Fedora and Mesa's New AI Policy

Violet Kurtz

EDIT: I do not want to be misconstrued here. I absolutely do not like Fedora's policies or Mesa's policies. I do believe Mesa's are overall better. I want to be convinced that I am overly pessimistic about the feasibility of enforcing a "no AI" rule. Given that much of open source is volunteer-run, I harbor immense sympathy for those maintainers who have to put up with this garbage.

Now, on to the actual post.

What are we doing here. How the heck did we let this "Generative AI" nonsense become so prevalent that this is necessary.

Summary of problems with Generative AI (within this context, some of these are general points against Generative AI as well):

  • Because it is effectively a statistical regression model with an ungodly number of parameters, it has no intrinsic understanding of what it is saying or of what truth or correctness is. All it knows is that what it is saying is statistically likely to be something that would get said. That lack of understanding makes it untrustworthy.
  • The sheer size of the model means that using it requires significantly more energy than traditional methods of doing the same task. I believe I saw a source at one point saying that compared to traditional Google searching, it takes one or two orders of magnitude more energy to perform a lookup task. This energy consumption is massively destructive in a world where even before Generative AI we were in desperate need of reducing energy consumption.
  • The rise of so-called "vibe coding" means that people are using Generative AI to write code where they have zero understanding of how it works. It should be very obvious why this is a problem for contributing code.
  • Additionally, because Generative AI is trained on existing works, particularly works that are under licenses which would not permit non-consented reuse, and because Generative AI is a statistical model, it is not unheard of and in fact common for it to just output code it has already seen verbatim in violation of any licenses. Again, it should be very obvious why this is a problem for contributing code.

I have issues with Generative AI beyond this which are not necessarily relevant to this specific problem being discussed today.

So tl;dr Generative AI should absolutely not be used for contributing code to projects. At least one of those problems should make Generative AI considered to be too high of a risk to be criminal theft by default. Another is a situation which makes it significantly harder for a responsible project maintainer to ensure good code is coming in. You really want the person who wrote the code you're including in your project to understand why it works!

Fedora and Mesa both adjusted their contribution policies to permit Generative AI contributions. I will briefly go over some of the points in these policies while discussing what my overall stance is on it.

Starting with Fedora, their policies basically summarize to:

  • You must disclose the use of AI
  • AI must not be the final arbiter in deciding what code is good for including. A human must make the final call with their own judgement.

That second point is very good. It helps to ensure that any code that is contributed actually does its job and has been properly vetted. The first point... I am mixed on. It allows Generative AI. I do not like that. It requires disclosure. I do like that. If it is known what code was contributed using Generative AI, then it is possible to keep an eye on that specific code for license issues. I still do not like the use of this technology at all, particularly given the environmental impact. However, at least we know which code is AI generated (I don't want to say "Generative AI" every time so please understand that when I say "AI" that is what I mean) so it can be monitored and addressed where needed and possible.

On the other hand, there is a possibility of the disclosure being used as propaganda and promotion for generative AI. "Look at what it can do!" and such.

Let me be clear, I do not like that Fedora is allowing AI code. I wish it were outright banned. However, there is an unfortunate truth - people are using AI to generate code. If it were outright banned, they would simply... not tell anyone. And because AI generates code that is "statistically likely to be written", it can look convincingly real while still being bad at its job, particularly given there is only so much time reviewers can dedicate to actually going over it. As a result, while there could be a policy of "if we catch you using AI, we ban you from contributing", I do not believe this is even remotely feasible without wasting a lot of time and resources. Sure, an AI contributor may get banned here or there, but the rest wouldn't stop. They'd just get better at hiding it. I hope that I am being overly pessimistic on this.

Moving on from Fedora to Mesa, which is far more important to the overall Linux ecosystem because rather than being an individual distribution, it is the graphics stack that most everyone uses. They changed their guidelines to permit AI recently.

Uh oh!

Here is the entire portion of their policy on the use of AI (source):

The submitter is responsible for the code change, regardless of where that code change came from, whether they wrote it themselves, used an “AI” or other tool, or got it from someone else. That responsibility includes making sure that the code change can be submitted under the MIT license that Mesa uses.

The submitter needs to understand what code they are changing, what the change does, and justify that change in the commit messages. Using coding assistants or “AI” or other tools does not grant additional privileges or reduce our expectations.

If you don’t know programming (and don’t want to learn), but you are interested in the Mesa project, there are plenty of other ways to contribute besides writing code, for example reporting bugs, benchmarking, testing changes, etc.

This is significantly better than Fedora's policy, but also lacking in one key way.

First: the person submitting the code is entirely responsible for the code they write. If the AI does something bad? The person who used the AI is responsible. If the AI breaks a license? The person who used the AI is responsible. The code doesn't work? The person who used the AI is responsible.

Second: You must understand the code you contribute. No "vibe coding" nonsense.

Third: It recommends ways to contribute that don't involve programming for those who don't know how to program! Unfortunately some people see the programming part as "prestigious" and use AI to contribute to stroke their own egos and this won't help them, but those people are likely lost causes for the time being anyways and need to get over themselves.

The Mesa guidelines are a lot better at placing explicit responsibility on the user of AI rather than placing it on the code reviewers. The understanding requirement alone should help to filter out a good amount of AI usage - people who understand their code have generally written it themselves. I have heard of some who use AI to, in a sense, "rubber duck". Which... really??? Have y'all forgotten about pair programming? Or actual rubber ducking? Embarrassing. On the bright side, using it to rubber duck is... hopefully... less usage of AI than using AI to outright write the code for you.

If the goal is to ensure high quality code in Mesa (a good goal!), then the Mesa guidelines are, in my mind, very good. If the goal is to block the use of Generative AI (which, given the environmental impacts and the unethical way in which AI is trained, I believe to be a good goal), then neither Mesa nor Fedora's policies are good.

I'm not happy about this. Mesa's policies are the most practical, Fedora's put more onus on reviewers than contributors which I find unfortunate, but I sure wish that there were a practical way to outright ban AI contributions. I hope I'm being pessimistic but I do believe that targeting AI directly will just result in it being done in secret and disguised so it can't be caught as easily, and placing responsibility for code quality regardless of AI usage on the contributor should at least filter out a good chunk of it.

Y'all I hate this. This is just so embarrassing for humanity.