We largely disallow making posts entirely based on AI model output. For example, we get a lot of forum threads from people with concerns based on AI model output and will typically provide a quick answer followed by locking the thread and then eventually removing it.

It isn't permitted to submit pull requests or issue reports created by an AI model without fully understanding it. It's fully allowed to file issues found by an AI model if there's a human who understands it and writes the report.

We do not want issue reports entirely generated by an AI model or which were written by a human and passed through an AI model to provide analysis. It's usually incredibly inaccurate and we would greatly prefer the user's explanation of what's wrong. We want a description of what happened, a crash traceback if one is available and optionally a subset of logs emailed to logs@grapheneos.org if people are comfortable doing that after triggering the crash or another issue. We sometimes request it.

It can sometimes be useful to analyze an issue with an AI model but it usually isn't. It also definitely isn't useful to do it with a free or cheap model available without either paying for it or running it on very expensive hardware. In general, users do not have access to anything useful to analyze it. We don't want people to keep converting their issue reports into slop. We want what a user pasted into the AI model interface rather than what an AI model produced as output from that.

Frontier models are very good at finding bugs but it requires an experienced developer to babysit it and extract the useful portion of the output. Important bugs are often found but mixed in with a bunch of low quality output. The details on the issue and especially proposals to fix it are often wrong. It's still very useful and finds many real issues. The volume of real vulnerabilities being found this way in Linux, Chromium, Firefox, Postfix and countless other projects is quite scary.

It isn't a good idea for people to point a model at an open source project and then start submitting bug reports to it. People need to be able to confirm the issues themselves with relatively high confidence before reporting it. It's okay to make some mistakes but it should not be the majority of what's reported. We do want people to report these kinds of security bugs to us but the signal to noise ratio is far too low right now. Even frontier models spew out contrived nonsense and fabrications.

We want people to report very serious Android Open Source Project security bugs to us but we can't handle a lot of minor issues. We don't generally need Chromium security bugs reported to us because they handle those far more quickly and have a far better system for releasing it. Linux kernel security bug reports are useful if they refused to fix it (arm64 kASLR) or it didn't get backported to the LTS. GKI LTS being behind the LTS is a separate problem we'll be addressing ourselves again soon.

We have high standards for code being merged into GrapheneOS, especially for code in critically important parts of the project. Most of the changes made to the OS are to critically important parts of the code. It takes a long time to get features to meet our standards. There's usually a lot of back and forth review with many improvements requirements for anything significant. External contributors shouldn't try to take on major features without talking to us and planning that out with us first.

Going from having a working implementation of a feature to code we can merge often takes a long time. It can take months or even more than a year. It doesn't always work out. Sometimes we decide a feature ended up being too invasive or risky for other reasons and don't want to include it. We'll often do rewrites. Contributors need a full understanding of what they've submitted and need to be prepared to make substantial changes including fully rewriting it multiple times. AI slop isn't accepted.

We don't forbid using AI models for writing code but pull requests largely created that way will typically be rejected or skipped due to not meeting our requirements. It needs to be well written code which appears to be regular code written by a human regardless of the level of AI assistance involved in making it. It should not look like AI generated code. We do want to know if AI models are being used and how they're being used rather than people using it but not telling us they're using it.

GrapheneOS is based on projects heavily using AI including the Linux kernel. Cellebrite, NSO and other exploit developers are using it to exploit these projects. They currently have a major advantage thanks to AI which will likely be turned into a major disadvantage over the long term. It's getting a huge backlog of bugs fixed and creating enormous pressure to make systemic improvements.

Here's what Debian adopted, which is a similar idea but much more permissive:

https://www.debian.org/vote/2026/vote_002#texte

There are currently many widely shared threads directing hate towards us with major misrepresentations about what we've said in done.

A large number of people are using it as an opportunity to promote using operating systems which are the direct opposite of hardened and are much more heavily using AI models including for a lot of code generation.

LineageOS is certainly using it. CalyxOS, /e/ and iodéOS are based on it. CalyxOS is developed by LineageOS core developers.

https://github.com/LineageOS/charter/blob/main/ai-coding-assistants.md

@GrapheneOS i feel genai should also be banned for writing code; no genai outputs should be allowed in the codebases

@lumi @GrapheneOS realistically if they took this approach seriously then the majority of recent android commits wouldn't be allowed lmao. Sadly genAI has revolutionized coding in a way that isn't really feasible to entirely separate from. It has also become a legitimate tool for many developers and can actually speed up workflows massively. Outside some idea of purity I don't get the motivations for staying away from genAI code as it's long past the days of writing horribly insecure slop.

@antsyboi @GrapheneOS can still enforce it for their own projects and devs

if google wants to slop, google can slop

i don't care whether it's secure or insecure, it's wildly unethical. even if it wrote perfect code all the time, the ethical issues should not just be dismissed

@lumi @GrapheneOS @antsyboi

Can you please elaborate on how genAI should be unethical?

Genuinely asking, I am wondering why it's the case

@GrapheneOS motorola signature 27 is being teased on motorola.com, any news you can say?

@corigan01 @GrapheneOS @laura_ge

I think there's some misunderstanding.
People are jumping at conclusions too fast.

I guess what'ss happening is GOS team starting to embrace new technologies to *check* on code.
It seems they decided that dealing with false positives is a burden they are willing to take to receive also true positives.

There is a huge man in the loop involved in the process and only to *find* (not fix) bugs before they can be found by adversaries.

Am I missing something?

@GrapheneOS get fucked, seriously

@GrapheneOS protects you from authoritarianism and fascism like when mom and dad tell you to do your homework and you really just want to play nintendo or the local government says you can't burn a pile of car tires on *your* property

@GrapheneOS if this policy keeps up I'm going to have to stop recommending graphene to people the same way Debian is no longer safe for casual users. You're throwing out your base audience. This sucks and you know it.

@bekkaboo @GrapheneOS

Name one actively exploited Debian vuln that doesn't appear in other distros.

@libreovergratis they've added vulns long before any of this

@bekkaboo @GrapheneOS which policy do have issues with?

@bekkaboo @GrapheneOS you better only be using NetBSD or Haiku then

@bekkaboo @GrapheneOS

The base audience is people seeking privacy, security, and usability. They promised to uphold this mission and not using tools that help find exploits would be counter to this mission. They are doing exactly what they promised their users they would do, even if they dont like it.

@bekkaboo Linux itself is heavily using AI models. Therefore, every Linux distribution moving to recent kernel versions is heavily built on top of using AI models. Creating a Linux distribution not heavily using it would require a hard fork of the Linux kernel and many other projects.

It's unclear what would be accomplished by banning AI for a tiny portion of the code while continuing to use Linux, AOSP, Chromium and hundreds of other projects heavily using it. We'd still be benefiting from it.

@GrapheneOS
> Creating a Linux distribution not heavily using it would require a hard fork of the Linux kernel and many other projects.

The pitfalls of using LLMs are well known and documented. Hard forking everything would probably be for the best really. Leaning into it, out of pear pressure is really the bad move here (unless you think there's more to it than "pear pressure")

@zm We're using it to raise the quality of our code. Our current usage for the core OS is entirely for extra passes of code review and to find issues in our existing code. We began doing it after receiving a bunch of valid reports from external contributors of issues found with AI models. Several issues we fixed due to external contributors scanning our code with AI were serious issues including crashes and bypasses for protections. A lot of that was reviewed by over a dozen people already.

@zm Our Camera app was originally written in Java with the Android Views framework. It was ported to Kotlin years ago using Android Studio which was a non-AI machine translation. It has never been idiomatic Kotlin. It was written by a junior developer and we didn't apply strict enough code review or standards due to lack of resources.

It's ridiculous to portray experienced developers overhauling the app with everything going through a lot of review as writing slop because one uses AI tools.

@zm Our initial Camera app needed to meet the bar of being better than AOSP Camera which was horrible and the codebase was a huge mess. It succeeded in providing that and has been a decent camera app since then.

Camera needs a massive overhaul to meet our much higher current quality standards for the user interface, features and especially code quality.

We're doing the same for the incredibly outdated AOSP apps. Those are being nearly entirely overhauled with far higher quality code.

@GrapheneOS
I still think you have to look at what this means from a cultural perspective.

Even if this is all true (i.e. you were getting amazing quality output from LLMs), it doesn't answer for all of the negative externalities of AI use (just look at why Codeberg banned it). You have for the most part called balls and strikes on a lot of the controversy and misconceptions surrounding this project and other similar projects.

It's given you a good enough reputation to get the user base you have and even land you in the news because of how secure it is. AI companies on the other hand have a terrible reputation and many people are jumping ship to something like GrapheneOS because of AI (and how it's being forced on their users)

If you can understand the reasons that people want to use GrapheneOS then you'll understand why people don't want you to allow AI use in this project. None of the technical challenges you're facing will even matter if your users can't trust you

@zm

If you can understand the reasons that people want to use GrapheneOS then you'll understand why people don't want you to allow AI use in this project.

You're taking too much upon yourself speaking for other people.
I use GrapheneOS and I want them to use LLMs in development to keep making the project even more secure since adversaries would use it when looking for vulnerabilities in it.

from a cultural perspective

More like political and shortsighted.

I'd prefer to trust people who instead of running around and crying about "cultural perspective" would make decisions based on observations like Torvalds or GrapheneOS developers did.

The technology is here. You can keep your head in the sand and let your users suffer because you just ignore the outside world or you can adapt and apply appropriate measures. Thankfully, this project decided to take measures.

People being vocal in social media in social media is not a threat to GrapheneOS user. People who look for vulnerabilities are. From security perspective it's a good decision. And if people who use GrapheneOS care more about the cultural perspective, maybe they don't really need this OS.

@GrapheneOS

@GrapheneOS
> It's ridiculous to portray experienced developers overhauling the app with everything going through a lot of review as writing slop because one uses AI tools.

To my previous point, even if you feel that they're not writing slop because of AI use. They still are, because of the reputation they have of being used for that purpose (even among the best developers). Historical precedence shows that using AI over time will de-skill and you'll just vibe code eventually

@GrapheneOS
If you're looking for inspiration or feel like people are demanding the impossible, look at @elementary

This is OS development without AI.

@zm @elementary It's a Linux distribution based on Ubuntu. Linux and Canonical are both heavily using AI. Debian is permitting using AI with fewer restrictions and oversight than we impose.

They're not working on anything similar to we are or in a similar space to us. They do not have to defend against what we do.

Basing a project on other projects which are using AI is not avoiding using AI. Banning it for the downstream work is a tiny fraction of the OS.

@GrapheneOS@grapheneos.social @elementary@mastodon.social @zm@kolektiva.social

Basing a project on other projects which are using AI is not avoiding using AI. Banning it for the downstream work is a tiny fraction of the OS.

@GrapheneOS @zm @elementary
>Basing a project on other projects which are using AI is not avoiding using AI. Banning it for the downstream work is a tiny fraction of the OS.

This sort of false dichotomy only serves to push folks to surrender any agency they have. I've never agreed with every aspect of every decision of the projects my work relies on, what a ludicrous claim! Y'all literally criticize Google's choices regularly, but you claim to operate differently and to a higher degree of quality within your project.

That is the reasonable and realistic level of agency anyone expects from a project.

The real stress from this situation is idk what to switch to from gos... Might just finally have to resort to a dumb phone if Android's "most secure" OS is this thick...

Side note, stop acting like you need AI to effectively operate in SWE. You don't, and if you just can't resist it then say that and drop it. Honestly if it was some offline model strictly being used for security reviews I wouldnt care that much, but watching y'all immediately start paying money to some of the most evil corps in the world, then have a meltdown when people are understandably concerned is enough to finally push me away.

GrapheneOS and DigitalOcean in 1 day... Gonna be doing a lot of infrastructure work here for a while 😭

@MonKaiju @zm @elementary We're doing the direct opposite of reducing quality. It's helping us catch things we're missing in our own code review. A couple of our newly hired app developers using it themselves is also going well and they're doing a high quality overhaul of the badly aged AOSP apps. That includes fixing long term latent vulnerabilities in apps like AOSP Messaging which we didn't know were there before.

Plenty of people already attacked us for using Pixels or AOSP due to Google.

@MonKaiju @zm @elementary

> but watching y'all immediately start paying money to some of the most evil corps in the world

We're paying for it on the scale of hundreds of dollars per month. If we were going to use it at a much larger scale such as for vulnerability discovery in the Linux kernel or AOSP then we would buy hardware and run the latest Chinese open weight models. We're currently leaving it up to the Linux kernel, AOSP, Chromium, etc. to handle that instead of us dealing with it.

@GrapheneOS @zm @elementary I mean doesn't giving hundreds of dollars a month to super evil corps, like the ones people move to gos to get away from, seem questionable? Seems like it'd be safer to either do nothing or fundraise for hardware to run a local model than to give what many of your users consider "the bad guys" money. Seems like something you could even switch to now and maybe recover some community trust.

@zm Codeberg also banned cryptocurrency which is our primary source of funding and is what we use to send money to nearly everyone on our team. A huge portion of our users are cryptocurrency users. Many of them care about financial privacy and support Monero. We also support financial privacy.

Most of the people attacking us on this platform aren't our users. We aren't being attacked elsewhere. People in our chat rooms oppose the attacks on us and it's only an active topic in the media rooms.

Watch this, people are also going to get pissed off because GrapheneOS accepts Monero lol

@GrapheneOS @zm Sorry you're dealing with this. It's embarrassing.

@GrapheneOS
Keep up the fantastic work GOS team. I like most of the decisions you've made, and I'll financially support the project once I'm capable of it. You lots have the sanest approach to a lot of technical issues. Most people complaining about AI use in production are just virtue signaling because muh AI slop muh evil corps muh environment muh losing jobs. Purely performative because hating the evil AI is a bandwagon everyone especially the normies are jumping on.

@GrapheneOS
There's no neutral stance. You either join the AI hate cult or the AI worship cult. Bloody hilarious.
BTW a lot of folks who complain about AI slop create human slop themselves. AI creates slop because it feeds on human slop. Classic GIGO that is. So is AI even the right thing to hate? AI can write higher quality code than a lot of these mediocre software "engineers" anyway.

@GrapheneOS how would you know that people on here are not your users? 🤔 @zm

@GrapheneOS @zm girl this ain't it, this is probably the platform with the largest share of GrapheneOS users and also the most critical one — not out of hate, but of love and care

@xerz @zm There are a lot of GrapheneOS users on the fediverse but it's hardly representative of the overall userbase.

Most people using GrapheneOS do not use social media accounts. The vast majority of our userbase does not have these super strong feelings for or against AI. The vast majority wouldn't want cloud AI in the OS and also largely dislike anything storing or learning stuff about their behavior. Details of what people want varies a lot. Many people want a lot of local AI features.

@xerz @zm Our discussion forum and chat rooms are a much better representation of our overall userbase than looking at the fediverse, X, Reddit or another platform. It's still only the subset of it willing to make those accounts. We get a good idea of the major differences in what people believe and want from their devices from our own platforms.

Nostr very likely has a higher proportion of GrapheneOS users. We don't have a project account for it but they can see a lot of our posts from here.

@GrapheneOS @zm

Codeberg has banned cryptocurrency projects, not the use of cryptocurrencies. Codeberg e.V themselves have never accepted cryptocurrency to begin with.

What lead to the decision:
https://codeberg.org/Codeberg/Community/issues/794

The vote they had about it:
https://codeberg.org/Codeberg/org/pulls/1254

@GrapheneOS
Codeberg has banned projects related to the actual development of cryptocurrencies, not projects that accept them as payment.
@zm

@ozzelot @zm We're aware they started by banning projects tied to the development of cryptocurrency which are what we rely on to accept donations and pay our developers around the world. We never said they banned GrapheneOS from using it for hosting. It shows we couldn't reliably use it for hosting since the bans may be greatly expanded in the future.

We brought up the other ban because it's another way that we're not at all on the same page. We care about preserving the privacy of cash.

@zm @GrapheneOS

I think you are over-estimating.
Vast majority of GOS users do not have such strong opinions on AI use.

In any case, I understand your points about AI slop, but re-reading GOS posts here on socials give me the impressions you are talking about different usage.

I think you both agree on most of the points, and GOS seems to have acknowledge all downsides, limiting AI usage to check on code, and not writing it.

Is this assessment correct or I am missing something?

@MagentaMold @zm We allow people to use AI assistance to write code they're submitting to the project. It must meet high standards to pass code review so they're going to need to heavily refactor/rewrite it in practice.

We're not using it for the core OS code ourselves but we have gone through rounds of code review to get clearly AI generated external pull requests into shape and then merged them after it was all fixed. We usually have to do a final pass of fixes ourselves and then push it.

@MagentaMold @zm We're in a bubble where we don't use AI for much. We also don't trust AI harnesses to run directly on a workstation. It would need to be in a dedicated VM and then that's inconvenient.

On the other hand, most experienced software engineers at tech companies are using AI for assistance with writing code. It's part of Android Studio so it's there for people not seeking it out. Android SDK CLI was rewritten with it in mind too:

https://developer.android.com/studio/gemini/overview
https://developer.android.com/tools/agents/android-cli

@GrapheneOS @zm

> It must meet high standards to pass code review

I think that everything correctly reviewed must be accepted.

Even using my best skepticism, I heavily trust GOS team.
Looking at how things were managed in the past, I strongly believe they will make the correct choices for the project :)

In all my ignorance, If the code submitted does what it has to and it's written in correct idiomatic ways (for maintainability), I would even argue that it doesn't matter who/what wrote it.

@GrapheneOS @zm

Winnowing (reviewing) the LLM chaff to find the real vuln signals has been a problem for our projects. Winnowing is the majority of the work; maybe 0.5% to 1% turn out to be real.

External reporters who use LLMs as a start, but then winnow themselves to report actual verified vulns, are great. 😉

The ratio of $60M of tokens (subsidized pre-IPO) doing less precise work than $10M of expert code review... is probably not sustainable.

@GrapheneOS
@bekkaboo
Then a hard fork is needed.

@GrapheneOS @bekkaboo nirvana fallacy detected

"as the world is shit, does not matter what you do as you still depend on shit and the end will also be shit"

@GrapheneOS At least write your AGENTS.md by hand.

@GrapheneOS this whole situation is just saddening.

@GrapheneOS The streisand effect is strong with this one 🫪

@GrapheneOS that’s not right 🤦‍♂️ why can’t people just be nice 🤷‍♂️

@GrapheneOS You don't have to defend AI code use, it's clear to anyone that's actually paying attention that LLM-driven cybersec hardening and fuzzing is useful, and here to stay.

@GrapheneOS can we hate more on cars please? people swear by them and outright reject alternatives. how is their rollout in the 50s any diff from what's happening w AI? cars are indeed useful and imo AI isn't at that lvl yet. but dependence on either is outright stupid. GOS' using the tool as a tool not an alternative. they're using it to accelerate their workflow not fire all devs to produce slop. when the well is poisoned, criticism is warranted. be nuanced and not blindly root for one side.

@GrapheneOS many of your users spent a number of years recommending others to specifically avoid projects like calyx and "/e/" due to all the technical, security, and privacy reasons tirelessly documented by you, and use grapheneos instead, if they're able, *because* of your higher standards.

and now you keep saying on here that you can't avoid the upstream slop anyway.. others are doing it too, and that somehow makes it ok to use and "carefully" cook your own? this is wrong, and you know it

@GrapheneOS as you might have realized these past few days a lot of people hoped those standards included taking a stance and rejecting / banning (yes we know people can just copypaste chatbot output and pretend) the use of that grotesquely unethical technology, no matter how i-swear-im-doing-heroin-responsibly good

it IS bad actually, did you ever stop to consider that maybe all those critics have a point, a lot of very good ones too, before conflating them with a targeted harassment campaign?

@ludonaut We're not conflating anything. It's openly a targeted harassment campaign with the ringleaders of it well aware of what they're doing. This is one of the main people doing it who has been boosted by most of the other people with highly boosted threads. There's no secret about what they are trying to do. They're heavily using lies and misrepresentations about what we've said and done to do it.

What is being done is not an attempt to convince us of anything and has done the opposite.

@ludonaut That's the direct opposite of what we've said. We're primarily using it to improve the quality of our code through additional passes of code review. We started doing that after multiple external contributors used AI to find a bunch of issues throughout our code. Most of those were issues like crashes but some were more important. Some of our low-level hardening features were not providing as much security as they were meant to be. We began using it proactively to catch issues early.

@ludonaut As you're well aware if you use GrapheneOS, there are a bunch of abandoned AOSP apps which haven't had any active development for years.

Those apps are stuck in the state they were in back in Android 5 or even earlier. Many even regressed. They've had bare minimum maintenance for years which gradually ended upstream.

The issues with those apps include them not being overhauled with privacy and security improvements applied elsewhere. It includes outdated dependencies missing patches.

@ludonaut We're in the process of overhauling these apps by rewriting nearly all of the code in phases. It's becoming much higher quality code with many bugs getting fixed as part of it. That includes fixing upstream privacy and security issues which have been around for years.

Vast majority of experienced developers working at tech companies are using AI. Most of the people applying to us are using them. We have to filter through people who can pass our tests but are too reliant on AI.

@ludonaut People using AI models doesn't imply the end result is lower quality. We hired the people who we decided are capable of producing high quality code and being productive with their usual approach to development. For people who made it past our initial screening, we gave test projects and we learned a lot about what they'll produce for us from it.

All of the work they're currently doing is clearly massively raising the code quality compared to the starting point of that AOSP app code.

@GrapheneOS "additional passes of code review", you keep specifying "frontier models", why exactly do you believe this would make any difference, and how much of that donated money did you or the people you've hired spend on those death cult motherfuckers? how many tons of co2 do you think this took? how many liters of water ruined? how many lines of plagiarized code do you think? don't you love "not now/later" consent dialogs too?

actually, here, real simple, let me quote @jwz for you:

@GrapheneOS please, i'm begging you to consider that people might be sad and angry and disappointed because they've put a lot of trust in you that they feel is being betrayed. it is actually a betrayal because how are people supposed to trust their operating system, or any computers, now that it's all top to bottom compromised by torment nexus chatbots that make you feel good

@GrapheneOS
i for sure feel like a huge idiot now for ever recommending grapheneos to others, and i really don't know what i'm supposed to do now about my privacy except throw my phone into a river and walk into a forest. i don't know how many more bad news i can take, i just really wish you hadnt joined the llm bozo parade

@ludonaut We spend hundred dollars per month on it and you're claiming we're destroying the world. We disagree with the premise in the first place but even if we did agree, it's such a disproportionate response.

How is it that this is such a big deal to you but you're not attacking everyone you know who eats meat, drives a car, travels by airplane and other wasteful things? Somehow we are the problem for using less resources on this than we've used for plenty of far less useful things.

@ludonaut You would probably be fine with us running a 256 core machine 24/7 doing fuzzing but yet us paying hundreds of dollars to get far more useful results is somehow us destroying the environment.

We do not understand where you're coming from or why you're so incredibly angry with us. It's not justified and does not make sense.

Many of the people attacking us travel around the world to conferences on airplanes, drive to work and probably have the carbon footprint of half our team or more.

@GrapheneOS @ludonaut me turning off my light when i go to work while a billionaire burns my lifetime carbon footprint in an hour

@GrapheneOS It has become a religious issue.

@Lightfighter @GrapheneOS yes on one side the pro AI sicko, who think it's a god who will solve everything.

and on the other side the Anti AI sicko who see it as anti Christ who will destroy everything.

With us normal people in the middle.

@skyblitz @Lightfighter @GrapheneOS I am no fan of generative AI either, but I recognize it’s a tool that is currently needed because the opponents have them too. I’d just wish those tools would not be in the hands of those shitty companies

@Dawnexa @Lightfighter @GrapheneOS don't like AI, but sadly now the genie is out the box, and we cannot put it back.

so the only "thing" we can do without allowing the bad guy to win... is to force those company to develop the next generation to be less and less "bad" for humanity and the market.

Sadly right now due to a pedophile Orange child in the white house they do anything they want without any check on them.

@skyblitz @Lightfighter @GrapheneOS I also think a proper ethical and open source AI model would go far.

I remember when OpenAI still was „Non Profit“

@GrapheneOS
hundreds of dollars per month huh... feels great i bet.

your actions matter. you don't exist in a vacuum, everything you do is political, even diet choice or mode of travel and what to compute, especially if the "you" we're talking about isn't a single person but a project. the nth times infinity digit of pi won't matter if computing it boiled off the oceans.

lamps in videogames, as the meme goes, use real electricity, and llm datacenters run quite literally on gas turbines.

@GrapheneOS sidenote, i've had to block (edit: stopped counting) unusually hateful drive-by harassers since talking to you today, guess that's what i get for trying to help

@ludonaut @GrapheneOS They CANNOT stop. That's not an opinion, it's a fact of running anything security-critical. If you genuinely believe otherwise, then by all means, join their security team for $200 a month and show us all how it's done, analyzing every line of code that lands on their desk with the same output as an AI. Until you're willing to do that, repeating the same flawed argument isn't helping anyone.

@ludonaut @GrapheneOS
Are you vegan? And if so, do you only use software made by vegans?

@ludonaut @GrapheneOS What about other things you use in your life? Are they all made by vegans?

@GrapheneOS @ludonaut People correctly associate LLMs with fascist oligarchs and obscene levels of corruption. That is not hyperbole. That is the literal genesis of the technology. THE ENTIRE POINT OF LLM CHATBOTS IS TO INFLICT HARM. I really don’t care if you limit your fascism budget to $200 a month. The correct fash budget is zero.

You embarrass yourself and what is otherwise an attractive product with your nonstop excuses and whattabouts.

Be better and just stop using it.

@beaucoup @GrapheneOS @ludonaut Fuck off back to your Reich.

@beaucoup @GrapheneOS @ludonaut @LabSpokane
Marxism explicitly rejects moralism, arguing morality obscures the material contradictions of capitalism, such as exploitation and alienation.

@beaucoup @GrapheneOS @ludonaut @LabSpokane Luddites are resurgent! And many of us are openly COMMUNIST too ✨😈

@LabSpokane @GrapheneOS @ludonaut

They CANNOT stop. That's not an opinion, it's a fact of running anything security-critical. If you genuinely believe otherwise, then by all means, join their security team for $200 a month and show us all how it's done, analyzing every line of code that lands on their desk with the same output as an AI. Until you're willing to do that, repeating the same flawed argument isn't helping anyone.

@skyblitz @GrapheneOS @ludonaut Oh hi there 3 follower Nazi asswipe from ze Fatherland.

Believe it or not, software got written ALL THE TIME prior to chatbots, so stick that in your V-1 and smoke it.

Now, fuck off back to your underground bunker.

@LabSpokane @GrapheneOS @ludonaut it's hyperbole and you look stupid parroting this line of argument.

@MisterWanko @GrapheneOS @ludonaut Back to your wanking. Blocked.

@GrapheneOS @ludonaut this is clearly just a value discrepancy that I doubt you can resolve with words. I see the fundamental values of grapheneOS as security and privacy and those of us who switched to it with that knowledge and expectation in mind will understand using "the tools of the enemy"/"unethical tools"/whatever to the end of better security/privacy. But right now llm-opposition as a primary value is in conflict with security as a primary value. Welcome to life in dystopia.

@GrapheneOS @ludonaut My general experience is terms like AI or LLM turn the brains of generally reasonable people into mush.

Much like arguing with a Trump supporter, or an NRA member it's not really an argument you can settles with reason or rational arguments.

This is about feelings, and for many humans they trump rationality. LLMs and the extraordinarily large impact they are having on the world right now (in good and bad ways) invoke a lot of them.

@GrapheneOS @ludonaut Yeah sorry but no, even running god knows how many fuzzers nonstop will not come close to the power usage of any serious LLM. And that's just talking about inference, not even training and crawling. Even so, power use is far from the only environmental concern, and environmental concerns are from the only AI concerns people have. And you know that.

@engideer @ludonaut That's incredibly far from reality.

If we were using it for much more then we could buy a bunch of hardware and run open weight Chinese models locally. The reason we're not is because it's already being done by others.

It would be a higher priority if we were the ones responsible for dealing with the overall Linux kernel, AOSP and Chromium code getting security issues patched but we aren't. It makes more sense to spend our time and money on things not already being done.

@GrapheneOS

I'm sorry that you have to put up with this, but I believe there is a far greater majority that understands what you are doing.

Your approach seems sensible.

Using LLMs to find vulnerabilities, and accepting LLM written code as long as it conforms to standards and is readable/understandable/maintainable seems like a reasonable thing to do.

You don't have to defend yourself against every attack. Mastodon is getting pretty nasty. Some you can just ignore.

@engideer @GrapheneOS @ludonaut Frontier-scale inference uses 0.31 Wh/query. A 40 watt light bulb uses the energy of 130 LLM queries per hour. A query with large context is 13x more, but that’s still extremely marginal compared to a bunch of fuzzing machines running 24/7.

If you really want to stop destruction of the environment, stopping flying and becoming a vegetarian/vegan is much more effective than yelling at @GrapheneOS

@engideer @GrapheneOS @ludonaut Inference will only get cheaper energy-wise as more and more specialized inference hardware is being made.

At any rate, there are many studies about this, e.g.: https://www.sciencedirect.com/science/article/pii/S2542435126001145

@danieldk@mastodon.social @engideer @GrapheneOS why walk when you could roll coal instead

@engideer @GrapheneOS @ludonaut This is all besides the point that LLMs can find many vulnerabilities that fuzzers and traditional static analysis tools cannot (easily) find.

@GrapheneOS @ludonaut but funny how certain asshole, immediately label you nazi because you simply state a fact that Security = AI + human.

If we put all those people with a negative IQ in orbit, we would not see the sun anymore.

Edit : corrected QI into IQ (translation mistake), thanks matt.

@skyblitz @GrapheneOS @ludonaut Unless you're referring to the concept from Chinese philosophy I think you might have meant the eugenicist "IQ" lol

@MonKaiju @GrapheneOS @ludonaut yeah you are right i will correct it, my native language we use QI (quotient intellectuelle (belgian french)) instead of IQ thanks to pointing out my mistake 👍

@GrapheneOS you don't have to engage these people. you maintain one of the most important operating systems in use today and they contribute nothing but pissing and whining because they have experienced in the past that they get the attention they crave when it manages to hook into some general zeitgeist of concern. don't feed the concern trolls.

@ludonaut frankly you should feel like an idiot for copying someone else's absolute objection to AI. jwz is not recognizing reasonable utility of AI, and that kind of lazy thinking is exactly what we don't want here.

@ludonaut @GrapheneOS I somewhat have to agree with GOS. Most of people who hate on LLM use environmentally are not vegans and the meat/dairy industry does much more damage to the environment (and is also a literal holocaust of living beings).

I don't think LLM use is good, but I also don't think most people should speak up this harshly about it when they don't do the single easiest thing for the environment (and animal rights ofc) which is just going vegan.

I hate big tech as much as the next guy, don't get me wrong, but all the leftists are focusing on LLMs right now, because it's easier to blame a corporation than do something yourself first.

@skill @GrapheneOS sorry i forgot it's impossible for two bad things to be true at the same time

@ludonaut @GrapheneOS I didn't state anywhere that it's impossible, I'm just ranting that most people prefer to hate on AI (that will still be used, because it has a lot of value for business), where as going vegan (which reduces the demand for meat, which reduces the produced meat, which directly impacts animal lives and ecological aspects) would make a more direct positive impact.

I don't think hating on AI is bad, I am simply stating that it's mostly done by people who don't have enough will to stop doing something much more harmful themselves.

communist filth must be destroyed
in a free marketplace of ideas I win
you suck

@ludonaut Your image description keeps using "Al" (a lowercase l) in place of "AI." (uppercase "I"). You didn't use AI to write it, did you?

@GrapheneOS Thank you, Graphene for staying true to the mission and not unnecessarily campist.

@GrapheneOS

Instead of wading through LLM model vomit which takes a significant amount of time, with an admittedly low signal to noise ratio, you could invest in experienced vulnerability researchers who don't use LLMs.

One could argue that the time discovering vulnerabilities with traditional or custom tools (some vuln researchers write their own tooling) could take ~same amount of time as sifting through mass produced LLM bugs to determine if those bugs are actually vulnerabilities or not.

@synnfynn @GrapheneOS like who? like, let's be clear here, who would be paying who in this particular scenario? Or if it's not money, who would be investing what into whom for what outcome?

I'm not asking as a "reply" guy here; this is something we're digging into in FreeBSD land.

For example - if the suggestion is "invest time to build partnerships with experienced vuln researchers" then great, but .. what are you missing by ignoring everything else? Who does the sifting?

@erikarn @GrapheneOS

Yeah. You are a reply guy.

@synnfynn @GrapheneOS

The AI catches things most have not caught. Thats why there is a huge influx of linux CVEs that werent known about for decades. This isnt something you can throw money and people at and assume it will work to the same extent.

@HybridStaticAnimate @GrapheneOS

Bot blocked.

@GrapheneOS You guys have made it very clear that you find frontier LLMs useful for this specific purpose, and that LLM contributions that are slop are not accepted. I trust you to know what is best for the future of the project I've followed since the Copperhead days.

However, my main concern regarding this is the legitimization of a very environmentally damaging service (not to mention the direct support of fascists) by endorsing its use.

@GrapheneOS I'm no purist here, I've used LLMs. (Just barely though, I've hardly found it useful for the things I do.)

I see its potential utility, and I do wish to see that this technology gets better, both in capability and in ethics. So, in the interest of transparency, I have a few questions:

@GrapheneOS
1. To what extent did you use LLMs in both the coding and review process? What are the lines you are not willing to cross?
2. How much did you pay for the models, and to which company/provider did you pay it to?
3. Are there any considerations on hiring more dedicated vulnerability researchers instead of spending on LLMs?
4. How do you justify the harms stated above?
5. Finally, how do you plan to mitigate the harms of using LLMs? Are there plans to use it locally, for instance?

@GrapheneOS In my view it should also be fine to let an AI give feedback, point out errors and suggest additions for pull requests, issue reports, etc. as long as the human doesn't blindly adopts the AI output but only does so if they understand and agree.

@GrapheneOS I would imagine #GrapheneOS has quite a few users (like myself) who would rather not have any AI/LLM-generated code in any projects--especially one so crucial to everyday life.

@lattera @GrapheneOS

Then you need to stop using AOSP, chromium, linux, and much more. GrapheneOS is only using it officially for code review and employed contractors must understand what they are submitting, how it works, why it works, and what it solves.

@GrapheneOS I may be wrong, but this looks like the first post detailing project policy on LLM-assisted coding (other than comments).

It follows up on today's long discussions, which took place especially under this thread: https://grapheneos.social/@GrapheneOS/117225539756835649

Who drafted this, i.e. how does the team decide on these issues? Are there any plans on involving the community / userbase? (not that this is mandatory)

Will this eventually be included on the project website?

@crayon This is an explanation of our existing policies which existed before today. It's not a formal document and is being written as we make these posts.

@GrapheneOS OK, and sorry for rushing it.

@GrapheneOS @crayon It sounds sensible to me so far.

@GrapheneOS
yeah, unless those restrictions are "any and all ai output can and shall get fucked all the way into the goddamn sun", i don't care

@GrapheneOS for an OS project that refused porting to non-PIxel h/w for so long b/c other platforms didn't meet security reqs, this pro-LLM stance is ludicrous.

~all bugs found by LLMs can likely be found by other methods using the same-or-less compute resources, especially w/ the human effort "babysitting" the LLMs to ensure they don't go off the rails.

there just aren't billionaire fascists subsidizing that compute, be honest about it.

stop covering + doing PR-by-action for LLM fascists

@elle @GrapheneOS

"for an OS project that refused porting to non-PIxel h/w for so long b/c other platforms didn't meet security reqs, this pro-LLM stance is ludicrous."

Read or reread the thread; it might prevent you from responding with inaccuracies, but I think you did it on purpose.

@Xtreix ? care to elaborate?

before you make accusations about me intentionally misinterpreting things

@GrapheneOS

@Xtreix

"It also definitely isn't useful to do it with a free or cheap model available without either paying for it or running it on very expensive hardware"

sounds like pretty explicit, "if you're not using proprietary AI models, don't bother" AKA PR propaganda for those firms from a big-name project in the FOSS space. one that up-to-now, has a shining record for security + privacy.

@GrapheneOS have you really explored all alternatives to these models for surfacing security issues?

@elle @GrapheneOS

"sounds like pretty explicit, "if you're not using proprietary AI models, don't bother" AKA PR propaganda for those firms from a big-name project in the FOSS space"

No, that's not the case. GrapheneOS hasn't suddenly become pro-LLM and isn't promoting big AI companies, those are the false claims you're making.

@Xtreix

"Frontier models are very good at finding bugs but it requires an experienced developer to babysit it and extract the useful portion of the output."

"The volume of real vulnerabilities being found this way ... is quite scary"

Sounds pretty pro-LLM to me. "oooo big LLM so scawy, definitely couldn't find the same bugs with equivalent compute using non-LLM tools"

the majority of bugs haven't been triaged, ones that have are shallow(-ish). this is part of the PR hypecycle

@GrapheneOS

@elle @Xtreix @GrapheneOS

Relaying the reality of the situation that AI review has helped find vulnerabilities that evaded human examination does not somehow make GrapheneOS pro-AI. They dont like it. I dont like it. You dont like it. But the alternative is either lying or doing nothing. Would you rather them lie to us? What they said is objectively true. It sounds like you want them to conceal this from us and/or leave vulnerabilities unpatched.

@HybridStaticAnimate

> It sounds like you want them to conceal this from us and/or leave vulnerabilities unpatched

what a strange interpretation of "bugs could be found w/ non-LLM tools using equivalent compute".

also, of course they should fix any legit bugs. does that mean they need to come out defending big-tech LLMs as "the only tools that could have found these bugs" (effectively doing PR for those companies)?

does it mean they need to use the LLMs for code gen?

@Xtreix@infosec.exchange @GrapheneOS

@elle @GrapheneOS

"Can" is irrelevant. Any bug can be found with sufficient time, but attackers are using tools that find them faster, and find vulns that humans missed. Fixating on the "can" part ignores the nuance, like how *quickly* and how *many* vulns are being discovered with these tools. If this can be done without AI, why was it not done already? Why has attacker and defender discovery of exploits accelerated exponentially? There is no substance behind the claim this was achievable with other tools.

The objective reality of how these tools work and how effective they are is not a "defense" of LLMs and GrapheneOS is not doing PR for them. For them to say something different would be a lie and to not say anything at all would be concealing information.

GrapheneOS has already said any code made with AI still needs to be understood fully by the person submitting it, and it needs to meet code quality requirements. An LLM alone is not capable of meeting these standards and a developer needs to know what the code is doing, how, and why.

@HybridStaticAnimate

> If this can be done without AI, why was it not done already?

b/c there wasn't a multi-billion dollar, VC-funded campaign to subsidize the compute required to use other techniques?

what's the closest equivalent, OSS-fuzz from Google? also, open models, even frontier-grade, exist if you insist on using LLMs. why aren't those being utilized? why choose the ones specifically attempting to garner good PR by getting FOSS projects to use their shit?

@GrapheneOS

@elle @GrapheneOS

There arent OSS equivalents. They are months behind. They are still useful, yes, but the ones they are using are currently more effective. This isnt some kind of ad, they picked the most effective tool for the job and they will pick a different one if another becomes more effective.

@HybridStaticAnimate @GrapheneOS hmm let me check:

- being "months" behind still doing useful bug finding
- being "cutting-edge" and supporting fascists actively destroying the world for oligarchical benefit

which to choose, which to choose...

@elle @GrapheneOS

We, "in the business", call this a false dichotomy.

@HybridStaticAnimate

no, those are the true "dichotomous" solutions that are in the same arena.

frontier-grade, open-weight LLMs that are some relatively small degree behind the proprietary models created by fascist war criminals.

you can obfuscate, and run defense for this all you want: that is the choice you or anyone else is making.

there are legit situations where there is no alternative. this ain't one. there is a viable alternative that is only slightly sub-optimal.

@GrapheneOS

@elle @GrapheneOS You are making false claims.

@Xtreix

get blocked ducky

@GrapheneOS

@GrapheneOS to clarify the other methods I'm referring to are symbolic analysis, fuzzing, and static analysis tools.

I think this post from @david_chisnall puts it very well: https://infosec.exchange/@david_chisnall/117183568828323924

@elle @GrapheneOS what's the relation of Google being Google and a language model?

@dasmatus

are you serious? what is the relation b/w GrapheneOS taking security so seriously that they wouldn't port their OS to h/w that didn't have Pixel's special sauce, and now being fine using LLM code + bug reports + dedicate human time to "babysit" the LLMs?

my intention is not to "bully" @GrapheneOS. we need folks like you in FOSS building rock-solid projects. I'm merely voicing criticism, and hoping the team explores other alternatives.

leave big (proprietary) LLMs in the bin

@elle @dasmatus GrapheneOS is based on Linux, AOSP, Chromium and hundreds of other upstream projects heavily using AI generated code.

Our OS development team hasn't been using any AI code generation but yet the OS is heavily using it because the vast majority of the code comes from upstream projects. Linux and Chromium are both massive projects.

Firefox is heavily using it too, so that isn't relevant to this. It's nowhere close to what we would need to use it as a replacement regardless.

@GrapheneOS

I know, that's why we need as many folks on the side of "we're not using this shit, those big-tech LLM fucks can get bent"

it's also clear FOSS teams don't have the resources to rebuild / fork foundational projects like Linux / Chromium / Firefox, each one containing millions of LoC.

@dasmatus

@GrapheneOS this is also why I'm looking for alternatives to those projects, especially in anything I care about.

again, I'm not condemning you for being caught up in the same bullshit as the rest of us. there is no perfect or easy answer to any of it.

@dasmatus

@elle @GrapheneOS @dasmatus if you have watched reported vulnerabilities over the last few months, you'll see that there is a huge increase in the last few months due to LLMs. LLMs finds vulnerabilities that older methods such as static analysis and fuzzing didn't and don't find.

Since security is paramount to GrapheneOS and adversaries are using LLMs, the only way to defend is to use LLMs for auditing too.

LLMs are here to stay, let's boost open models to own the means of production.

@elle @dasmatus Our policy is only accepting high quality code. We've always had to do careful code review and avoid trusting submissions.

We aren't happy with the flood of slop which gets submitted to us via our issue tracker, security@ email and pull requests. However, a lot is reporting or fixing valid issues.

For pull requests fixing valid issues, we can either get them to improve it to meet our standards or do it ourselves. We often start with rounds of review but finish it up ourselves.

@elle @dasmatus In the past couple months, there has been a massive flood of valid vulnerabilities being discovered by frontier AI models. Nearly all of those are from human written code, often from many years ago.

Linux has heavily shifted away from adding new features and improving performance to fixing the bugs found by these models. They're being forced away from sticking with C and a monolithic kernel design. It's on ongoing crisis and people can regularly grab working exploits off GitHub.

@elle @dasmatus Cellebrite and other exploit development companies are having growing success exploiting all kinds of targets. They're openly talking about how they're using AI tools for reverse engineering, vulnerability discovery and exploit development.

It's a very large and rapidly growing short term advantage for attackers. The consensus among security researchers is that it's short term because vulnerabilities are being rapidly found by defenders too including before merging or release.

@elle @dasmatus We have a responsibility to protect our users. We're aware frontier AI models can be used to find many vulnerabilities. We made several accounts on cheap plans with a fixed amount of usage, applied for and received cybersecurity access and began testing it. We've found what others have which is that these tools find many actual vulnerabilities including subtle domain specific issues. It's largely beyond the scope of what traditional static analysis tools even attempt to do.

@GrapheneOS @dasmatus I understand, what I'm suggesting is that we as a community explore other solutions, possibly involving open models (hopefully not), that can also provide serviceable results for vuln disco.

for example, taking a symbolic + static analysis, and fuzzing approach that shells out to an open model LLM (or dev a fine-tuned small model) for path exploration when the other tools get stuck.

in other words, use/develop purpose built tools instead of rigging a GPT

@elle @dasmatus As with anyone else, we make mistakes and there are many things we don't know about. There are undocumented behaviors of library and Linux kernel APIs. We have the wrong mental model about how some things work. We can review a pull request a dozen times with great care and still miss things quickly discovered with one these tools. We confirm it's a real issue and figure out how to fix it ourselves. Our fix can also be checked. We write small volumes of code so it's very cheap.

@elle @dasmatus Our OS development team and most of our other developers aren't using AI coding assistants in the form of an IDE. They'd need to be run in a VM as a secondary workspace with a separate GitHub account or a similar approach.

We're in a bubble where we haven't adopted it. Most people applying to work for us with the skills and experience we need use these tools as most companies are using it. The concerns we have about it aren't much different from supervising junior developers.

@GrapheneOS @dasmatus sure, I haven't personally had to deal w/ a whole new generation of devs being brought up w/ these tools or mid-to-senior devs forced to use LLMs, much less having to hire + train them.

I sympathize w/ your plight, and am trying to find ways to insulate folks from this bubble. including finding legit alternatives that can fulfill the need for LLMs (perceived or real), w/o contributing any support to big-tech LLM firms

@elle @GrapheneOS @dasmatus

What options are available?
What are the rough costs involved?
What kind of expertise is needed to help?
What is a realistic timeframe to shift from a big tech frontier AI tool to an alternative option?

I am genuinely asking, this is not to provoke.
I lack knowledge and I am trying to better understand the situation, I think you can help me (and others) to have a better picture.

In this moment, I really fail to see what's wrong in revising code with these tools.

@MagentaMold

re: alternatives, idk there are no perfect, 1-to-1 alternatives that are generally applicable. frontier open models may help, and they at least contribute (somewhat) back into the commons they used to train/derive the models. they also undercut the business model of the big-tech LLM firms, which is a good unto itself.

re: reasons not to use LLMs, you can start w/ https://txt.ltdk.xyz/sloppery-slope/

I've collected some other resources here: https://codeberg.org/tech-cooperatives/resources/src/branch/main/cail-resources.md

@GrapheneOS @dasmatus

@MagentaMold

the reason open models are imperfect is they still maintain the property of consuming FOSS + other data non-consensually, and w/o attribution. it still takes energy to run those models, so depending on the deployment, there could still be ecological harm.

though, there is more opportunity to host them in datacenters/hosting facilities that take true renewable energy + environmentalism seriously.

against the big-tech LLM firms spinning up gas generators

@GrapheneOS @dasmatus

@MagentaMold

there are also the cognitive decline effects, which still likely occur w/ open models (ur still using the same agents + tooling which lead to decline).

h/e, in a use-case like "scanning for bugs", this specific harm is reduced to be on the level of "ran coverity". as long as you're engaging in rigorous mental activity outside the scan, cognitive decline should be minimal.

@GrapheneOS @dasmatus

@elle @GrapheneOS @dasmatus

I couldn't read all the links, I will catch them up slowly.
I see most of them make the same point: code quality being lower.

I agree, with this reserve: what I get back from AI will be _very_ different from others would get, because I will pack my expertise in my prompts (which is not enough to ask proper code).

Great devs tho, will possibly have quality output.

On top of this, as long as strict review is in place, I would say that there's no real difference.

@elle @GrapheneOS @dasmatus

As per pollution and similar topics, people shouldn't blame a small company for using newer technologies.
They should blame technology
builders/owners for not building it or maintaining it in a sustainable way.

If I buy a car to go to work, I can't be blamed for the entire automobile pollution of the world, can I?

The "if nobody use it" argument is flawed, because you cannot educate/enforce this decision planet-wise.

@MagentaMold @dasmatus

> The "if nobody use it" argument is flawed, because you cannot educate/enforce this decision planet-wise.

mb, but we *can* call out & criticize projects we respect for using it.

> They should blame technology
builders/owners for not building it or maintaining it in a sustainable way.

I do, loudly & regularly. I can do both, imagine that

@GrapheneOS does not have the most terrible AI/LLM policy. given their goals, I would expect them to have an anti-AI stance

@MagentaMold @dasmatus

I understand @GrapheneOS take that using AI/LLMs for bug finding is useful as a defender, especially w/ cop/mil-tech using it to find exploits. I've already made my case for exploring alternatives to proprietary models from the most harmful companies, I won't repeat them again.

again, I'm not singling out GOS as some sole bad-actor, this plague has infected so much of the FOSS space. it's just sad to see another solid project take a middling stance on big-tech LLM use

@elle @MagentaMold @dasmatus The reaction towards us is highly disproportionate to what you describe as a middling stance on it.

We're very interested in running open weight models ourselves and eventually open source models. We've even been working on making our own open source text-to-speech models.

We decided the standard for what's shipped in the OS is that it needs to be open source and we can provide open weight models as packages in our App Store instead of bundling those in the OS.

@GrapheneOS I'd be curious to see an Article or doc that kinda shows how a dev's AI environment is setup and maybe an example that shows how it's being used.

@GrapheneOS I disagree with you on this, without attacking you:

> The concerns we have about it aren't much different from supervising junior developers.

If you tell a junior developer that/where he or she made a mistake, he/she will learn and not do it again.

If you tell a LLM that/where it made a mistake, it will output "You're right, I shouldn't have done this" … and do it again. There is no learning from feedback.

With a human junior developer, you know what mistakes junior developers commonly make … what *you* struggled with at the beginning of *your* career … you know the common pitfalls to look out for. The mistakes of a human junior developer are obvious to more experienced developers.

What a human junior developer wouldn't do is write code that looks flawless to a senior engineer *and* to all the configured linters/tests but contains an extremely subtle bug that goes unnoticed despite careful code review. "AI" coding assistants do that, however.

Similiar to how AlphaGo plays Go in a way no human has ever played Go before, "AI" coding assistants write code in a way no human writes code, and "AI" coding assistants are thus much more likely to introduce bugs than humans.

Your concerns should be very different from supervising junior developers.

@davidculley

> If you tell a junior developer that/where he or she made a mistake, he/she will learn and not do it again.

Definitely not our experience.

> There is no learning from feedback.

It can be kept as context.

> code that looks flawless to a senior engineer *and* to all the configured linters/tests but contains an extremely subtle bug that goes unnoticed despite careful code review

Projects with careful review, static analysis, dynamic analysis and tests still introduce many bugs.

@GrapheneOS right, and one of my points was just imagine if all this compute & resources had been committed to, for instance, funding the Rust-for-Linux devs, the in-kernel testing infra, and paid community reviewers/maintainers (not corpo-backed devs).

it doesn't address the immediate practical need to address the fallout of LLM-found bugs.

@dasmatus

@elle @GrapheneOS @dasmatus We don't live in a world of imagination.

@prism my apologies, swap out "just imagine" for "consider for a moment" or "just think"

@GrapheneOS @dasmatus

@elle @GrapheneOS

The hardware security requirements GrapheneOS has for device support has nothing to do with this. GrapheneOS is a privacy, security, and usability project. The requirements for device support and using AI code review to find exploits both serve to further these goals.

@HybridStaticAnimate

"The requirements for device support and using AI code review to find exploits both serve to further these goals."

how does using tools from outspoken fascists who have the explicit goal of eroding privacy, expanding the surveillance state, targeting dissidents + immigrants, etc. further the goals of a security + privacy project?

if you absolutely insist on using LLMs, mb choose ones not developed by fascists. mb some of the open models fit that description

@GrapheneOS

@elle @GrapheneOS

It finds exploits that were otherwise unknown, which can then be patched. If they can be found and exploited by attackers, they can be found and patched by defenders. Youre asking them why they would dare to use a hammer for a nail when hammers are used to hurt people all the time.

@HybridStaticAnimate

no, I'm asking why use the hammers w/ a swastika on the label, instead of alternative hammers.

again, this isn't an attack specifically on @GrapheneOS, Linux (specifically Linus) defense of "we're using the nazi tools, don't like it? fork off" is much worse, especially since the kernel is a more foundational technology.

but saying, "hey we're not the only ones doing bad shit" isn't exactly great, either.

collaborating on finding ways for us all to do better is good, tho

@elle @GrapheneOS

It... does not have those symbols. We have been using this technology for decades. It only took off recently because there is enough processing power to handle bigger tasks (even if those tasks are generating slop, people chose to make it do that, which is an abuse of the technology). The greater issues with AI were bound to happen with something else if AI did not take off. The issues are far deeper, socially, economically, politically, and AI is a symptom of it.

The tool is just a tool, not associated with any negative imagery. Its abuse is purely the product of humans, and GrapheneOS is using it to achieve some good.

Dont get me wrong, I am incredibly anti AI, and I would rather GOS locally host and run these models, but that will take time.

@HybridStaticAnimate

I was writing metaphorically... yes, none of the frontier AI labs are stupid enough to *literally* use a swastika as their logo. but one very prominent one has a leader *bold* (read incredibly stupidly asshole-ish) enough to do *two* nazi salutes at the U.S. presidential inauguration. so xAI's Elon Musk is not that far from stamping a swastika on his forehead, is he?

@GrapheneOS

@HybridStaticAnimate

both Anthropic and OpenAI are also gleefully aiding the genocide in Gaza + Lebanon, and automated bomb strikes in Iran. notably a girls school w/ IRGC family members in attendance (little girls). all w/ the "cover" of it being old info in the training data...

these are all outright fascists, who have also admitted they're fine with the non-negligible prospect of AI killing all of us. probably marketing, mb true believers. either way, fuck them into the sun

@GrapheneOS

@elle "LLM fascists" lmao

@GrapheneOS

@GrapheneOS Because "ai" is best known first and foremost as being constrained by rules. Mhmm, the makes it all ok.

Morons.

@phaedral @GrapheneOS You must have a lot of time on your hands to come to a discussion thread just to post something that's neither relevant but just to insult open-source developers.

@GrapheneOS i am tired to see all the "ai bad" responses. It is clear ai is now a very useful tool.

@ilmiwi @GrapheneOS Some of the anti-AI people are as bad as if not worse than the AI bros in pushing their extreme views on others...

@GrapheneOS Should be forbidden.

@GrapheneOS gonna be blunt:

your approach to this has been beyond abysmal with some of this account's replies to being intentionally deceptive to avoid being up front about graphene's use of AI.

i remember uttering a "what the f--" at seeing you post close to two paragraphs to someone asking if you used AI and it was literally a yes/no question.

people are already looking to kick your teeth in for the crime of not being google; so i suggest you don't give them any additional reasons to do so.

@halfashark We've been very clear we don't disallow people from using AI on their own as long as anything they submit for inclusion is fully understood and rewritten to our standards. This platform is filled with abuse and hate towards us based around lies and misrepresentations. Once again attacking us because of how we write responses is nothing new. There has been a whole lot of personal attacks, bullying and harassment over the past day. It's only the latest round of that endless cycle here.

@GrapheneOS At the risk of placing myself in the crossfire: I don't know if it needs saying here, but there's a lot of people here who unequivocally hate or dislike AI. For those who find the technology itself unethical, arguments about how it's used & whether it leads to software quality seem to hold little sway. They'd rather hear that it's not used in any capacity and that the project explicitly bans it.

@dandels GrapheneOS cannot ban it while using Linux, AOSP, Chromium and other upstream projects using it. The majority of the code we ship using it while claiming to ban it would be ridiculous performative nonsense.

We could only ban our own usage of it and remain ignorant of bugs easily found with it until external contributors report those and submit fixes which we usually need to rewrite. External contributors to the project are going to use it regardless of what we say as will exploit devs.

@GrapheneOS
It isn't about being correct; it's a purity spiral. Reasoning won't work. Usually you just have to disengage until they get bored and attack someone else.

@paul @GrapheneOS 100% - witch hunt mentality.
It’s a flip side of the AI cult, anti-AI cult.

@GrapheneOS Great policy, doesn't matter if the cat is white or black, as long as it catches mice.

@halfashark

@GrapheneOS > There's an exception from this rule for translation and accessibility features.

Would you mind sharing the motivation/intent of this exception?