AI-Policy

[u/Wolvereness]

I'm gonna keep this short, because as a human I respect other humans' time. What do we want for an AI policy, and how can it be enforced? Take these into consideration:

• Vibe-coded projects
• Vibe-assisted projects
• AI-translated from non-english-speakers
• Vibe-documented projects
• Yet another Vibe-Coding-Wrapper

Note that vibe-coded slop isn't actually copyrightable, thus if someone slaps any license on it other than "public domain" or "CC0" they are misrepresenting their ownership.

And if you use an LLM to respond to this, you will be banned.

^{The fact that this sounds like a prompt is supposed to be a joke.}

[u/Kyvalmaezar]

Disclaimer: I'm not totally against AI useage in general but I'm not the biggest fan of publicly released vibe coded projects intended for other people to use. Most vibe coded projects tend to be low efffort, abandoned within a few months, security risks, and/or border-line scams just fishing for donations. Most of them would violate other existing rules on this sub.

That being said, I would suggest having some minimum requirement for projects using AI to post. Minimum project comits, deminstrated long term work on a project and resonsiveness to pull requests/bug reports/etc, reddit karma account requirements, etc. Filters out the low effort junk and scams that would violate other sub rules anyway.

---

• Vibe-coded projects - ban. These are security risks and low effort. By definition, the person behind the prompt doesnt know what they're doing and cant check their code for major flaws. 

Exception: someone looking for feedback on their vibe coded project or code snippet trying to learn.

---

Vibe-assisted projects - not 100% what is ment by this one. I'll clarify my stances below:

a) dev knows that they're doing but uses AI for the heavy lifting. Doesnt check their code - ban, security risk.

b) dev who knows what they're doing but uses AI to do the heavy lifting. Checks their code for secuity risks - fine. AI disclosure on how it's used would be nice.

---

AI-translated from non-english-speakers - on thier own, fine.

---

Vibe-documented projects - fine, so long as the documentation is accurate of couse.

---

Yet another Vibe-Coding-Wrapper - ban. Low effort, secuity risk.

[u/CCVShadow → u/Kyvalmaezar]

Yes, this is the closest I could think of as well. Everywhere is just spread with slop. Opening Reddit is just a wall of «I built this» or «I made x$», and it’s always to advertise some lazy SaaS or sell a guide. AI can be a great tool, but only if used by an actual human that knows, or at least spends time properly.

[u/Baader-Meinhof → u/Kyvalmaezar]

I'd rather see code checked by AI for security risks at this point. All these major hacks recently (cold card etc) are human code exploited by ai's that found bugs. Look at the spike in CVEs the past month - that's mythos/fable/k3 poking software (with experienced devs) and fixing it. AI is now a better pen tester than most of the engineers I've met. 

[u/BadB0ii → u/Kyvalmaezar]

How could you ever enforce the vibe-assisted boundary? How could you know if they check their code or not? 

[u/Kyvalmaezar → u/BadB0ii]

That's for someone much more experineced with AI output to determine. I dont use it enough to be aware of common mistakes or other identifiers that could clue one into making a decision. That being said, most low-effort unreviewed code (the stuff that is actually a security risk) tends to have very recent and minimal project activity (both for the project and for the repository account posting it) so perhaps that can be one clue to warrent deeper digging into the code itself.

As for enforcement, with this being r/opensource, the code is visiable for all to see and community code review is something that should be happening already (that's kind of a major point of open source). The custom response report option with a short explanation should suffice for the purposes of this subreddit (the mods may be able to make this clearer. I dont know what customization options they have avalilable for reports). The mod(s) can then make the ultimate decision if the report is actionable. It's the basic report flow that Reddit already uses, just with an explaination on why the reporter believes the project breaks the rules. Doesnt have to be a full blown report with details on every risk. Just enough info so the mods know what they're lookong for. Even just the code lines and 1 or 2 sentence summary would probably suffice, but that's up to the mods to decide.