Latest / The MonkCast / "Somebody is always paying the token bill": AI and Open Source with Brian Proffitt & Jason Brooks
Transcript
- speaker-0: Good morning, good afternoon, good evening. I am Steve Bulgrady, ⁓ co-founder of Red Monk, ⁓ the developer and practitioner-focused industry analyst firm. And we are here to talk about ⁓ unsurprisingly, sort of in in this day and age, ⁓ AI, of course, because we have to talk about that all the time. ⁓ and I'm here with two two folks that had quite a bit of experience with open source and community governance and all that fun stuff. ⁓ and we want to talk a little bit about sort of where those two things intersect. ⁓ so Why don't we start with Jason? You're sort of next in my ⁓ in my sort of screen here. So you wanna introduce yourself briefly? speaker-1: Yep, I'm Jason Brooks. I've ⁓ worked at Red Hat for fourteen years and ⁓ I am the manager in the open source and AI program office and the people who who are on my team ⁓ work with open source projects that are strategic to Red Hat to try to help them be successful. speaker-0: Awesome. And Brian. speaker-2: Yeah, so I'm Brian Proppitt. I'm also a manager within Red Hat's AI and open source program office. ⁓ and also with a a extensive background like Jason in in technology journalism. ⁓ and my team is responsible for ⁓ communicating ⁓ all the different ⁓ mess ⁓ messaging around what we're doing in AI and open source and also educating. So we have a lot of training and enablement curricula that we're Sharing with our customers, our partners, and also upstream communities, especially now around all this stuff around AI and how to deal with. speaker-0: And deal with it, we we sort of all must, right? ⁓ that's a it's a perfect segue. So ⁓ I don't need to cer certainly tell anybody who's listening to this, I'm sure, you know, AI has had a massive impact on the industry broadly. It's impacting for pick a sector, pick a category, pick a ⁓ you know, sort of vertical, pick a business, right? You know, AI is is ⁓ everywhere, it's ubiquitous, and you know, its implications are often sort of difficult to to sort of tease out in substance, right? Because in many cases there's a ⁓ you know, sort of a a superficial or surface impact, but then there are ripple effects, but you know, sort of ⁓ below the surface, right? And sort of one of the most sort of obvious for this is that ⁓ you know, for a couple of years, you know, we've seen, you know, tremendous improvements in sort of self-reported productivity from developers. ⁓ and yet the impact for their organizations has been mixed at best. So we're in theory creating code faster, and yet you know, the the sort of actual benefits from an organizational standpoint or a project standpoint, ⁓ are often sort of in question. So, ⁓ with that sort of background, I think where we want to start is, you know, sort of Brian, you know, sort of from your from your perspective, ⁓ you know, sort of overlooking, you know, Ospo and all sort things open source at sort of Red Hat. ⁓ you know, we have obviously this flood of AI code. ⁓ some of it's good, some of it's slop. ⁓ sort of in your experience, sort of what are the guardrails, you know, projects can implement, ⁓ you know, to sort of maintain the code quality, you know, you know, sort of without sort of bottlenecking things such that we don't get that benefit, you know, sort of as we're talking. Like, how do you put guardrails in and keep things moving? ⁓ you know, because there's all sorts of you mentioned, you know, sort of at at one point in one of your presentations, ⁓ plausible but not always correct, which I think is is sort of you know, sort of one of the more difficult cases to handle where it's like, hey, there is this code and it looks okay, but in fact it's not. ⁓ and that makes it that much more difficult to detect. So, you know, sort of as you think about this, ⁓ how do you think about all right, what are the guardrails we can put in place? Whether those are are people in process guardrails, whether they're automated or something, you sort of everything in between. speaker-2: Yeah, ⁓ well yeah, great question to start out with. So a a lot of what we're trying to do right now, ⁓ at the beginning, because we're all trying to all get our hands wrapped around these tools, ⁓ whether it's generative AI or identic AI. So the first step that we're trying to do around our upstream communities that we're participating in is essentially trying to introduce a level a new governance layer that will basically what I call our human speed bumps that will encourage ⁓ transparency and also sort of tease out ⁓ a lot of these ⁓ generative AI contributions that are coming in. Because the real problem, as you said, is it's either good or bad or somewhere in between. And e anywhere on that spectrum it has to be dealt with. Even if it's all crap, ⁓ it that you have to dig out the trash. So you're gonna have to deal with it. So These processes that I'm talking about include things like having like templates on your contributions, ⁓ on your PRs and whatnot that say, is this AI generated? Yes or no? ⁓ and obviously there's some honors in here. If they say yes, then it leads into, okay, what were your prompts? What what was your reasoning behind this? What we're trying to do is not necessarily stop. The incoming flow of AI, but encourage people to be transparent and understand what it is they're they're contributing. Because the real problem, and you alluded to this earlier, like with within companies, but the big problem out in the open source ecosystem is right now, like ⁓ forge like forges like GitHub and GitLab kind of encourage this whole mentality of the more I contribute, the more karma I get. So you have people who are incentivized for making a a ⁓ solid green contribution wall. ⁓ by, you know, and so we're trying to get around that and and try to say, okay, look, you're gonna turn this in. It's you you either did it all with generative AI or you resisted or whatever. Do you understand what you're doing? Do you understand why you did it? Do you understand the context of the issue that you're trying to solve? ⁓ And then if we can do that, ⁓ what we're trying to do is encourage this participation not just with code, but now with like follow-up conversations. ⁓ and and we hope that that will introduce a little bit of a slowdown on the fire hose coming in while moving forward, you know, as we get our hands around the other things, then we can look at things like automated agentic AI ⁓ solutions that will help review at scale. And I think moving forward, it's probably going to be some kind of combination of the two, ⁓ right, ⁓ as we do that. But that's where we are right now. and it yeah, we I've seen evidence. I've got a data team where we've done this in our project, it seems to be working with the open source software that we're hosting and fostering. ⁓ so we're seeing some anecdotal evidence that it's helping. but we have a long way to go. speaker-0: Yeah. And so that's sort of some of the theory and the the sort of intent, if you will. So Jason, in practice, right? You know, sort of ⁓ in the field, project like Fedora, you know, how are you looking at things like, all right, how do I verify the provenance of this AI generated patch? Like how do we basically how do we sort of intake and ingest code when you can't rely necessarily solely on the authority of a human contributor? speaker-1: Yeah. Well, I think that the the trick, right, is that ⁓ I think Fedora and I really think this is the norm among projects that I've I've been paying attention to, they just kind of reject that premise that you can't rely on the human. And they just say, No, we're ⁓ going to rely on the human. So, ⁓ you know, I mean it's like There's all these AI processes happening, all these these agents they're out buzzing around doing things, but you know, in zero of those cases is there not some human who is ultimately has set that process running. Somebody is always paying the token bill. Somebody's intentions are behind that, even if they're like poorly articulated. So, you know, the way that Fedora started off with the policy and and I think that it's just, you know, it's in the early time of playing out really, is that ⁓ we're not going to assume the responsibility of, you know, vetting, you know, mindless robot products. You know, y you're a person. You know, I I I thought that when Brian said that about the wall, you know, the contribution wall on GitHub or there's all these stuff going on. It's it it what it popped up in my head is that in a place like Fedora, you have the luxury of an actual community. And so if some sort of, you know, code spewing robot just shows up, it's not hard for everyone to say, wait a minute, no, you know, this this this isn't how we do things here. So you know, it's kind of a it's it's ⁓ I don't know, you know, it's a cheat. You know, it's a it's a it's a human you know, the human cheat where where like what I was thinking about as we were going in this interview is that, you know, the the cost of producing code might be going to zero, but the cost of making a contribution, of actually collaborating with people, of getting people to accept what you spew out, that still has a cost to it. And Fedora is relying on that, you know? Yeah. speaker-0: Yep. No, that's a good point. That's a good way to put it, I think. ⁓ sort of so on that note, ⁓ Brian, so as we as we sort of bot traffic, you dwarfs human interaction, and we have this sort of flood of of incoming ⁓ contributions, ⁓ you know, and there's other things. It it it's funny to me that, you know, these these sort of autonomous loops were very much in fashion at the start of the year and now it's, you know, ⁓ no, hey, they may be sort of passe or whatever. But ⁓ I either way, right? We have all this sort of code coming in. ⁓ respect to the obvious question. So, you know, if you're looking at it, you know, sort of from a high level, from an industry standpoint, is anyone actually getting this right? Is anybody doing this really well? ⁓ are are we just buying time until tools catch up? Like where where would you sort of say we are as an industry? speaker-2: I would say we're probably at the at the very start of of figuring this out. I I I think we are at a point where the technology has gotten ahead of the the human governance patterns and the the development workflows and everything like that. So I think we are all trying to figure this out. I mean, we saw an example ⁓ late last week. ⁓ I was, you know, about a you know, a bot that escaped. and went off and cribed the answer. And this is by a company, not naming names, that was actually building the learning model. So I'm gonna say no, that we haven't quite figured this out yet. I I think it's gonna take a lot of effort to wrap our heads around this because as Jason's already alluded to, like there there's always a cost to us somewhere. ⁓ and we haven't figured out where the costs really lie. We think it's in tokens, sure. I think it's in technical debt, you know, another person's gonna think it's somewhere else, you know, it's like community reputation, that's a s so it's a lot. So I think collectively, I think we're all gonna have to not standards, but I think we're gonna have to come up with best practices around all of this in an especially in the open source ecosystem that will let people use this technology generally safely. ⁓ and I think we have a ways to go. And a lot of communities right now, we're still at the stage where a lot of people are just like, they're stiff arming everything. They're like, nope, nope, nope, no generative AI. And then you have people who are like, let's bring it all in. And Yeah. So yeah, I think we're at the beginning. I as like I said this be ⁓ when we were talking before the interview, you know, it reminds me a lot of the early days of Linux. speaker-0: Yeah. speaker-2: where, you know, we were I was blowing out cathode Ray Tune monitors ⁓ by making the wrong X window settings. Right. It kinda feels like we're in that era right now with with AR. speaker-0: Yeah. I'd say that's pretty fair. ⁓ and I think it's notable that you both referred to costs. You know, because the the next question I want to ask ⁓ Jason is, you know, the sort of all too real, ⁓ and we hear this all the time, you know, talking to different communities and different developers, ⁓ you know, is the is the sort of ⁓ I mean, I guess it's a for permanent question, but I think it's it's getting worse. You know, sort of is the developer burnout. Right. ⁓ and more specifically the maintainer burnout, you sort of for projects. So, you know, as I said, this has been a problem for years. ⁓ and then, you know, as we sort of all know and we've we've sort of discussed already, you know, that the cost sort of cost of creating code at least has gone to near zero. ⁓ so how does Fedora like how how do you see what what is the human side of this look like? How do you sort I mean, obviously you can't fix and solve burnout, but how do you mitigate it? Yeah. speaker-1: Well, I I think that we have to always remind ourselves that saying no is always an option. You know, just because you have a billion ⁓ merge requests, that doesn't mean you have to merge any of them, you know? And ⁓ you've got to decide to be what kind of project you're gonna be. And it could be ⁓ hey, I don't have time for that project. And then if it's if those folks, you know, who who want to make those contributions want it enough, them through the magic of open source we can fork. And do your own thing. So that's the thing I think everyone has to keep in mind is that just because you've got a flood doesn't mean that you have to manage the flood. Now, there's a lot of great stuff in there, I'm sure. And so but I and you I feel I'm sure there's the pressure, I know there's the pressure to want to get at that and and bring in the community. The other thing is that, you know, again, this flood is a flood of people, or at least processes that people have launched. And it's fair to ask those people to participate in the process of handling The flood. So, you know, the just the classic, you know, ⁓ like you say, what are the incentives? I want to get some code in this project. Okay, what's it gonna take to get the code in the project? I've got to build up my stature by, you know, chopping wood, carrying water type things. I've got to participate in reviews. So I think that's the thing we have to remind ourselves that ⁓ again, these are other people, and it's fair to ask those people to participate, or you know, if you don't want to manage the part that participation, They can always, you know, do another thing and let a thousand flowers bloom. But the other thing I'll say is that there are promising tools to say, look, here are here are our standards for the project, here's our style guide, here's these things that can, you know, AI tools can aid in some of that triage and doing some of that work. So that's a piece of it. But I think where we where right now we have to keep our main focus on is ⁓ hey, it's okay to require contributors to make contributions beyond code. Yeah, we have to insist on that. speaker-0: Yeah. No, I think that's fair. You know, we have a sort of share of the load, as it were. ⁓ all right. So Brian, if if we can agree that sort of AI is not going anywhere, which I I know there are that's really the minority out there that I think thinks so the genie can be put back in the bottle, but I I I think the reality is is that it's not going anywhere and devs are gonna use it. ⁓ you know, from your perspective, like what's the most important trait, you know, for open source communities, ⁓ you know, sort of in order to remain sort of trust is trusted steward moving forward? Like how do they what do they need to do to to essentially leverage these tools but leveraging them safely. speaker-2: I think probably if I put it in one word, it would be transparency. I think everybody everybody on all parts of this process have to be as transparent. Contributors have to be transparent. Yes, I did use ⁓ some form of AI assistance. I think committers, ⁓ and maintainers, you know, everybody on the in you know, on the receiving end, so to speak, they have to be transparent about what their policies are and be very clear about them. And as Jason says, not be afraid to say no. and and and come in and it's it's say exactly what they are. we are what worries me the most about AI beyond the mechanics of it is something I believe you're kind of alluding to in your question, is that we cannot have a lack of trust here. I think a lot of people are a little bit afraid of if we have too much non human activity in this pipeline, whatever you want to call it, that we're going to lose trust. And and I think for me, that's the most worrisome part of it. ⁓ the logistics we'll figure out. We'll build better tools. We'll do that. But if we lose trust in the process, you know, if our end users do no longer trust the security of what whatever we're building, for instance, we've lost a lot. Because as you know, it's really easy to tear apart trust and really difficult to build it back up. So I think that transparency at every part of this process, ⁓ and all this integration and thinking and conversations that we're having, I think that's going to be key ⁓ to success moving forward for the open source ecosystem. speaker-0: Yeah, no, I think that's exactly right. And then I think that sort of brings us to to the last question for today, ⁓ for for Jason, which is you know, obviously AI has been in market for, you know, what is it, six years now, ⁓ in terms of being able to generate code, maybe longer. ⁓ I can't get my sort of math right. ⁓ but it it's been here for a while. Obviously Fedora has been ⁓ sort of in particular has been sort of in the middle of it, right? You know, sort of as so many ⁓ communities are. So what have you learned? Right. You know, what sort of change in in your sort of policies with respect to AI and how do you expect them to change sort of moving forward? speaker-1: Yeah, I think that we, you know, we're about we're about a ⁓ just under a year into the ratification by the council of the Fedora policy. So I don't think we're quite at the stage of making changes to it yet. I I do think the thing that we will be challenged by and other projects will be challenged by is this agenc factory type of ⁓ you know model. And so what does it look like to say, ⁓ you know, again, it's always going to be people and trusting people, but what does it look like to say Trust me, this is my code too. Trust me, this is the factory that I maintain and design. And by the way, you can look at all the specs of it and exactly what it does, but trust the output of that model, which I think does ext I I can I can imagine that working. But, you know, that's gonna be a a a shift and it's gonna take time to for people to see how these things work and to process it and build up that trust. But like right now with this Fedora hummingbird, you know, this is like a new kind of branch of Fedora that is agentically assembled. And ⁓ you know, it's one thing for Red Hat to assign a bunch of engineers to build a thing, but in order for this to become like a full part of f the Fedora community, the community will have to digest what it means. Like ⁓ you know, the individual rawhide package maintainers need to say, need to trust the end you know, trust these p change sets. And then maybe someday the eventual upstreams of those projects need to trust. So ⁓ you know, trust the ⁓ the outputs. So ⁓ I think that that is what will be next and those changes will involve some policy changes, you know, to as we adapt to those. ⁓ but that's what I see coming up, you know, ahead. But it'll take some work to to get there. speaker-0: Yeah, I think, you know, I I I ⁓ was talking to ⁓ another another person I'm sure you both know, Adam Jacob a while ago. And one of the things he was talking about is is that the you know, again, sort of get into the the sort of second level and second order effects here. You know, one of the things we haven't worked out in many cases is etiquette. Right. So all these things that we'd grew you know, we've grown up like you can't do this and you can do this, well, that looks different. You know, sort of in a world where machines are building a lot of this stuff. So Exactly. I think that the sort of the the probably the closing theme here is is that ⁓ obviously there's a lot of change. Open source communities are gonna be sort of in many cases at the forefront of this ⁓ and are gonna, you know, sort of have to learn some some some hard lessons, I would assume. so I'm sure we will be checking in with you you both, you know, sort of as we as we roll around ⁓ as we roll along. But ⁓ yeah, that'll that'll wrap us for today. ⁓ Jason, Brian just wanna say thanks so much for coming on that ⁓ coming on the show and talking to us. speaker-1: Yeah, thank you. It was great. speaker-2: Thank you. speaker-0: Awesome.