Debian permits generative AI contributions, keeps contributors fully accountable
- Debian's general-resolution vote selected "Responsible Use of Generative AI": the project neither endorses nor prohibits generative AI in software, packaging, documentation, or other published media.
- The resolution says AI tools can improve contributor productivity, but every submission must meet the same quality, correctness, maintainability, and legal compliance standards regardless of how it was produced.
- Contributors remain responsible for AI-assisted work and must understand, review, test, and where appropriate modify generated output before incorporating it into Debian.
- In LWN's discussion, commenter bluca said proposals to change the Social Contract or Code of Conduct failed to beat "None of the Above", while mhvk read the vote graph as showing about 30% preferred no-AI options over all others.
- Hacker News commenters generally supported tool-neutral accountability, while raising concerns about copyright ownership, review overload from agent-generated code, and agents causing unintended harm.
Hacker News opinions
I hope this goes better than Microsoft's use of generative AI in Windows 11. Do we actually know Windows 11 got worse because of it, though? I've heard Microsoft used AI to find and fix common security issues at scale.
I'm glad the hysterical, quasi-religious objections lost. The anti-AI case is an ethical argument, though, and dismissing opponents that way can sound like calling them insane or victims of propaganda.
I can accept the policy: AI or not, the submitted code is still my responsibility. A reviewer should be able to ask me to explain it, and I should stand behind the result.
At work, that policy falls apart when management expects much faster delivery. Burned-out developers dump agent output into review, and the review burden becomes badly asymmetric.
The useful rule is to judge AI-generated code exactly as if I wrote it myself. If I repeatedly submit slop, maintainers should reject my work or ban me, rather than blame the model.
I worry about ownership. Copyright attaches to human creation, and there is no settled law on whether the prompter owns AI-assisted code, whether nobody owns it, or whether Debian can safely accept it.
"Responsible" is vague. People will submit code they do not understand, comprehension will drop, and maintainers may need to quiz contributors and reject PRs as AI slop.
A blanket ban would also prohibit mundane use, like having an agent figure out how to build a flashable TWRP ZIP because I do not care to learn Android packaging details. Volunteers may stop contributing if they cannot use tools they prefer, but bad output still deserves rejection.
Current agents can go rogue, as the Hugging Face hack showed. If the human who triggered an agent is fully responsible for unintended harm, organizations may end up limiting AI to autocomplete-style use.
I think the range of proposals was useful even though the moderate one won. Without alternatives, the vote would not necessarily show what Debian voters actually wanted.