Debian rejects an LLM ban and keeps AI disclosure voluntary
Debian developers voted through August 28 to adopt "Responsible Use of Generative AI," the Condorcet winner over seven rivals including an outright ban on LLM contributions. The project neither endorses nor prohibits the tools and encourages disclosure without requiring it, so a maintainer reading a merge request works from the same signal as a year ago — the diff itself. The one new hard line is secrets: confidential material, embargoed security bugs, cryptographic keys, and credentials stay out of third-party AI services without explicit authorization, and whoever signs the upload stays answerable for correctness and licensing regardless of what produced the code.
Source: helpnetsecurity.com ↗
A maintainer reading a merge request can't tell whether a person or a model wrote the diff, and nobody has to say.
Why this matters
- → Secrets policy explicitly bars AI services from embargoed security bugs and credentials
- → Review remains the only control; AI code gets same scrutiny as human code
- → Licensing liability stays with the uploader, model output provenance stays opaque