[doc] need a CONTRIBUTING.md document?

[robrwo]

I was looking for a document about how to contribute bug reports, security reports code and documentation changes.

On a related note, it might be wise to amend such a document with a policy regarding AI-generated contributions. See the one for Servo https://book.servo.org/contributing.html#ai-contributions

[Grinnz]

perlhack, perlpolicy, perlsecpolicy, perldocstyle are probably the most relevant documentation here, for more specific topics than covered by README.

[Grinnz]

As for adding a policy like you mentioned, the appropriate place is probably perlpolicy, but the mechanism for officially adopting such is trickier, probably involving consensus among the core team and/or p5p list.

[haarg]

This is basically the same issue as #21806

[guest20]

@haarg it is similar to #21806 except for the "Manually created bugs only please" part, which I think is a good point to address.

@robrwo This project is in a repo on github.com, I'm not sure every project on github needs to include instructions on landing a pull request on github‡, and the 🛡 Security tab is already active, so it feels pretty discoverable - except for all that stuff I was complaining about in #21806 obviously

Maybe the wiki and projects tabs could be turned off to de-clutter that ... upper area a little
__
‡. even if github is getting progressively more and more aggressively enshitified

[robrwo]

@guest20:

even if github is getting progressively more and more aggressively enshitified

It's not just GitHub's CoPilot. See https://www.reddit.com/r/perl/comments/1k28860/i_just_patched_the_neovimext_perl_module_with/

I decided to run an experiment and see if Claude Code could handle this since I don't have nearly enough knowledge about Neovim to do it myself.
...
After about 20 min of prompting and approving Claude's actions blindly, it was able to fix the issue, get the tests to pass, install the patched module, and submit the patch to the repo. It would have gone even faster if I had my git authentication set up properly so Claude could use it out of the box. Claude even fixed that problem for me, too. The only work I had to do was patiently sip on my coffee between approving Claude's suggestions.

So the issue is people submitting AI-generated slop they don't understand. Or worse, someone prompted it to generate code with a really subtle security hole.

But anyhow as @Grinnz noted, rules around AI-generated contributions should be discussed in P5P. (However, I do think such rules, once agreed upon, should be noted in a contributions document.)

[Leont]

perlhack, perlpolicy, perlsecpolicy, perldocstyle are probably the most relevant documentation here, for more specific topics than covered by README.

As for adding a policy like you mentioned, the appropriate place is probably perlpolicy, but the mechanism for officially adopting such is trickier, probably involving consensus among the core team and/or p5p list.

Yeah so then we should add a small CONTRIBUTING.md that points people in those directions.

[bulk88]

On a related note, it might be wise to amend such a document with a policy regarding AI-generated contributions. See the one for Servo https://book.servo.org/contributing.html#ai-contributions

I'm going to bet in at least 1 jurisdiction somewhere on earth in the past, there was a criminal trial, that the GPL violates multiple human trafficking and un-free labour laws https://en.wikipedia.org/wiki/Forced_labour . You can't work for nothing. That is what every house maid "aunt"/"cousin" with no genetic connection and doesn't speak the local govt language tells every local/international LE investigator during a raid. No $$$ == crime. 1st world parts of Europe makes it illegal to take outdoor photographs in a public space under the same logic. See also https://vtuhr.org/articles/10.21061/vtuhr.v5i1.43 https://www.investopedia.com/terms/s/stranger-owned-life-insurance-stoli.asp

If GPL/FOSS was ruled illegal. It was dismissed much later on appeals court or withdrawn a year or 2 later by the next PM/president in office, and a non-issue by 2000. Recent 2020s SBOM laws/regulations (Software Bill of Materials) are getting very close to making GPL & friends illegal again. Although it seems to me EU constitutional court is going to do some surgery on that law in the near future, to add a "was the GPL software written by the paid staff developers of a >25 or >6 employee for-profit company" section to that law.

[book]

But anyhow as @Grinnz noted, rules around AI-generated contributions should be discussed in P5P.

Indeed. It's probably good to think about this before it inevitably happens.

In the reddit post link above, the OP also writes:

And like any other patch, the maintainer with more expertise will have to review it before approving it.

And that is likely the biggest threat for us, as "maintainer with more expertise" is a scarce resource for the Perl core.

[ch0ccyra1n]

I am of the view that a total ban on any and all usage of LLMs is what would be most in the spirit of this module of perlpolicy. While it was not written with LLMs specifically in-mind, the idea that authors should control their work goes against even allowing LLMs to ingest such work for training or in their context (e.g. via Opencode or Claude Code).

In addition, we may have to deal with some consequences if we don't ban LLMs, for example regarding legal compliance, as well as driving away potential contributors who do not want LLM ingestion of their code, and so would choose to take their talents elsewhere.

I do hope this is taken into consideration when drafting a more specific policy regarding LLMs.

[robrwo]

I am of the view that a total ban on any and all usage of LLMs is what would be most in the spirit of this module of perlpolicy. While it was not written with LLMs specifically in-mind, the idea that authors should control their work goes against even allowing LLMs to ingest such work for training or in their context (e.g. via Opencode or Claude Code).

There are various problems with it:

• Some countries may make copyright exceptions that allow AI training whether the authors like it or not
• Open source licenses do not seem to disallow AI training
• There are different kinds of data mining: search engine indexing, virus scanning, security analysis, bug analysis, academic study (which many authors do not mind), and generative AI (which is what many people do object to)
• There's a grey area between a system that can analyse code for bugs and recommending fixes (which is generative)
• This cannot be enforced through technical means, since open source code can be coped and that would require every software repository and website that hosts the code to enforce it consistently
• This is expensive to enforce legally, and what may be held up by courts in one country may not matter if another country allows it
• It's difficult to identify people hiding behind anonymization services like Tor, VPNs, or shady cloud providers
• Code quality metrics used by MetaCPAN (e.g. Kwalitee) count as a kind of data mining
• CPANSec want to use various kinds of tools to analyse modules for security issues

At PTS some of us discussed ideas for adding automation policy metadata https://github.com/CPAN-Security/cpan-metadata-v3/blob/main/automation-policy.md (code to be released soon) and we decided against adding something for authors to express data mining restrictions because it was basically unenforceable, and having it would create expectations that it could be enforced.

This is a bad situation, because much of the control has been taken away from authors already. But it's not black and white:

• The nature of open source is that you lose some of the control by letting other people see and use your code.
• Some authors are happy with their code being consumed by LLMs.
• Some authors people are happy to have LLMs write code for them.
• Some authors are happy to use LLMs to analyse code and make recommendations.

In addition, we may have to deal with some consequences if we don't ban LLMs, for example regarding legal compliance

That is a concern, as are code quality and security.

[book]

In addition, we may have to deal with some consequences if we don't ban LLMs, for example regarding legal compliance, as well as driving away potential contributors who do not want LLM ingestion of their code, and so would choose to take their talents elsewhere.

This argument can easily be turned around to claim an AI-ban will drive away potential contributors who want to use AI for their contributions.

And we can't really control how a given contribution was made: we will only see the result anyway. What we can control and demand is what form future contributions will take. For example, have a human person taking full responsibility for the contribution, properly sized changes, passing tests, disclosure of AI tools used (if any), etc.

[guest20]

an AI-ban will drive away potential contributors

Who? Are these contributors in the room with us now?