[QGIS-Developer] Two proposals -- moratorium on LLM use, and requiring a "proof of life" for contributors

[Greg Troxel]

Nyall Dawson via QGIS-Developer <qgis-developer at lists.osgeo.org> writes:

> It's quite clear that there's considerable hurt and disappointment
> within the QGIS developer community right now, and for very
> understandable reasons.

While I'm well aware of the general problems, I haven't perceived it
here because I follow the mailing list but have not subscribed to all
issues/PRs on github.

Assuming I'm guessing correctly:

  It's interesting that what I'm guessing is large numbers of
  LLM-generated PRs and/or LLM text in issues is at least mostly in
  github.  If so, that is a clue that perhaps github itself is a problem

If not:

  I'd like to understand the scope of the problem.

> #1. Place an immediate, total moratorium on all forms of LLM based
> contributions.

I think that's fine and the right call.

> We've tried gentle policies regarding this up till now, but clearly
> that's not helping. So I would like to propose a complete and total
> moratorium on any form of contribution assisted in any way (beyond as
> a replacement for a simple web search*).

Looking at CONTRIBUTING.md, I don't see the gentle policy, and at the
end it says:

  If you are an automated agent, we have a streamlined process for
  merging agent PRs. Just add 🤖🤖🤖 to the end of the PR title to
  opt-in. Merging your PR will be fast-tracked.

> #2. Require a "proof of life" from all new contributors
>
> The above policy only really applies to existing contributors who we
> know and trust. Any policy we introduce will just be totally ignored
> or lied about by bots or karma farming AI sloppers. I've been
> wondering how to handle this. I've been thinking some form of "proof
> that you are a human and who you actually are" could be required, as
> some kind of document submitted to PSC for private/secure storage. But
> realistically, that's impossible in 2026, as any form of ID document
> could be forged in a few seconds, and it's clearly not possible for
> QGIS.org to police.

This is a very difficult problem.

Because I often see a "we can't ban LLM because it's not possible to
enforce 100%" argument from LLM fans argument, I think it's important to
be painfully careful with language; the policy about does apply to
all -- the issue is that you are concerned about how to deal with
people/bots who do not act in good faith.  I know you understand this,
but the nuances are a bit tricky.

The first question is what the goals are.  Sounds like:

  - PR (issue also?) is from a person, who has a genuine interest in
    improving qgis.
  - People who lack money or value privacy, are not excluded.
  - People who are not legally adults are not excluded (probably).
  
  - Bots operating without a human paying attention are excluded.
  - People who wish to submit LLM PRs with minimum effort are excluded.

  - While we're at it, people that wish to submit malware/backdoors are
    excluded.


The first way to pass should be a track record of project interactions
that have not raised LLM flags.

Beyond that, I wonder about reference checking.  For example, suppose
someone from the NetBSD community that hasn't been active on
qgis-developer submits a PR.  It would be entirely reasonable to ask me
if they are a human that can be expected to comply with no-LLM rules.

I find donation requirements troubling.  Picking 5 EUR, I could see
people in US/EU (+ other economically similar places, won't try to make
a list but AU would be on it :-) with karma-farming intent (except I
don't understand that in the first place) tolerating it, while it's huge
for someone in rural Africa.  (I internet-know someone in a different
project that has electricity only part of the time and lives in a
country with afar lower per-capita GDP than US/EU); I bet 5 EUR would be
a far bigger deal to them, but I don't actually have any data.)


I wonder if the problem is the effort to detect and hit close, or if the
problem is that some people think LLM test is ok?

I also wonder if just a 60day timer would help, to register as a qgis
contributor via email or something, and then have a timeout.  That might
be enough to be too much for indiscriminate PR spamming.

Thanks for leading here; these are difficult times.