Hi, On Tue, 27 Oct 2026 12:22:44 +0100 Ludovic Courtès <[email protected]> wrote:
> Well, just yesterday I realized that I had been on my free time > reviewing patches (presumably LLM-generated, given the pace) adding > packages for vibe-coded software with, very likely, no user other than > its “author”—which to me is blatant disrespect of volunteer time². I don't think that the number of users is a good criteria as most projects don't track users, and a criteria about that would probably open a can of worms. An example is that GNU Hello probably has no serious users, though it is useful *and properly maintained*. I have several other examples in mind as well and I'd prefer them to stay in Guix. However there are real maintenance concern about software that is 100% vibecoded, which tend to not be a concern with well made software with very few users: - It may not be legal to redistribute at all. Here the substitute servers and/or anybody that redistributes it might be at risk. We already had a discussion about (not) redistributing binaries of the ZFS kenrel module in the past. - The software may not be maintained at all. I was refused a useful package on that basis, and usually distributions do remove unmaintained software unless they are dependencies of software that is maintained. - If such software gain users somehow, the question is also if it's possible to contribute without having to personally run an LLM (which often comes with terms and conditions) because the code is such a mess than doing large scale modifications does in practice requires an LLM. Though some forges also have unacceptable terms of services, and I think this is also a very serious issue as well. Personally my take on that would be to have criteria that can tell if some software is OK or not OK, and have multiple distributions follow these in order to not be alone and share work and/or constraints / pressure on upstreams to not mess up to the point where distributions would refuse to package them. This would also lower the costs globally because if each distribution has its own rules, the cost of compliance for new contributors or upstream would be prohibitive. I've wanted to discuss that privately with GNU but If I understood well, they are are working on criteria(s) that could fit that goal. So again we need to wait and again if we go alone here that might not be very productive. Though we could probably do some kind of moratorium to address the community concern if we have to. But given that common sense (don't package software with potential copyright issues, unmaintained software, software that requires LLM to be modified, etc may be able to cover 99% of the cases.
pgpfEwn5NGiWW.pgp
Description: OpenPGP digital signature
