[TZubiri]

Interesting that this makes no distinction from using LLM output and using LLM assistance. An overly strict policy is better than no policy, but I wonder if using llm for conversation and analysis, but not code/config generation, was discussed.

[aabhay]

I’m curious what makes you believe that this distinction is precise or meaningful. What exactly is the difference?

[preg_match]

The difference is LLMs are extremely good at analyzing code under the careful hand of an engineer. This is how most vulnerabilities are found now.

Prohibiting that might mean that security falls off.

And, if the concern is code quality, then everything before the code writing shouldn’t matter. A good engineer using an LLM for analysis and then writing a patch by-hand might create a better patch.

[pixl97]

A rather mean counter troll to this is rather than submitting any bugs/security flaws to Debian, just immediately zero day them and say it's because of their LLM policy, since the bugs were found by an LLM.

I'm guessing after a few dozen serious risks that are found some people might think twice.