Sam: A whole Linux distribution is seriously debating whether to ban AI-written code. Debian. The one your servers are running right now.
Kai: [excited] And people are treating it like a constitutional crisis! I'm Kai.
Sam: And I'm Sam.
Kai: It's July 29th, 2026, and we've got three open-source stories that are all basically fighting about the same robot.
Sam: [dry] Three stories, one existential dread. Let's go.
Kai: First up — Debian devs are debating a project-wide ban on AI-assisted contributions.
Sam: Then curl, doubling down on rejecting what Daniel Stenberg literally calls 'AI slop' security reports.
Kai: And to cleanse the palate — Firefox 153 shipped, with Vulkan video decoding and experimental JPEG-XL.
Sam: Two AI fights and a browser. Sounds about right for a Tuesday.
Kai: So — Debian maintainers are seriously talking rules on LLM-generated patches, and an outright ban is on the table.
Sam: And this matters, because Debian sets precedent. When they pick a policy, half of open source copies the homework.
Kai: Right, but Sam — a full ban? How do you even enforce that? You can't smell an LLM on a diff.
Sam: You can't. Which is exactly why the debate isn't about detection — it's about provenance and licensing.
Kai: Licensing meaning — where did the training data come from, and is this patch technically derived from someone else's GPL code?
Sam: Exactly. If a model spits out copyrighted code and you can't prove the chain, Debian's whole legal-cleanliness story cracks.
Kai: [excited] Okay but hot take — a ban is a mistake. AI-assisted doesn't mean AI-authored. A maintainer using Copilot for boilerplate is fine!
Sam: [dry] Sure, in theory. In practice the review burden explodes. Reviewers are volunteers, and now they're auditing plausible-looking machine text.
Sam: That's the real cost — not the code, the reviewer time. Volunteers burn out fast.
Kai: Yeah, that's fair. Confident, wrong, and beautifully formatted is the worst combo for a tired reviewer.
Sam: So the likely landing spot isn't a ban — it's mandatory disclosure. 'Tell us if AI touched this.'
Kai: What this means for you: if you contribute to Debian, expect to declare AI involvement soon, and keep your provenance receipts.
Sam: And don't paste a model's output into a patch and pretend you wrote it. That's the thing they're trying to stop.
Kai: Story two — curl. Daniel Stenberg is STILL at war with AI slop security reports, and honestly? Kinda iconic.
Sam: And this one's real data, not vibes. He shut curl's HackerOne bounty on January 31st because the signal collapsed.
Kai: Collapsed how much?
Sam: Confirmed-vulnerability rate went from about 15% down to under 5%. Drowning in fake AI-generated reports.
Kai: [excited] Wait — so bounty hunters are firing ChatGPT at curl, inventing fake CVEs, and hoping one sticks for a payout?
Sam: That's the incentive. Money for a plausible report, zero cost to spam. Classic slop economy.
Kai: Okay hot take — isn't shutting the bounty a win for attackers? Now legit researchers have nowhere to send bugs.
Sam: That's the tension. But a bounty you can't triage isn't a security program — it's a denial-of-service on your maintainers.
Kai: [sighs] Yeah. One guy, curl runs on like ten billion devices, and he's manually reading robot fan-fiction about buffer overflows.
Sam: And every fake report he reads is time he's not spending on the real one hiding underneath it.
Kai: So what's the fix? Charge a deposit to submit?
Sam: Some projects are floating exactly that — stake something, get it back if the bug's real. Skin in the game.
Kai: What this means for you: if you report vulns, disclose your tooling and include a real reproduction. 'The model said so' gets you blocked.
Sam: [dry] And Stenberg will name and shame you. He posts the slop. Don't be the slop.
Kai: Last one — [excited] Firefox 153 dropped and I actually starred the release notes, is that weird?
Sam: [dry] You can't star release notes, Kai.
Kai: I star them in my HEART. Vulkan video decoding! Experimental JPEG-XL! Profile management!
Sam: The Vulkan decoding is genuinely good — offloading video to the GPU through a modern API means better battery and smoother playback on Linux.
Kai: And JPEG-XL is BACK! Chrome killed it, Mozilla's keeping it alive. Total underdog energy!
Sam: Experimental, behind a flag. Don't ship your website assuming everyone can decode it yet.
Kai: Details, details. Also split view and proper profile management landing in the ESR enterprise track — that's actually huge for work machines.
Sam: That's the part I like. Real profile separation is a security win — work identity and personal identity, actually isolated.
Kai: See?! You DO get hyped. I saw it.
Sam: [laughs] I get cautiously interested. Different energy.
Kai: What this means for you: update to 153, flip on Vulkan decoding if you're on Linux, and try the profiles before your IT department makes you.
Sam: And leave JPEG-XL off in production. It's a preview, not a promise.
Kai: Lightning recap — Debian's weighing an AI-contribution ban, probably lands on disclosure, not prohibition.
Sam: curl shut its bounty after real vulns dropped under 5% in a flood of AI slop.
Kai: And Firefox 153 shipped Vulkan decoding, experimental JPEG-XL, and grown-up profile management.
Sam: Two robot fights and one browser that actually shipped something. Balanced diet.
Kai: Before we go — fun one: somebody noticed a couple of today's top trending repos had suspiciously identical star-timing curves.
Sam: [dry] You mean fake stars. Say fake stars. Zero to nine thousand overnight with no issues and no forks — that's a botnet with a README.
Kai: [laughs] Okay, okay — check the contributor graph before you clone anything, and watch for typosquatted package names copying a popular repo.
Sam: One letter off from a name you trust is the oldest trick in the registry. Read before you install.
Kai: That's the show! Debian's deciding, curl's fighting, Firefox is shipping — and I still star with my heart.
Sam: [dry] And I still don't trust your stars. See you tomorrow.
This show is made with AI: the hosts’ voices are synthetic and the scripts are AI-assisted. Every story links to its original source.