Seems short sighted for an interim policy, to me. Why not just require clear and detailed disclosure of the use of said tools, to generate data for which to make a properly informed non interim decision?
My prophecy is that in 3 years we'll see a complete reversal of this. Using GenAI to code will be the default and we'll see policies that put limits on human/artisan development. Possibly even projects that outright ban non-LLM development.
AI contribution is basically just "prompt + AI work". Even if you are okay with AI work per se, you should accept prompts (after reviewing them) and let your own AI generate the code (and then also review the code)... rather then accept an output of someone else's AI with an unknown prompt, that may or may not include an instruction to create a vulnerability.
In the age of AI, the prompt is becoming the actual source code. Accepting AI-generated code would be like accepting binary code from unknown source.
This doesn't match my experience with prompting AI at all. In every professional application of AI I've seen, there are a huge number of variables and inputs, over many turns, that produce the output. We see radically different results across different engineers using AI, and that variance is not 100% attributable to the prompt. I don't even think it's 50% attributable. See sibling comment for some delineation of these additional parameters.
The correct policy is what Linux adopted. "We don't care what tools you use, provide high-quality PRs."
> Most generative AI tools, however, are trained on copyrighted and licensed content, and their output can include content that infringes those copyrights and licenses
To some extent, it feels like the genie is out of the bottle on this. There's so much LLM-generated code out there, and I'm sure plenty of it could be argued to infringe a copyright or license (though I think the legal bar for counting as infringement is set too low), that there's no way to go back and undo it.
That said, OpenJDK might be afraid that someone will decide to make an example of them because they are a high-profile target.
11 comments
[ 0.19 ms ] story [ 8.5 ms ] threadIt states in part:
> Until that policy is in place, the Governing Board has approved this interim policy:
> Contributions in the OpenJDK Community must not include content generated, in part or in full, by large language models...
Note, this would exclude most spell checkers, as they often are LLM based. That said, they do soften this with the addition:
> Q: Is it okay to continue using the spell-checking, grammar-checking, auto-completion, and refactoring features in my editor or IDE?
> A: Yes, so long as they are not based on large language models or similar deep-learning systems.
This addition will likely not help as most spell checkers are OS/IDE services and their implementation details are opaque to users.
AI contribution is basically just "prompt + AI work". Even if you are okay with AI work per se, you should accept prompts (after reviewing them) and let your own AI generate the code (and then also review the code)... rather then accept an output of someone else's AI with an unknown prompt, that may or may not include an instruction to create a vulnerability.
In the age of AI, the prompt is becoming the actual source code. Accepting AI-generated code would be like accepting binary code from unknown source.
The correct policy is what Linux adopted. "We don't care what tools you use, provide high-quality PRs."
To some extent, it feels like the genie is out of the bottle on this. There's so much LLM-generated code out there, and I'm sure plenty of it could be argued to infringe a copyright or license (though I think the legal bar for counting as infringement is set too low), that there's no way to go back and undo it.
That said, OpenJDK might be afraid that someone will decide to make an example of them because they are a high-profile target.