software if anything running on your machine and not served remotely can be trivially reimplemented, in some cases not even needing the original source code but just a spec and some screenshots? Interesting times..
 
Back the topic of "clean room" reimplementations of GPLed code, now that I think about it, such a thing might not even be possible in the truest sense because if the GPLed project is older than the LLM, then there's a pretty good chance that its code was in the heap that the LLM was trained on. You could do clean room reimplementations of something with a human developer since you could have some reasonable expectation that even if someone did see some of the original code, they almost certainly wouldn't be able to remember significant parts of it. You can't have the same assurance of an LLM. It'll be interesting to see how things fall if this stuff ever gets decided in court.

And then there's the whole matter of HuggingFaceGate and other examples of LLMs doing sneaky things to get their jobs done. A non-airgapped robot might just solve the problem of "reimplement X" by grabbing X's source code, pasting it in, then maybe changing some of the method names a little so it doesn't look like it completely copied someone else's homework. If there's nobody who's following up on what it creates to make sure it's genuinely novel (to the extent that any LLM output can be), something like that's bound to happen eventually.
 
Least Concern said:
It'll be interesting to see how things fall if this stuff ever gets decided in court.
Click to expand...
I think going after LLM code in court would be a disaster for copyright, in that I believe there's a huge chance for a judge to rule in favor of the LLM code. I can't really articulate why I believe this because it's just a feeling I'm still trying to explain. There's also just no way to put the genie back in the bottle, and training an LLM on "how" to program would likely result in the same shit.
 
Dante Alighieri said:
I think going after LLM code in court would be a disaster for copyright, in that I believe there's a huge chance for a judge to rule in favor of the LLM code. I can't really articulate why I believe this because it's just a feeling I'm still trying to explain. There's also just no way to put the genie back in the bottle, and training an LLM on "how" to program would likely result in the same shit.
Click to expand...
The LLM would win a crushing victory.
Unless the LLM would just do a blatant copy of a work (which they don't), the LLM output is definitely transformative and thus explicitly allowed under fair use.

Should they go after the guy that made TheBackrooms and sue him for copyright infringement because he obviously has read HouseOfLeaves and probably also played TheEvilWithin and created a new unique work that looks heavily inspired from both?
Of course not. That would be silly.
Same thing with an LLM, if it scans something and then just uses it for inspiration, mixing it with a million other things and produces some output, it is exactly the same thing.
The only legal question is who owns copyright on the new work, the LLM itself or the person that wrote the prompt.

But the bigger reason why the LLM will win is because the companies behind AI have significantly more money to spend on legal expenses than Disney and Penguin Books, at least for now.
 
Least Concern said:
Back the topic of "clean room" reimplementations of GPLed code, now that I think about it, such a thing might not even be possible in the truest sense because if the GPLed project is older than the LLM, then there's a pretty good chance that its code was in the heap that the LLM was trained on. You could do clean room reimplementations of something with a human developer since you could have some reasonable expectation that even if someone did see some of the original code, they almost certainly wouldn't be able to remember significant parts of it. You can't have the same assurance of an LLM. It'll be interesting to see how things fall if this stuff ever gets decided in court.

And then there's the whole matter of HuggingFaceGate and other examples of LLMs doing sneaky things to get their jobs done. A non-airgapped robot might just solve the problem of "reimplement X" by grabbing X's source code, pasting it in, then maybe changing some of the method names a little so it doesn't look like it completely copied someone else's homework. If there's nobody who's following up on what it creates to make sure it's genuinely novel (to the extent that any LLM output can be), something like that's bound to happen eventually.
Click to expand...
Dante Alighieri said:
I think going after LLM code in court would be a disaster for copyright, in that I believe there's a huge chance for a judge to rule in favor of the LLM code. I can't really articulate why I believe this because it's just a feeling I'm still trying to explain. There's also just no way to put the genie back in the bottle, and training an LLM on "how" to program would likely result in the same shit.
Click to expand...

how copyright maps onto computer code is interesting before you get to AI. the only thing you can hold a clean copyright in is the programming language itself (or libraries etc.). code is just different permutations of commands within a copyrighted language. it's always been the case that if you can show you created a work independently without reference to the work you're allegedly infringing, you don't violate the copyright even if the words/code is literally identical. another way to think of it is that copying code purely to create a requirement document/teardown is fair use. that is where clean room development got started. it was always a way of copying software without violating copyright, it just took two teams of coders working on a double-blind basis instead of two agents. Computer Associates v. Altai (2d Cir. 1992) is the seminal clean room coding case. The Google v. Oracle 2021 scotus decision gets into how thin copyright protection of code is.

so even if a model was exposed to the code in its training data, unless a substantial and expressive portion of the code it wrote here is literally identical, you wouldn't have copyright infringement. this is all super academic anyway, because in practice if you were going to do this, you would do two things: (1) you'd have the second agent write the program in a different language (often a huge lift for humans, easy for AI) so there is very little risk of copyright infringement and (2) have a third model or second human review the new code base to identify anything that looks like it had been copied (like variable names) to ensure nothing remains from the original program. people (including me) had assumed that software has had a strong moat around competitors just copying it because of underlying copyright protections inherent in code. it turns out the real barrier was the labor cost and time involved in a traditional clean room coding process, and AI has eroded those completely. kind of like how the content industry could tolerate piracy when it was high-friction with tape recorders and BBS uploads, but once things went digital and p2p it destroyed the equilibrium.

on training data cases we have seen, the fair use analysis most of the time has come down to whether or not the person doing the training is a competitor doing it for a use that will harm the owner of the training data. As long as the use wasn't for a directly competing product courts have generally held fair use. Thomson Reuters v. ROSS is the exception and that's b/c the infringer trained its product on a competitor's product to spit out competing legal case notes on the same cases.

the tricky edge case to me is, if for some reason you can't use the clean room approach of three triple-blind models, you give a single model the instructions "make a program that has all the functionality of the linked github, spit out the code in another language and ensure that no code is infringing". We give humans instructions to make "legally distinct version of [XYZ]" all the time and this is no different, but a lot of people's intuitions are that it feels wrong and so i think you'll see lots of confused case law on those kinds of facts.
 
Last edited:
dame dudi jench said:
yeah, that's uniquely a problem for open source projects. now anyone trying to pad their github stats can toss slop grenades at projects and there's not much you can do unless you make contributors interview before they can submit code. we are seeing a lot of corporations ban use of AI in email b/c it is intolerable to wade through that shit. social shame and affirmative norm-setting about how AI is used is going to be much better than trying to resist it entirely.
Click to expand...
Well, there's a not-unique solution to that problem: Make the source code available, but don't accept any outside contributions. Problem solved. After all, why should they accept AI submissions when they could just use an AI themselves and cut out the middle-man? This also cuts out the problem of receiving submission-spam from fucking jeets and chinks, too, so it's a win all around.
 
Cherenkovblue said:
Well, there's a not-unique solution to that problem: Make the source code available, but don't accept any outside contributions. Problem solved. After all, why should they accept AI submissions when they could just use an AI themselves and cut out the middle-man? This also cuts out the problem of receiving submission-spam from fucking jeets and chinks, too, so it's a win all around.
Click to expand...
People like coding because it is fun for them to code, right? I would expect a lot of people do open source as hobby projects they want to have fun with, and so will want to hand-code the parts they enjoy and automate the rest. It's also fun for people to collaborate with others to build a project, and AI is a terrible thought partner. A healthy project wants smart thoughtful people to contribute their perspective and ideas as much actual code. I believe that over time open source volunteering will represent a lot of "gym time" for coders as workplaces become more automated. Using AI too much makes you cognitively flabby, there's a misalignment of incentives between employers, who want to maximize productivity by turning people into autocomplete button pushers, and employees, who want to retain the skills and abilities that make them valuable
 
Least Concern said:
Back the topic of "clean room" reimplementations of GPLed code, now that I think about it, such a thing might not even be possible in the truest sense because if the GPLed project is older than the LLM, then there's a pretty good chance that its code was in the heap that the LLM was trained on. You could do clean room reimplementations of something with a human developer since you could have some reasonable expectation that even if someone did see some of the original code, they almost certainly wouldn't be able to remember significant parts of it. You can't have the same assurance of an LLM. It'll be interesting to see how things fall if this stuff ever gets decided in court.

And then there's the whole matter of HuggingFaceGate and other examples of LLMs doing sneaky things to get their jobs done. A non-airgapped robot might just solve the problem of "reimplement X" by grabbing X's source code, pasting it in, then maybe changing some of the method names a little so it doesn't look like it completely copied someone else's homework. If there's nobody who's following up on what it creates to make sure it's genuinely novel (to the extent that any LLM output can be), something like that's bound to happen eventually.
Click to expand...
Copyright is over, a ridiculous concept since it's inception. A total fiction. A state granted monopoly based on the fictional and demonstrably wrong assumption that these monopolies would encourage more works to be created. In reality, it has the opposite effect. The entire conceptual basis of copyright is a just wrong, and a failed policy that did the opposite of what it was intended to do.

I like how the T2 Linux guy, who is like "clean room reverse engineer this drivers" is basically using LLMs to launder the non-clean room methodologies. It's all so fake and it's so obvious now.
 
CrunkLord420 said:
Copyright is over, a ridiculous concept since it's inception. A total fiction. A state granted monopoly based on the fictional and demonstrably wrong assumption that these monopolies would encourage more works to be created. In reality, it has the opposite effect. The entire conceptual basis of copyright is a just wrong, and a failed policy that did the opposite of what it was intended to do.

I like how the T2 Linux guy, who is like "clean room reverse engineer this drivers" is basically using LLMs to launder the non-clean room methodologies. It's all so fake and it's so obvious now.
Click to expand...
Fuck copyright, all my homies hate copyright
 
CrunkLord420 said:
Copyright is over, a ridiculous concept since it's inception. A total fiction. A state granted monopoly based on the fictional and demonstrably wrong assumption that these monopolies would encourage more works to be created. In reality, it has the opposite effect. The entire conceptual basis of copyright is a just wrong, and a failed policy that did the opposite of what it was intended to do.
Click to expand...

I'm not necessarily disagreeing with you about the moral aspects of this question. There are certainly a lot of things that I think are perfectly moral and shouldn't be illegal. But they are illegal nonetheless, and not everyone has the ability to just not care about that aspect of the act.
 
Last edited:
CrunkLord420 said:
Copyright is over, a ridiculous concept since it's inception. A total fiction. A state granted monopoly based on the fictional and demonstrably wrong assumption that these monopolies would encourage more works to be created.
Click to expand...
The original copyright term was ten years. It worked fine as a time-limited monopoly at that time. It's when didney expanded it out to lifetime of the artist plus forever that it went stupid.

Still, if copyright goes, we'll just see orgs lean even further into data acquisition and the use of other mechanisms to enforce control over who can access their hoards. Everything will turn on access to remote APIs, which will have contractually-enforced access requirements. Breaching those terms, for instance to exfiltrate data or trade secrets, will get you sued instead.
 
LLM weights also don't store any code, copyrighted or otherwise. The argument already falls apart at that point. They were definitively trained on code, but so where you if you program. This has been discussed to death in the art sphere and there have even been lawsuits of artists against companies training on their art, and the general trend of how these lawsuits go is that courts are definitively not ready to claim AI art is copyright infringement, nor are the chances great that companies can be stopped from training on copyrighted works, on account of how training works and what it really does. It'll be the same for code.

My guess is the biggest legal pushback will probably come from the music industry, if that won't work out then this discussion is truly over.
 
You must log in or register to reply here.
Back
Top Bottom