Concerns around vibe coding on Flathub and Free Software

Hi all,

I was bit dismayed to see the vibe coding policy change Replace blanket AI ban with disclosure-based policy (#641) · flathub-infra/documentation@43e6e15 · GitHub .

I feel like vibe coding, for the time being at least, is fundamentally incompatible with the ideals of free software and am keen to avoid it.

The spectrum between I’m good engineer who used some AI auto-complete and I rewrote Photoshop without having any idea what the AI was doing PhotoCraft: The image editor you already know how to use. — ArtCraft is pretty broad but the disclosure doesn’t really have the nuance the decipher between the two.

Further, just looking at app quality isn’t sufficient either - as some vibe code apps look good and function well but the source is generally an inscrutable disaster.

If I need a giant AI running in the cloud to make modifications to a piece of code because it’s so convoluted it might as well be machine language, then it’s not free. It’s slop as a software substitute and I’d rather not be dependent on it.

More worryingly perhaps, I feel like we’re on the cusp of fork-pocalypse. Every project that took a stand against vibe coding is going to get forked and enslopified. Or worse, it won’t get forked, the AI launder the original code into a new codebase, and a new less principled dev will run with it. End user’s will be wooed by fast features thereby robbing many real projects from their userbase.

Again, I realize this is a challenging moment with lots of squishy factors that complicate the policy making so I’m not sure there’s a good answer for the time being. But I was very cheered that Flathub seemed to be taking a strong stance against this stuff and would really like to see the stronger policy reinstated.

As a reviewer, i would prefer to, but the line is very murky, it isnt “vibed slop” vs “totally free”. Theres rotjuice seeping everywhere, and the few reviewers are tired and unpaid

People disclosing is the best case scenario because then the reviewers gets to draw the line, instead of spending their limited time playing hide and seek with the source code.

Also we kind of “have to” consider some cases ok, else big things like discord arent, and it would be hypocritical to give a pass to big companies only. And then snap store becomes the place to be for big apps… And then small ones… And next thing you know flathub goes from high quality standard to ghost town with values.

I do my best to reject stuff that relies on AI too much, block ai gen assets, and encourage people to own their codebase. Current policy makes it much more visible for me to see and reject/advise. But i cant reject “i did some research” or “my bro did a couple commits with it from time to time”. And it is also hard when someone poured all their love in, but also used it sometimes.

You can Work on the community so people use less ai and stronger stances get more justifiable. Or donate to the reviewers who do their best to block shit. If we get too burnt out we leave the seats to techbros, and they will rot everything worse. Or help out with reviews and see for yourselves.

Please believe however we do our best for flathub to offer good soup. We believe in our work. Best we can.

More worryingly perhaps, I feel like we’re on the cusp of fork-pocalypse. Every project that took a stand against vibe coding is going to get forked and enslopified.

One of my lovely apps has been slopforked

And look at the submission queue. The slopocalypse is here since at least january. We end up assuming everyone uses that abomination. Ive taken a few breaks because it made me into a dick.

AI hurts communities this way too. We dont know anymore who or what we talk too. And we get to deal with people who see no issue with any amount of usage of The Ecocide Engine™. Which is socially hard to reconcile.

Hi teamcons - thanks for the thoughtful response.

Within the last few months I started noticing apps that looked really good but the functionality was badly broken. Generally the developers putting care in the UI are doing so more broadly as well, so it was unusual to me. It took me awhile to realize it was the result of vibe coding. Since then I’ve been checking the repos any time I find a new app and have also been absolutely shocked at the kind of PRs that are getting merged left and right.

Although the devs and marketing web sites love to tout the apps’ open source nature, I don’t think of these as libre/free programs. The people who cloned Photoshop are calling it “clean-room” but I think that’s somewhat doubtful given how the models are being trained. I found one popular app, not forked as far as I know, that had options screens replicated 1:1 from an older FOSS competitor. I’m not even sure the developers know their AI plagiarized it.

It’s very clear that the AI model peddlers are losing money. They’re in the “free sample” phase of the pusher ladder, but once they start charging cost for the services I suspect that many of these apps will be dead in the water. Neither the monetary nor human capital will be worth expending to keep them going. If we could run open weight LLMs on commodity hardware that was good enough to maintain these human-hostile code-bases the calculus might be different. But that’s not where we’re at.

And then snap store becomes the place to be for big apps… And then small ones… And next thing you know flathub goes from high quality standard to ghost town with values.

That’s prescient. I’ve been thinking to myself that if Flathub and F-Droid both take a hard, principled stance it would be enough to keep the stuff out of the FOSS spaces. But it is true that exercising your influence could lead to losing it.

I’ve long preferred rough-but-libre alternatives to the polished non-free software. So, in that sense, a ghost town with values doesn’t sound like the worse thing but I understand the concern. I’m wondering if the AI disclosure is displayed to end users anywhere? It it would at least let me know when I don’t have to do further investigation before letting an app into my repertoire. I think ultimately we might need something like a GPLv4 that ensures the code and any forks are human written. Something like copyleft for human intelligence.

Anyway, I’d be happy to offer some monetary support if you could show me where and/or to whom.

Within the last few months I started noticing apps that looked really good but the functionality was badly broken.

I have as well. Bizarre behaviours, weird choices, unstable ui from update to update, and absolute insane workflows.

We have none of the capacity to track what is in the store, so we enforce at submission time… So it is extra important we see how trustworthy someone is, and how much AI is in. The latter, being info we dont get from blanket ban for various reasons

Theres also another facet to the role of reviewer than the open source equivalent of nightclub bouncer. A lot of people never get any sort of feedback before they land before us. We dont just reject, but also help people get proper manifests, sane permissions, cleaner buildsystems. That is often grating for reviewees, and we also dont put in much the diplomacy efforts, but we also force often people to higher standards from their peers.

So theres a community aspect to this. And community isnt gaining much from being told no, or from power struggles at chokepoints like who gets to say what goes in or out. I prefer telling people with limited usage to replace the AI assets, educate on the technical issues with AI, work out with them a solution if they have too much of it, point them to matrix, than just kick them out.

Theres a lot of peeps who are a bit on the edge, who were made to think it is a good approach, and these things also are really good at seeming convenient and useful. Id rather tell someone beginning who thought it could help them to learn, to try an earnest effort so they can be included, than get my shotgun.

Dont get me wrong i fricken hate AI. But doing a violence will just isolate and rot us all even more.

ve been thinking to myself that if Flathub and F-Droid both take a hard, principled stance it would be enough to keep the stuff out of the FOSS spaces.

It wont. For the same reasons we’re not all on the same wavelength as Stallmann.

I agree with you on the philosophical incompatibilities, but not everyone goes as far with their thinking on their values. And for many, “values” is just what their surroundings do and say, not more

Some people use chatgpt to generate “lets save the climate” images…

Anyway, I’d be happy to offer some monetary support if you could show me where and/or to whom.

On GitHub the current gang is barthalion, petershh, codedore and i

I dont know if everyone has some donation link. But the whole team puts in lots of efforts in equal measure, and a little gesture, even symbolic, will go a long way

And for many, “values” is just what their surroundings do and say, not more

That’s unfortunately by design to some degree. It’s been litigated on the Internet for time eternal - and I’m sure you know most the history - but “open source” was largely a systematic neutering of the free software movement to make it more broadly palatable.

As a kid in the mid 90s I ran Debian on the first computer my parents bought for me and grew up reading Eric Raymond and Jon Hall. In the early 2000s I switch to a Macintosh because I viewed computing as basically pragmatic - use what works - and the Mac looked and works a heck of a lot better than what I was used to at the time. In the mid 2000s Stallman gave a talk at my University that open my eyes to the broader political machinations of software freedom but I came away thinking he was kinda kooky. It wasn’t until a few years later working for software company that was building the worst kind of anti-features that I started recognizing how right he was about a great many things.

Exclusion-to-enforce-inclusion is a difficult concept for people and those watching uncritically tend to find those sorts of efforts tyrannical. And, of course, bad actors will take advantage of that to promote their toxic causes. I think we need to start thinking about spaces and mechanisms to enforce human authorship in perpetuity - like a GPLv4 - or a human only store front. Let Omarchy and Windows, and the other long list of lost causes have the hardcore vibe coders I think. But I totally understand and respect Flathub’s stance.

It is quite remarkable, given how many GNU/Linux adjacent projects I’ve seen turn into corporate land-grabs how grass roots Flathub still is. This moment has placed a larger burden on you all than anyone probably expected, but I’m really grateful there’s a thoughtful group of people working through these issues. I didn’t see sponsorship option on Github for the other devs you mentioned but I’d be happy to support them similarly.

Thanks for the discussion and the very important work you do.

Personally, I am glad to see the AI policy loosened. Speaking as someone with obvious biases (snap maintainer, and I work in the AI-adjacent space), I think the bigger problem is tooling and maintainer bandwidth, and AI is part of the fix rather than the threat.

Two recent examples.

calibre: flathubbot opened the 9.15 update PR on 19 September. It’s still open. 9.16 shipped on Friday and there’s a second PR for that too. Nobody’s doing anything wrong here. There just aren’t enough hands, and calibre isn’t an obscure app.

Symbolical: I helped the developer get their manifest through review. Their PR was closed as AI slop, which it wasn’t. Another maintainer stepped in, sorted it out, and it got there in the end, so credit where it’s due. But for a first-time publisher, that’s a rough introduction. I also wrote their snap packaging, and getting the same app into the Snap Store was quicker and a lot less stressful. I’m not mentioning this as a sleight, or them-vs-us, just fact observed by the publisher.

I don’t think that’s news to anyone here, and I know time and people are the constraint, not willingness.

Two things that really need help from the community:

1. Recruit more maintainers. Hard, unglamorous, and the only long-term answer. A visible “apps needing a co-maintainer” list would help people who want to contribute but don’t know where.
2. Automate more of the review, not just the PR. The bot already spots new releases and opens PRs. The slow bit is a human looking at a green build and deciding it’s safe. A pre-review pass could summarise the diff, read the build log, flag permission or runtime changes, and label routine version bumps as low-risk. Run it on an open-weights model if that’s a concern. Maintainers still press the button, but they’d only need to look closely at the PRs that warrant it. The same pass could give first-time submitters early, specific feedback, before a human gets involved and before anyone has to guess how the manifest was written.

Without something like this, the backlog grows, the same few people carry it, and sadly they will likely burn out.

Hi popey -

Thanks for your thoughts - the maintainers here are free to do what works for them obviously.

Speaking for myself, I think you’ve touched on one of my primary concerns around AI adoption. It seems to be innately cancerous. People at my workpace are starting to use it for code reviews - and I understand it we’re all busy - but there’s something undeniably dehumanizing about being dropped a mass of text and then told to sort through it. Indeed the AI sometimes picks up on something pertinent, but just as often it’s drivel or pointing things out without fulling grokking the implications and now the submitter has to sort through it.

It’s worse when AI is used to modify code bases. The code becomes genuinely human-hostile. The 1000 file change-sets can’t be reviewed effectively without AI and suddenly everyone has to use it or be left behind. Once you let a little bit in here or there it spreads and ultimately crowds the humans to the periphery.

Obviously, there’s an inevitability to this for most projects in most places. Vibe coders will soon outnumber “agentic engineers”, will outnumber traditional developers. And that’s fine I guess, it’s the way of so-called progress.

But code review can be incredibly edifying if done with care. It’s uniquely human meeting of minds. Indeed the relationship between a software author and user has traditionally been something similar if a bit more abstracted. Hackers are as much painters as they are engineers and it’s important that some groups take a hard stand to maintain that.