frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

Open in hackernews

Pop!_OS bans AI-generated code from much of its codebase

https://www.neowin.net/news/system76-bans-ai-generated-code-across-many-of-its-cosmic-codebases/
60•bundie•2h ago

Comments

zzzeek•1h ago
banning AI from PRs because you're swamped with too many low quality PRs, definitely. We pretty much are doing this with SQLAlchemy. If I'm going to have a small fix or improvement coded by an LLM (which I do all the time), I want to prompt the LLM directly, rather than having someone trying to pad their resume forward my communications onto their LLM via PRs. What's the point of that?
nonethewiser•58m ago
> If I'm going to have a small fix or improvement coded by an LLM (which I do all the time), I want to prompt the LLM directly, rather than having someone trying to pad their resume forward my communications onto their LLM via PRs. What's the point of that?

Which is why LLM PRs should just be issues (if there isn’t one already). Make the issue author a co-author on the PR. But let the maintainer actually oversee the LLM generated solution.

api•50m ago
Maybe the policy should be: no AI PRs except from established contributors who have been vetted?

So basically you're saying you reject drive-by PRs.

whateveracct•34m ago
drive-by PRs that are handwritten are presumably okay
nicoburns•11m ago
Reasonable, although I've taken a different approach. Either closing such PRs, or treating them as very detailed issues and having my own LLM build the actual fix.

My repos probably don't see as much traffic as SQLAlchemy though.

baq•2m ago
rejecting low quality ones should be the norm regardless of whether an AI or a human wrote them. the question is what would happen if you were swamped with high quality PRs? what will happen once you are? (that's probably a 2027 question!)
ItsMattyG•58m ago
I don't see how this will survive the attacker/defender gap as ls get increasingly good at cyber security and finding 0 days... but maybe it's an obscure enough is it doesn't matter?
barbazoo•56m ago
I'm assuming they still use AI to find vulnerabilities, just not fix them?
PorciiVorbesc•55m ago
Probably because pop_os and Cosmic are so niche and their market share so low, that they're irrelevant to attackers and bad actors, when those now have much bigger fish to fry.

I think even amongst the HN and Linux userbase, pop_os is still niche, let alone amongst normies who never heard about Linux. So they can afford take the high road and treat it like their personal sandbox accepting only human written code.

But larger and more important projects like Fedora and Debian are more realistic and pragmatic with the fact that they'll have to accept AI written(but human reviewed) code, if they wish to keep up with the real world development and threats, as expressed by Linus Torvalds himself.

The thing is, the cat's out of the bag on this one now, especially in the fields of pen-testing and reverse-engineering. AI can brute-force its way into projects in ways that beat experienced researchers, so your only choice to keep up is to accept the use of AI generated fixes as a counter defense.

DelightOne•37m ago
It also means security is not held as high and vulnerabilities not as much found. A simple 0-day may survive for years. Not much effort needed to have permanent access.
PorciiVorbesc•
lkramer•55m ago
I had a PR in flight that got closed because of this. I had an issue with passwords in the network applet for the VPN and had used Claude to help me identify and then come up with a fix. I did spend a lot time handcrafting and making sure the quality was good, but I respect their decision and no hard feelings, but as someone who have struggled to find time and opportunity to contribute to open source it was a small set back.
sedan_baklazhan•33m ago
What is actually the meaning of “handcrafting” here?
throwaway74628•13m ago
My guess: taking personal responsibility for the functionality, readability, and sanity of the change proposed, both atomically and in the context of the wider code base (adhering to existing conventions and patterns), to the best of the author’s ability.
Cyan488•17m ago
I found your commit and your usage of AI seemed reasonable. It seems to me like your PR itself and the subsequent comments and correspondence was also human written.

I think a PR "in flight" shouldn't have been closed like that.

All this will do is push out developers like you that honestly disclose, and instead people will now just lie.

brink•53m ago
I also have found that AI has not lived up to many of its promises and have dialed back what AI gets control of. My projects were turning into unmaintainable messes. The people who say coding is solved aren't paying attention.
lucianmarin•33m ago
Yes. I started two projects with AI from scratch. Both abandoned, complete mess. Projects without AI are so easy to manage, maintain, add/remove features, etc. I use AI as a search engine on my projects instead of Google. I ask what's wrong with my code and change or improve it myself based on my experience.
dnautics•9m ago
I have the opposite experience. I don't have the patience sometimes to clean up my code and stick to coherent conventions and organization even though the will is there. With my AI projects I watch it and if the AI starts drifting I ask it to go through and look for convention/directory structure violations and it happily cleans everything up in about 10 or so minutes.

Are you in Python by chance? Python has a lot of crazy hidden/inexplicit/spooky action at a distance stuff (especially in the frameworks) that can make LLMs gunk up code by defensively programming or just burn context chasing data provenance

fasterik•3m ago
I've been a vibe-coding skeptic for years, but I decided to experiment with the latest models on some test projects. They're a lot more capable than I thought they would be. I agree that it's easy to create an unrecoverable mess, especially when you're one-shotting a lot of features without detailed instructions. But I find that as long as I'm strict about the API boundaries and force the agent to work in small chunks, it's pretty effective.
holoduke•52m ago
Doing that will put you put of the market. I am certain of that.
lumpysnake•9m ago
There are a whole lot of people (in tech) who truly hate AI and want nothing to do with it. Those people will flock to projects who take a stand against it.
baq•4m ago
it doesn't matter. it's delusional to think you can outcompete a thing for which solving a Millenium problem is just Tuesday. it's the anger phase of grief, nothing more.
VCFundedGenYer•42m ago
Thank god. Tired of these orgs blindly and stupidly allowing them (Debian, cough).
sdcfgy•38m ago
Same trouble we have. Some clever person says to use AI agents for code review. 100kloc commit got flagged through on Friday. Taking this week off. Not my circus.

Faith is the problem. Extraordinary claims must stand up to scrutiny. They do not.

mahboi•11m ago
I still wanna see what Slop OS looks like. Go full AI spam making a Linux distro from the kernel up.
sippingabonedry•5m ago
Completely performative.

You build your OS atop thousands of open source packages, many of which contain AI generated code. Are you going to audit them one by one and remove offending packages? What about the ones you won't remove because the OS would be irreparably broken?

winrid•4m ago
I wonder if the issue is mostly the code or the AI written PRs and people using AI to talk to the maintainers. I personally just ban anyone doing the latter, I don't want to talk to opus more than I already do lol
33m ago
Sorry, I don't understand what you mean by this, can you elaborate pls?
badc0ffee•28m ago
It does show up on top 5 lists for Linux desktop distros quite a lot, and COSMIC is quite unique, so I suspect a lot of people are at least trying it.

(I wasn't able to make it work on a scrap Dell I tried it on because the GPU was too old. Booted the USB key and COSMIC greeter failed to start)

PorciiVorbesc•24m ago
>It does show up on top 5 lists for Linux desktop distros quite a lot

1) Firstly, surce? My research according to Google Gemini 3.8 Pro shows top 5 DEs are as follows:

  +---+---------------+------------+-------------------------------------+
  | # | Environment   | Est. Share | Primary Ecosystem / Defaults        |
  +---+---------------+------------+-------------------------------------+
  | 1 | GNOME         | 45% - 50%  | Ubuntu, Fedora, Debian, RHEL        |
  | 2 | KDE Plasma    | 25% - 30%  | SteamOS, openSUSE, Kubuntu, Manjaro |
  | 3 | Cinnamon      |  8% - 12%  | Linux Mint flagship                 |
  | 4 | Xfce          |  6% - 9%   | MX Linux, Xubuntu, low-spec PCs     |
  | 5 | MATE          |  2% - 4%   | Ubuntu MATE, Mint MATE (GNOME 2)    |
  | - | Others / WMs  |  3% - 5%   | Hyprland, i3, Sway, LXQt, Budgie    |
  +---+---------------+------------+-------------------------------------+ 

2) Secondly, keep in mind that distrowatch is not representative of linux userbase. MX-Linux kept showing up at the top spot for many years despite being niche.

3) And thirdly, TOP 5 DE isn't really an achievement when Linux DE market share is overwhelmingly dominated by KDE Plasma and Gnome as the majority shareholders, with XFCE and Cinnamon trailing. So Cosmic DE if it somehow made the no. 5 spot, would still be ignorable sub <1% market share, as I initially claimed, basically invisible to bad actors.

iugtmkbdfil834•14m ago
<< Probably because pop_os and Cosmic are so niche and their market share so low, that they're irrelevant to attackers and bad actors, when those now have much bigger fish to fry.

That is such a weird statement that I am not entirely certain where to begin. PopOS is hardly niche. Its base are all fairly common components by linux standards. And, more importantly, attackers and bad actors may other considerations in mind than sheer population size -- just to point out the glaringly obvious.

<< I think even amongst the HN and Linux userbase, pop_os is still niche

I think rather than trying to disprove it, I think I should ask why you think that? If anything, PopOS annoys me because it is just a step before ubuntu ( and ubuntu is just windows at this point ). Maybe I am defensive, because my first real distribution ( that did not share disk with windows was popos )?

vorticalbox•53m ago
The issue is “ai generated code” using ai to find bugs/0 day and manually writing a fix would (I assume) be allowed under the new rules.
altcognito•52m ago
Irony is that they will get the benefits from upstream projects (like the Linux kernel) that does accept AI inputs.
VCFundedGenYer•41m ago
AI finds a lot of "vulnerabilities" but most are fake, untested, or not actually vulnerabilities.

Reminder that AI is quite stupid.

dumberquestions•28m ago
I think this is just plain denial, AI has found many high severity vulnerabilities.
zdragnar•9m ago
There's plenty more false positives than actual finds. There are still actual finds, but that doesn't change all the false positives.
layer8•29m ago
Using AI to find vulnerabilities doesn’t mean that you need to use AI to generate the code that fixes them. And you can still ask AI whether it thinks the fix is okay, as a second opinion.
fignews•3m ago
Have you considered that maybe this is a reflection of your skills rather than that of the LLM?
bitfilped•17m ago
The people saying programming is solved couldn't program in the first place is what I've noticed. So to them it really does feel solved, things "work" and they don't have to learn what they don't know about programming.
orangecat•4m ago
I've been programming professionally for decades. LLMs are extremely useful. At this point if you haven't figured out how to get value out of them, you're either holding them very wrong or you're being willfully ignorant.
nicoburns•14m ago
Were you reviewing the changes? I've seen lots of projects with this problem. But if AI PRs have to pass the same review bar as any other PR then it shouldn't be an issue in theory (if you can actually maintain the discipline).
thesdev•7m ago
Isn't it tiring to keep up with considering the speed of the generated code? And if you want to be careful with the review you lose a significant part of the speed advantage.
analog_daddy•8m ago
Oh my god. I am sad to have to acknowledge this even if the models have “theoretically” gotten better. I am not a programmer but I am super opinionated with the design and structure of the code and need to make sure whatever I write/ask to generate and use for my own tasks is understood by me at least once. I wasn’t this way in 2023. I am constantly reading/trying for an agent to help me write simple code without spending too much time. But so far nothing has worked. I wish someone figures it out otherwise, I personally would not be able to realize the AI agent productivity benefits that others are supposedly seeing.

Hole Punch: Sling your spaceship around gravitational fields

https://notoriousbfg.com/hole-punch/
54•trwhite•1h ago•17 comments

Kolibri – Tech Report [pdf]

https://aleph-alpha.com/downloads/tech-report.pdf
78•yu3zhou4•2h ago•2 comments

Celebrating the 100th birthday of the kidney donated to him as a teenager

https://www.whec.com/top-news/webster-man-celebrating-the-100th-birthday-of-the-kidney-his-mom-do...
41•gscott•2d ago•6 comments

FTL: A new operating system for clouds

https://ftl-os.org/
114•romac•5h ago•49 comments

Kolibri: A Sovereign Open-Weight Model

https://aleph-alpha.com/en/blog/kolibri-has-landed-a-sovereign-open-weight-model/
362•bastitx•10h ago•248 comments

Show HN: Pi pod – Run your pi coding agent in sandboxes on your own server

https://pipod.dev/
29•edverma2•1d ago•17 comments

ADHD, autism or complex trauma? [pdf]

https://www.cambridge.org/core/services/aop-cambridge-core/content/view/30CC4826561366615BFAEC807...
147•skeptical1884•1h ago•102 comments

Vx – One Language, Every Chip

https://vxlang.org/
20•elffjs•2h ago•13 comments

Pop!_OS bans AI-generated code from much of its codebase

https://www.neowin.net/news/system76-bans-ai-generated-code-across-many-of-its-cosmic-codebases/
61•bundie•2h ago•43 comments

Woking Electrical Control Room (2016)

http://www.darbiansphotography.com/woking-electrical-control-room-urbex
106•NaOH•23h ago•18 comments

RetailReady (YC W24) Is Hiring

https://www.ycombinator.com/companies/retailready/jobs/bFcgIe4-implementations
1•sarah74•3h ago

C++ Insights – See your source code with the eyes of a Compiler

https://github.com/andreasfertig/cppinsights
114•rramadass•1d ago•22 comments

Show HN: Graphene – Data analysis toolkit for your coding agent

https://github.com/graphene-data/graphene
10•kcmarr•1d ago•2 comments

Newgrounds.com – A community of games, music, and art

https://www.newgrounds.com/
410•azhenley•19h ago•120 comments

MPEG-2 Transport Streams and MOQ: Yes, MPEG-TS Is Still Relevant Today

https://www.red5.net/blog/mpeg-2-transport-streams-and-moq-yes-mpeg-ts-is-still-relevant-today/
21•mondainx•2d ago•6 comments

Body Awareness in Goffin's Cockatoos

https://www.nature.com/articles/s41598-026-57500-7
26•bryanrasmussen•3d ago•3 comments

Court agrees with EFF: Utah's VPN law demands a technical impossibility

https://www.eff.org/deeplinks/2026/10/court-agrees-eff-utahs-vpn-law-demands-technical-impossibility
763•hn_acker•1d ago•370 comments

Show HN: Our space game has a built-in RISC-V emulator that runs Linux

https://againstallodds.games/blog/2026/10/03/our-risc-v-emulator-pasriscv/
43•nor-and-or-not•1d ago•12 comments

Two American Airlines Flights End Up with the Same Flight Numbers

https://aviationa2z.com/index.php/2026/08/19/two-american-airlines-flights-end-up-with-same-fligh...
13•samch•56m ago•4 comments

Mike Tomlin spent 12 years building a Minecraft city

https://www.nytimes.com/athletic/7648198/2026/10/01/mike-tomlin-minecraft-nfl-coach/
629•CoryOndrejka•2d ago•149 comments

Apple Pass Designer

https://developer.apple.com/pass-designer/
535•soheilpro•1d ago•320 comments

Cloudflare OHTTP gateway

https://blog.cloudflare.com/announcing-cloudflare-ohttp-gateway/
172•est•16h ago•80 comments

A 12-year sequence of telescope images of a star and four planets orbiting

https://bsky.app/profile/theplanetaryguy.com/post/3mwucf5ert22f
378•mariuz•1d ago•77 comments

Holes (1996-2025)

https://plato.stanford.edu/entries/holes/
26•surprisetalk•1d ago•6 comments

Loss of cell identity drives human aging: Two new papers

https://erictopol.substack.com/p/loss-of-cell-identity-drives-human
347•bookofjoe•2d ago•166 comments

The characters of plastics (2024)

https://yarchive.net/blog/plastics/
5•thelastgallon•13h ago•2 comments

City building games have a Soul Problem pt.2

https://www.radical-elements.com/minor-epiphanies/city-building-games-have-a-soul-problem-pt2
109•lexx•4h ago•107 comments

An Update on Orion for Linux and Windows

https://blog.kagi.com/update-orion-linux-windows
163•pentagrama•15h ago•93 comments

FLUX 3 Image

https://bfl.ai/models/flux-3-image
420•minimaxir•2d ago•92 comments

From the creator of Redis; run LLM locally with ds4

https://dwarfstar.sh/
332•fibo•1d ago•95 comments