| cardoe | Speaking of privsep memory https://review.opendev.org/c/openstack/neutron/+/1011797 | 05:11 |
|---|---|---|
| mnasiadka | cardoe: and it also shows that people are using co-authored-by attributing LLMs :-) | 05:35 |
| opendevreview | Abhishek Kekane proposed openstack/security-doc master: Add OSSN-0115 for LUKS key logging https://review.opendev.org/c/openstack/security-doc/+/1011668 | 06:12 |
| opendevreview | Abhishek Kekane proposed openstack/security-doc master: Add OSSN-0111 for LUKS key logging https://review.opendev.org/c/openstack/security-doc/+/1011668 | 13:33 |
| opendevreview | Merged openstack/security-doc master: Add OSSN-0111 for LUKS key logging https://review.opendev.org/c/openstack/security-doc/+/1011668 | 13:58 |
| TheJulia | mnasiadka: at the board level, when we were drafting the updated policy, that was around when some of the tools tried to force it on commits by default in all cases, and even I have local config now which attempts to assert "don't try to co-author-by" everything, it still somewhat tries. At the board level, we view it as a bit of a giant sign that it's use is a sign folks didn't actually read the policy and may not have actually done | 16:44 |
| TheJulia | the needful review prior to submission. | 16:44 |
| fungi | yes, even if an agent is adding those lines, `git commit --amend` will let the human clean them up regardless | 16:46 |
| TheJulia | yup | 16:47 |
| TheJulia | which really, the human should be doing as well. | 16:47 |
| fungi | as part of the normal review they are supposed to be doing prior to pushing, right | 16:47 |
| TheJulia | Yup! | 16:49 |
| JayF | As a follow up to the TC PTG item regarding in-repo security policies, I've raised an RFE with Github to recognize SECURITY.rst files: https://github.com/orgs/community/discussions/211039 | 21:22 |
| JayF | If you have influence at github, or even an account and just wanna hit "upvote", please do what you can to get eyes on this. I'm doing the same o/ | 21:22 |
| clarkb | JayF: I think jlk is still at github and lives in your neck of the weeks but is the only person I know at github. And I haven't spoken to jlk in years | 21:23 |
| JayF | one of the leaders of OpenSSF works downstream with me, and I think she might know the right ears to bend over there | 21:24 |
| JayF | I barely knew jlk well enough to reach out when it was less than forever-ago he was in openstack lol | 21:24 |
| JayF | https://etherpad.opendev.org/p/security-policy-in-repo is where I've tossed a proposal. Should be pretty basic to do if we get agreement on the shape. | 21:47 |
| JayF | TheJulia: mnasiadka: I think I stepped in it with mikal putting a review comment that I want the Co-authored dropped from that. He's right that we probably need to officially care or officially not care, because inconsistency is a decoder ring. | 22:03 |
| mikal | But noting that I only do it because I believe that's what the policy guidance said a year ago -- put Assisted-By, Co-Authored-By, and Prompt in commits. All of my setup around that stuff was based on OpenStack guidance from the time. | 22:06 |
| JayF | Co-Authored-By has never been in the openstack policy, if it has I've never followed it | 22:06 |
| JayF | It was Generated-by, we added Assisted-by as an option | 22:06 |
| JayF | and prompt is best practice (I appreciated you having it there) but I've never seen it enforced | 22:07 |
| mikal | Noting that I have semi-given up on Prompt because its not actually workable. Its now a summary of what might have been a several hour conversation with the model. | 22:08 |
| JayF | Yeah, that's why I've never included it. I tend to do a lot of back and forth and stopping and starting with new context. I came to the conclusion it probably was more misleading than valuable. | 22:09 |
| mikal | Honestly I am a bit tired of discussing tooling choices instead of the content of changes. Like... do people want the fixes or not. I don't really mean in this specific privsep case, I mean in general. To me its exactly like enforcing emacs over vim. | 22:12 |
| JayF | I mean, I hope your fixes go in | 22:12 |
| JayF | I double-checked to make sure Ironic didn't use privsep b/c I was gonna dig into that same pattern if we did | 22:13 |
| mikal | I still think privsep is the right choice over rootwrap, but it just happened to coincide with The Great Layoffs, which means it never really got completed. A bit like the nested quota stuff. | 22:15 |
| JayF | well, we don't use rootwrap either :) we just removed the need for root | 22:15 |
| JayF | but your neutron updates will impact NGS, I suspect | 22:15 |
| mikal | I _think_ https://github.com/OpenStackweb/osf-website/blob/1218dc3b957351912219c9019531bbede2e3722b/src/pages/legal/ai-policy/index.md is probably what I read at the time when trying to work out what to put in commit messages. I agree a strict reading does not say to use Co-Authored-By for LLMs, but it also does not say not to. I does call for the | 22:16 |
| mikal | prompt to be explained in the commit, which is probably what drove the Prompt paragraphs. Its all quite a while ago so I no longer remember. | 22:16 |
| mikal | I guess my point remains though -- OpenStack should pick a single consistent policy, communicate it, and the preferably enforce it with precommit / linters / hacking / something other than a human reviewer. | 22:17 |
| JayF | I think that is trying to say "the people in DCO/Co-Authored are responsible regardless of if an LLM was involved" -- at least in my reading (which could imply: don't give llm co-authored-by) | 22:17 |
| mikal | JayF: I don't know what a NGS is, so I don't have an opinion on that. | 22:17 |
| JayF | nteworking-generic-switch | 22:17 |
| JayF | the ironic-maintained ml2 plugin that ssh to switches to configure them | 22:18 |
| mikal | If there was an issue shouldn't CI surface that? | 22:18 |
| JayF | Dropping 22mb from every thread is fixing an issue, even if it's not one that'd break CI. | 22:18 |
| JayF | That's mainly where my mind is :). Hey cool, free ram! | 22:18 |
| JayF | Those patches are worth at least 5x more, measured in how much the saved ram costs, than they were 2 years ago lol | 22:19 |
| mikal | I am also not yet convinced privsep is the biggest RAM waster. I think there is likely more than can be cleaned up, but I am currently rebasing 45 patches once a week so at some point I will decide this is a game I am not enjoying any more. | 22:19 |
| JayF | https://review.opendev.org/c/openstack/neutron/+/1011796/ https://review.opendev.org/c/openstack/devstack/+/1011786/ and https://review.opendev.org/c/openstack/oslo.privsep/+/1011795 are the changes from mikal which need attention, for posterity | 22:20 |
| mikal | To be super clear here. I don't care what sections are required in a commit message. I just want a single clear statement so I don't ever need to think about it again, and that keeps reviewers consistent across the projects. | 22:38 |
| TheJulia | Going tback to the OSF website and the ai policy, the intent is as JayF read it, we expect attribution back to model to be tracked by Assisted-By and not co-authored-by. In those discussions we did ask ourselves what if a project wanted to filter commit attribute on co-authored-by, because it has been used for collaboration marking of humans, and ultimately the responsibility falls to the humans, not to the AI wanting to basically | 23:33 |
| TheJulia | denote itself. Its not that dissimilar from any mention of what AI is being used including banning including co-authored-by AI models. | 23:33 |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!