How about making a rule that it is at least six months old and in continued development? This would filter out most slop.

You can chain-load bootloaders but I am sceptical whether more complexity is helpful. At lesst grub is relatively easy to reinstall.

Caution, dual-boot means you have to power down your system before you can start the other, if you share any file systems. Hibernate and then booting another distro will result in file system damage.

The alternative would be a virtual machine.

It can also occasionally mess up the grub configuration, which means you have to reinstall grub.

As for the people throwing shade for ethics, EVERYONE breaks their ethics for consumption and EVERYONE has their justifications.

There might be some guilt feelings involved in the uproar.

But science is very clear that in order to keep a somewhat livable climate, we have to massively reduce CO2 emissions. This is a hard requirement. A planet Earth with 3 degrees warming will not be liveable for most humans.

The GenAI hype goes exactly into the wrong direction. We have to reduce, not increase. It is a civilisatory no go.

It is clear that as a society, and moreover in a plutocratic system where the richest people are deeply invested in fossil fuels, we are in deep internal conflict. But we cannot avoid this conflict. If we continue to let it happen, fossil fuels will kill us.

Accept something along the lines of a positive account given by an experienced software engineer - it’s useful, it presents risks but also it presents new ways to get certain work done well in much less time etc.

I agree to the utility of finding security bugs but the general utility of using LLMs is often overblown. There are studies that say that 95% of companies do not see any measurable positive impact.

The Linux kernel is likely a special case. But for other open source developer communities, it seems to have some negative impacts, too. And the full effects on maintainability of code will only be visible after some years.

I like the car analogy. I never had a car, and the last time I called to use one, I had had eye surgery and needed to get home.

There are many aspects of the analogy that match quite well:

• some types of motor vehicles like ambulances and trucks are clearly useful but most uses are not
• cars have a massive negative environmental impact (220 grams of CO2 per every kilometer, not to speak of toxic air pollution, photochemical smog, and particulate matter that appears to cause dementia)
• especially in cities, car feel much faster than they effectively are
• cars destroy cities and walkable communities, to such a degree that European cities like Paris come to new life after restricting cars
• cars are extremely convenient, such that they become an addiction quickly, and after a while you don’t even believe you can’t walk two miles on your feet. You even lose your sense of walking distances.
• cars massively increase the daily distance you travel, because of Marchetti’s constant (humans have a time budget of one hour travel a day), which changes your whole daily routines, leads to more distant work places, urban sprawl in housing, and after a while you are really physically dependent on them
• using cars is bad for your own health because it leads to lack of exercise, which leads to multiple common and deadly diseases
• cars do actually cost a lot of money which is sucked up by a corrupt industry and even more corrupt fossil fuel producers

These things are certainly made addictive by design, like TikTok, YouTube, and modern social media.

And even if the Internet itself is useful, these addictive-by-design stuff is so harmful that it is likely that the net effect is negative.

I see what you mean.

Yes, that’s true. In that aspect, it would be better to have an LLM which is trained on GPL code only and which returns copyleft licensed code.

However, I think using LLMs for code analysis is not affected by that. Maybe there will turn out a legal difference between code that is entirely LLM generated and code where humans do most of the editing.

One popular legal position is that LLM generated code itself is not subject to copyright law. That might be re-adjusted if the LLM has actually regurgitated training code.

In the long term AI will likely decrease the contributors as already seen with AI blowing up some traditional communities.

I do not agree to the AI hype, but I doubt that. The vast majority of the kernel code is hardware device drivers because one of the main functions of the kernel is hardware abstraction. Hardware is made by companies and being able to use ai will not reduce, rather increase their willingness to submit open source device drivers. If they do not, LLMs also seem to make it easier to reverse-engineer closed source Windows drivers.

Another thing to keep in mind is that the Linux kernel is quality-wise far above 99.9% of software projects. This means that you cannot apply observations of the effect of GenAI on software in general on the kernel, and also not vice versa.

The average usage of GenAI could totally trash 99% of company code bases within four or five years, and the kernel would still be fine.

Also, the way the kernel allows usage of LLMs is not necessarily a good blueprint for other open source projects, because these have less expertise, resources, and people which are experts in reviewing alien code.

I am not going to defend the unacceptable external costs of LLMs here, namely the environmental destruction and the large-scale rug pull on social contracts for creative people.

But adressing your argument, it is totally possible to rewrite the Claude slop to clean, easy to review software. I guess this would be far less work than to reverse-engineer a driver just from captured USB communication.

(That is just my $0.05, but I think the main problem with AI slop in smaller software is not that the code they generate is completely unreadable, but that the LLM systems tend to break down after a few thousand lines, and that they produce architecturally unsound and often subtly wrong software, which leads to an exponentially increasing amount of technical debt if not continously corrrected by experienced people.)

One technical alternative for Linux users is to use for example the pass program, which stores via GnuPG keys, and put the key on a GnuPG SmartCard. This enables a kind of 2FA on the user side (one needs the SmartCard and its PIN).

Another alternative would be KeePassX and YubiKey.

Another password and TOTP, which can be required on the service side.

This does not fully protect against phishing but is very helpful for using unique strong passwords.

I do not think the phishing protection is worth additional privacy erosion. Privacy is not really a nice-to-have. Due to targeted advertising (see the Cambridge Analytica example), loss of privacy is turning into a real threat for our democracy.

Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers. It’s an explicit non-goal of the designers of passkeys, who work together in a forum anyone can join.

And trust me, websites and apps like banks repeatedly asked for attestation at the beginning of the industry’s passkey journey. The platforms, browsers, and credential management apps have held firm that the goal of passkeys is reducing phishing and not some kind of trusted computing scheme.

Isn’t this exactly what Microsoft Authenticator app does now? MS requires its own app to log in to corporate outlook accounts, and does not support TOTP and other password managers any more. So, authentication is more and more linked with identification of the user, and attestation. For example, the backup method is a phone call, which requires the user to reveal their phone number to Microsoft. And a future version of the MS authenticator app could easily require to add fingerprints, or facial recognition.

This simply isn’t possible to do because attestation isn’t supported on the web for mass market, consumer authentication. Attestation for passkeys (software-based, syncable credentials) is antithetical to their mass market goals, and would freeze out independent, non-corporate-backed credential managers.

The argument is there that requiring attestation would harm mass market adoption. This might be true for some optional services. But it is not true for those services that a lot of people simple have come to rely on to organize their daily life - Google Mail, MS Outlook for work mail, things like DHL parcel delivery, public transport, and so on. These services are in 2026 not optional any more, and the corporations providing them are pushing hard to identify and attest users.

Another case where this has been happening if for example the German national train network, which requires for full usability and getting discounts to use its app, and which requires a user identification for any payments. The net effect is that you can hardly use the train without being fully traceable. This isn’t very nice if you are a normal citizen in a democracy, but becomes quickly dangerous if you are member of a minority group in a country governed by the nationalist far right or an authoritarian government.

true.

Three things more:

The Linux kernel is Torvalds project.

The fact that experienced kernel developers can sometimes use LLMs to their advantage does not mean that the average Joe Codemonkey can do it. These algorithms are often described as a kind of competence multiplicator - but experience from education shows that they are more risky than that and can hinder learning.

And third, we should in this question not put too much weight in the opinion of influential people. Behind the GenAI tech are huge corporations which pour billions of money into it. It is likely that they can pressure and bribe people and that they also pay influencers and bloggers to tout their stuff. Making decisions dependent on single influential persons, however competent and acclaimed they are, is therefore dangerous (see Eric Raymond, Eva Kaili or Gerhard Schröder). Torvalds is not Jesus, and I am pretty sure he didn’t apply for that role.

Copied from another thread:

When he came out talking about allowing LLM code contributions everyone told him this would happen.

He has criticized the excessive hype around GenAI/LLMs long before. Torvalds has generally a very pragmatic approach, not a black-and-white one.

Is it true that more experienced / knowledgeable / capable people, if at all, have more of an advantage from it, than juniors?

And on the other hand, it seems to me that these things are designed to take things out of our hands - “let me write that difficult email for you”, and so on…

deleted by creator

I do not want to cite Hickeys text because it is brilliantly written and grabbing some phrases would diminuish it. Go and read it.

The tl;dr of his argument is this: “Tools” are something that we fully and directly control and that enhances our abilities. Large Language Models are neither.

Passkeys big bonus is that they are far more phish-resistant than pretty much any other MFA out there.

So, what is actually the threat model? And does it justify to take away user’s control over keys?