With all the discussion around detecting when a code repo contains commits authored by an LLM, I think it is important to note commits like the following in Mozilla Firefox from 2 weeks ago:

"Bug 2011195 - When an agent commits, don't add itself as author"

https://github.com/mozilla-firefox/firefox/commit/71cc24b6a400dbd434e4df37087960d94b764791

I don't think it's a good thing that Mozilla seem to be explicitly encouraging unattributed LLM code in Firefox.

Bug 2011195 - When an agent commits, don't add itself as author r=ai4… · mozilla-firefox/firefox@71cc24b

…dev-reviewers,suhaib DONTBUILD Differential Revision: https://phabricator.services.mozilla.com/D279515

GitHub
Client Challenge

@pinskia
For FF that's not an "even". A PR must be preceded with a Bugzilla post, or it will autoclose. They manage issues there, not on GitHub. It's still frustrating, tho.
@sarahjamielewis Good that they’re not pretending a machine is a person. Bad that they’re not coming up with a new git footer to document their bad decisions.
@mallory @sarahjamielewis willfully bad people will just ignore it :(

@sarahjamielewis thanks for the link !

Interesting, seems counter to the discussions like this one yes

https://github.com/orgs/community/discussions/185387

Exploring Solutions to Tackle Low-Quality Contributions on GitHub · community · Discussion #185387

Hey everyone, I wanted to provide an update on a critical issue affecting the open source community: the increasing volume of low-quality contributions that is creating significant operational chal...

GitHub

@sarahjamielewis
Yet another reason to abandon Firefox and Mozilla in general.

Edit: Use NetSurf or Lynx. Or just curl or wget.

@jbowen >not just reading the OTA traffic in Wireshark
You get used to it, I don’t even see the code, just “blonde… brunette… redhead…”
@jbowen @sarahjamielewis we need a new browser, its kinda ovbious, both the major browsers are horrible companies now. We need a new browser, we need it to be big, and paid devs to work on it. Volenteer based projects are cool, but there needs to be money behind if
@skymtf @sarahjamielewis @jbowen I'm personally hoping that Orion by the Kagi devs will be good. I've been pleased with their search so far.

@wombatpandaa @skymtf @sarahjamielewis @jbowen

Kagi is hot garbage, sorry to say.

They're also wasting tons of resources developing AI slop, and don't understand basic privacy concepts either:

https://d-shoot.net/kagi.html

Why I Lost Faith in Kagi

Issues with Kagi's AI focus, finances and leadership

lori's blog
@pip @skymtf @sarahjamielewis @jbowen I'll admit that I don't love how much resources they're putting towards AI. I'll check out your link when I have some time, thanks!
@wombatpandaa @pip @skymtf @sarahjamielewis
Yeah, I definitely think of Kagi as an AI slop shop first.
@pip @skymtf @sarahjamielewis @jbowen thanks for that, I read the whole thing and it was enlightening
@skymtf @sarahjamielewis I'd like one, which is why I'd gotten excited about Ladybird, but they turned out to be anti-trans scum.
Servo aims to empower developers with a lightweight, high-performance alternative for embedding web technologies in applications.

Servo is a web rendering engine written in Rust, with WebGL and WebGPU support, and adaptable to desktop, mobile, and embedded applications.

Servo
@gkrnours @skymtf @sarahjamielewis I have and in writing this reply I realized I conflated the Verso browser project shutting down with the Servo project. I need to become reacquainted with Servo :)
@jbowen @skymtf @sarahjamielewis I don't know if you noticed, they now have an app you can download and use, which is a bit more useful to most people than a library :) Also they announced a couple month ago you could use mastodon web frontend with servo
@gkrnours @skymtf @sarahjamielewis
I saw it yesterday when I started looking into it again :)
@sarahjamielewis OTOH I'd think having a real human to blame would be less bad than a machine… 🤔

@sarahjamielewis

"Author... "

Lol

The producer of a "leperous distilment" needs a better word than author.

Something that says malicious laughter, incompetence and illegitimacy.

Maybe Shakespeare.

#ai

@sarahjamielewis according to my understanding of current copyright guidance in the United States, doing this means they forfeit their copyright to the entire Firefox codebase.
@sarahjamielewis attached excerpts are why i believe this. these come from this document, the Congressional Research Service's report on Generative Artificial Intelligence and
Copyright Law.

https://www.congress.gov/crs_external_products/LSB/PDF/LSB10922/LSB10922.8.pdf

@sarahjamielewis @linear no, it just means that the slop output is not copyrightable as a work in itself

(it’s still encumbered by the licences (or lack thereof) of all the stolen works they fed it with)

@mirabilos

my understanding is that what you said is the case if it is disclosed, or failing that as in this case, can be determined after the fact:

"Zarya of the Dawn: A February 2023 decision that AI-generated illustrations for a graphic novel were not copyrightable, although the human-authored text of the novel and overall selection and arrangement of the images and text in the novel could be copyrighted."

but that if it is not disclosed, and the AI-generated output cannot be separated upon request from that made by humans, then the entire work is at risk:

"Théâtre D’opéra Spatial: A September 2023 decision that an artwork generated by AI and then modified by the applicant could not be copyrighted, since the applicant failed to identify and disclaim the AI-generated portions of the work as required by the AI
Guidance."

@linear right. One could argue that the codebase ca. 2019 is likely untainted, and use that as measuring stick for what changed.

The other thing is that you can of course mix uncopyrightable PD stuff into a larger work, if your own stuff is copyrightable. That ofc only works if the former is indeed PD and not encumbered with the rights of the stolen works’ creatives.

@mirabilos yeah. in this case i think it primarily raises concerns for future contributions. one wonders if a judge might, if reviewing this, rule that all contributions after this commit are public domain, unless the provenance of the code is very clear, e.g. patchsets taken from other projects which do practice due diligence
@linear @sarahjamielewis No, the issue sound like an agent writes the commit message and commits it. Not about it writing it the actual code. That shouldn’t have any impact on the actual code base.
@basxto @sarahjamielewis from the Claude documentation I have read about this feature, it is explicitly used for adding co-authorship to commits and pull requests that are written substantially by the LLM.
@basxto @sarahjamielewis the "pr" one is for pull request descriptions, but the "commit" one is about the contents of the commit, not just the message, as far as i can tell.
@linear @sarahjamielewis Yep, it seems to be allowed to write commit content. One person says they only use it for commit message generation, but appears to be only that person. https://phabricator.services.mozilla.com/D279515?id=1186947#inline-1534420
⚙ D279515 Bug 2011195 - When an agent commits, don't add itself as author r?padenot

@sarahjamielewis ffs mozilla is the worst ​
@sarahjamielewis oooooooohhh ffffffuuuuuuuuuu what even is this timeline I cannot any more

@sarahjamielewis and that was sylvestre?

Will he add slop to the Dehian package, too?

@sarahjamielewis If Firefox hadn't already driven me away for good I'd be very upset
@sarahjamielewis There isn't much to think about this, this is objectively not good
@sarahjamielewis the “ai agent” cannot own the copyright on the code it produces so that might be one reason not to add anything to the author list - that said any code produced needs to be identified as you might have to check if it was copied from any training code (and the license requirements of that code). pyOpenSci and rOpenSci just wrote up new policies on this.
@brianrepko @sarahjamielewis The issue seems to be the opposite. They don’t want the AI to add itself to the author list when hey let an AI write the commit message and commit it. The wording isn’t 100% clear, but the made changes look like that.

@sarahjamielewis Closed source who cares. But with open source if there’s a massive successful lawsuit due to the endless stealing of training material every piece of code produced from that training set is tainted.

That’s something that should make open source reject all this, as a very big risk that’s not worth it.

Imho.

@sarahjamielewis the fact that theyre actively trying to hide this shit genuinely just disappoints me
@sarahjamielewis if nothing else this is legally dubious. AI authored content is uncopyrightable so all LLM written code is public domain.
@sarahjamielewis im not sure this would evade detection since theres a .claude/settings.json file now explicilty telling it to do this ..

@sarahjamielewis

Well it can be. Maybe (but probably not) people will start to think more about the quality of code they're trying to contribute when it is their credibility and not the "xyz bots" on the line...

@sarahjamielewis ssh xz bug here we goooooooo
@sarahjamielewis As a tester I find bug reports with titles like "When an agent commits, add itself as author" (#219842) and "When an agent commits, don't add itself as author" (#2011195) highly confusing as they read like they are describing intended behaviour. But a bug report should describe unintended behaviour like "Agentic commits are not attributed to the agent". So before jumping into conclusions about the intent of the authors, I would try to clear up the actual requirements.
@sarahjamielewis I did read a bit further and found that it is because of the dev laziness.
They are too lazy to write commit messages themselves. So they ask the LLM to write them.
And then they are also too lazy to copy paste the generated text themselves, so ask claude to do that.
And they are too lazy to push the commit button, so claude has to push it for them.
And this change is to hide all this laziness.
@gunstick @sarahjamielewis Also, nothing like guardrails that can be bypassed by saying "Just do it".
@sarahjamielewis Mozilla is so confident that Firefox users love "AI" slop in their browser that they feel the need to obfuscate its inclusion from them. "We don't need them to know, because we already know that they like it and consent to it! We know better!"
@sarahjamielewis its annoying, but i think this is a race simple ideas like this just wont win. The major problems with LLM coding tools revolve around code theft (in training data) and erosion of human skills.. Neither of which you can tell from thier outputs. By far the worst part of AI in tech is the corruption and impunity that pushes it. It is possible without that. You cant tell from the outputs any more than you can tell the political party of a developer in a patch file.