Codeberg: Protecting our FLOSS commons from LLMs

Last week I closed two "security issues" (which to their credit, included "fixes") that were premised on an extremely verbose "analysis" that fundamentally misconstrued the operating environment of the code in question [1]. This reduced the scope from OMGCRITICAL "security vulnerability" to mere bugs, except it also got the specifics completely wrong.

Then, after closing those issues, I re-disabled MRs entirely as the GH repo has always just been a secondary mirror.

[1] Completely offline device. One would need direct physical access [2] to exfiltrate data after a successful attack. But if one already has direct physical access... why not just exfiltrate the data directly in the first place?
[2] ie connect to it via USB or eject an SD card and plug it into a card reader

> Content that harms the reputation of Codeberg, such as cryptocurrency related projects.

This is not mentioned in the blog, but is announced along with the LLM policies in a banner at the top of the site.

I could be wrong[*] but I don't think the decision is that binary. It is certainly "LLM-hostile" but maybe not that hostile.

> I don't even know whether a line of code in my projects is LLM-generated or not. Because it doesn't matter.

The reasons why it matters are very well explained in the blog. You may disagree with them but don't dismiss them without reading them. Don't "delete everything" without reading either.

[*] I don't have anything on codeberg, so I didn't read every fine print.

PS: I think the biggest irony with AI is: it's making computers less binary and humans more binary at the same time :-) To be more accurate: it's anti-social media that made humans more binary slightly before AI - still very ironic to see both happening at almost the same time.

Anti-social media is also boosting celibacy like never before, so Skynet is not happening like Terminator predicted but maybe the machines really are taking over :-)

There are clearly a lot of people who disagree with you there, starting with the 358 people who voted for it!

From what I've read over the last ~year, there are a _lot_ of people who strongly believe that code should not be generated by LLMs (and it appears a fair subset of those believe that AI should not be used at all, for anything, ever). This decision will make Codeberg very attractive to these people, so I very much doubt it will "kill" it; rather, I think it will only make Codeberg even stronger within that market.

Just yesterday at $DAYJOB, the subject of the zig bun fiasco came up, during which I pointed out that the Zig project strictly disallows AI generated code contributions. A colleague immediately responded with something to the effect of "well, that's going to make sure no one uses Zig, then". To which I rebutted that no, it won't kill Zig, it will simply create a strong correlation between "those who use Zig" and "those who are against using AI for code generation". They didn't back down, so I left it at that; they seemed to have used exactly the same questionable logic as saying "being against AI will kill Codeberg".

And I say the above as someone who is (strangely?) more-or-less neutral in this whole AI "debate".

In practice I think this is a good decision. It will let them focus their limited resources on hosting projects that do more with less, rather than hosting generated content that objectively requires orders of magnitude more resources to do the same thing. As someone who has on numerous occasions struggled to access Codeberg with it being slow or completely unavailable for periods of time, I am very much on board with this movement.

It is worth taking note, by the way, of the following section of the Codeberg blog post, which confirms that you're not just going to be taken down for having "a tiny bit of LLM poison" in your repo:

> Some early, but informal guidelines
>
> If your work fits into these cases, it is unlikely that you are affected at all:
>
> - Projects who have an active community that cares about and maintains the software
> - Projects with a significant pre-LLM history
> - Maintainers who unknowingly or willingly accepted LLM-generated contributions from other contributors, if your project otherwise does not involve the heavy use of LLMs

Hey, see it positive, at least you're not one of those guys who believes GPL is anti-FLOSS because it's too restrictive.

It's also unlikely that, if a moderator reaches out and does find you violation - which they might not -, they'd immediately cut you off and delete your software. That's what billionaire-owned businesses do, not entities that want to be good stewards.

But at the same time, it *does* seem to have the intended effect: the people who don't think of their software as "not LLM generated" leave.

You are misunderstanding things, because that already happened, it already died several times due to LLM scraper bots and the sysadmins have gallantly resurrected it. Even if the official justification isn't perfectly thought out, this is a valid reaction in self defense. Once LLM scraper bots stop pounding every significant git server at usually thousands of times higher rates than humans, we can have a different kind of discussion.

I, too, was puzzled by Codeberg's seemingly weird attitude towards solo developers that kept cropping up in phrases like, "It seems like many ‘vibe coders’ don't realize that they don't actually have a community around them." I mean, there's a surprising amount of code in major Linux distributions developed by people who don't have "a community around them." The brutal fact is that XKCD is right (https://xkcd.com/2347/), and a lot of foundational code is kept running by one unpaid volunteer. Or it's effectively abandoned, and the distros pass around patchsets to keep it building, with no upstream to ever merge patches. Community can be a damn scarce thing in the open source world sometimes. Goodness knows that 1,000 stars on GitHub frequently results in 3 drive-by PRs in 5 years.

Personally, while I have real concerns about where this whole AI thing is going, I'm genuinely happy to see end users using LLMs to throw together personal software. Now they have software that does exactly what they need, that doesn't spy on them, and that they can customize. When I got involved in free software several decades ago, that was originally the dream: Users in control of their own systems, with the freedom to change things! But now there's apparently a political movement in the "open source" community which is aggressively criticizing these users for figuring out a way to put together custom tools.

Sure, frontier models are way too electricity hungry. But we've reached the point where there are MIT-licensed, open-weight coding models that run on 5 year old gaming GPUs, and that use about 280W when generating. They sure aren't Fable, but they do actually work. Stick 'em in a read-only sandbox (like your tool supports) and they can even help troubleshoot a Linux system, keeping all the data 100% local. It was a revelation the first time I asked a local model, "Ugh, what's wrong with systemd?", and it actually figured it all out.

I do dread many of the places this all might go. But seeing users take control over their computers? That's the one undeniably bright spot, to my eyes.