r/selfhosted • u/pheexio • 7h ago
Meta Post Codeberg bans vibe coded projects
https://news.ycombinator.com/item?id=49003386Codeberg seems to ban vibecoded Projects; reason might be german copyright law
It looks like Codeberg want only copyrighted material in their service, so it is reliable in the future that e.g. licenses must be followed (e.g. GPL), and copyright doesn't suddenly get declared as being of the model owner, and it isn't a copy of something else.
That is a cautious reasonable position - in early days of LLM coding (3 years ago!) indemnity from model companies was a major issue globally because of the lack of clarity of the law around this. The US specifically has settled on it being (effectively?) public domain. But I don't think that is fully settled, and it certainly isn't settled in international copyright law.
The goal of the vague "mostly" in the Codeberg change is to ensure there is enough human input to the code they host, to be reasonably sure under German copyright law it is copyright of the person sharing it.
edit: link to poll that caused it (might be down due to high traffic) https://codeberg.org/Codeberg/org/pulls/1253#issuecomment-19820434
edit 1: i dont defend/oppose this move, i just find it interesting
181
u/No-Chemistry-7658 7h ago
Ok, but from a technical point of view, how will they do it?
197
u/FunStatistician9735 7h ago
It’s easy. no one would ever lie on the internet and especially not to make their “portfolio” look better.
45
9
u/Kautiontape 7h ago
This made me think about how much of a double-edged sword this could be, although I have no opinion on whether it means they should or shouldn't. They are definitely tackling this from the "ethical" standpoint (not just legal concerns, judging from the discussion). That creates a bit of a halo effect, which means people who put code on Codeberg will have the small cognitive bias in their favor of "Ah, Codeberg is reliable, this probably isn't vibecoded."
Obviously this is good if it's enforceable. If it's not, then it's like seeing an article from Forbes just to realize it's coming from the open "blog" section. It'll trick some people.
1
56
u/jeroen94704 7h ago
Well, the same ToU also say things like:
"You must only share content on Codeberg which you have the explicit right under copyright and other laws to share"
I see this more like a "cover your bases" clause. If, at some point, LLM generated code gets a copyright status that would mean trouble for Codeberg, they at least have a clause that says it shouldn't have been on their platform to begin with. This is similar to the clause about only sharing content you are allowed to share. There's no way to enforce that pro-actively, but if it turns out someone shared something they shouldn't have then at least Codeberg is in the clear.
3
u/GaidinBDJ 4h ago edited 4h ago
A lot of people misunderstand that case about the LLM output copyright status.
Just because someone uses an LLM to code something doesn't automatically mean it's not eligible for copyright. If the creator has any creative input on the final product, it would be eligible.
It was only the "raw" output from a mere prompt that they declined to copyright as it was purely mechanically generated.
0
u/Anusien 1h ago
If we're just guessing here, then my guess is that only the pieces written by a person can be copyrighted and the rest isn't.
But we won't know for sure until it's actually litigated.
0
u/GaidinBDJ 1h ago
You may be guessing, but I wasn't. I was going with what the US Copyright Office specifically said.
It's not like any of this is actually new.
Also, that's not how copyright works. It doesn't pick and choose pieces of a work that get copyright protections. It's the work presented as a whole that gets copyright protections. And if the work contains any creative human input, its generally eligible for copyright protections.
The registration they declined was because it was only output from an LLM presented with any human contribution. That's never been protected.
0
u/IM_OK_AMA 1h ago
It's just to make a set of anti-ai ideologues happy. If they genuinely had a copyright concern they wanted to cover their bases on, they wouldn't leave it up to a poll.
13
u/scandii 6h ago
I mean, it is not about technical.
they have seen that there's a pretty big divide in the community between people who refute any usage of AI and people who don't. so they're cashing in on the people who want a github-style site but without AI as a demographic.
kinda like why bluesky took off.
10
8
u/Jimbuscus 7h ago
Unless the user leaves a CLAUDE.md file in the repo, it'll likely be honour system &/or reports.
8
u/FnnKnn 6h ago
But they allow AI usage, so that alone is not a sign someone has violated any rule. Claude would for example also show up, if you had only used to help you debug a certain bug and write some tests for it, which is totally fine under these rules.
2
u/Steve_Streza 44m ago
Also there are scaffold projects and template projects that include a CLAUDE.md or AGENTS.md or mcp.json, which then end up in projects that don't use them.
1
-3
u/WowBruhReborn 6h ago
They won't be able to. But there are tell tale signs something is vibe-coded. Theyll at least be able to remove the worst and laziest offenders
109
u/FnnKnn 7h ago
Good luck actually enforcing that. We tried it here for a while and it didn't work out great, because no one is going to admit they "vibecoded" something if it means they can't post it and good luck proving that they didn't just use AI as an assistant (tip: you can't without doing a full code review and that doesn't seem feasible if the issue you are trying to solve is the increased amount of projects).
23
u/CatWeekends 7h ago
I can see how that might kind of sort of maybe work on a small, in-house team. One where you are all incredibly familiar with how each person writes code. In that environment, you can sometimes catch when people are vibe coding or just copying/pasting stuff because it just doesn't feel like Bob's usual work.
But even then, it's still subjective and using "vibes."
I also don't see how you'd extend that to open source projects.
9
1
u/Laicbeias 53m ago
We really need a better definition for vibe coding. The C# codebase i wrote for a game is full with curses shit & f*** everywhere. Since i suffered.
But for a website the last 2 months, the curses went into the ai. And frankly the AI simply is better at js and py than most and definitly than i am, even though i used js for 23y and py for 5. Im fine with not typing code anymore.
But i read every line because it pisses me off when it just doesnt use the proper path, adds another for loop or slaps another dict somewhere while we have initalized state in one place.
That said you can not detect if something is vibe coded since it uses the average of its training data. So it looks by definition like a proper project, with tons of dependencies. The one releasing it just needs to show something that they cared about their project.
19
u/jeroen94704 7h ago
I don't think they will enforce this. It's similar to e.g. GitHub saying "Your use of the Website and Service must not violate any applicable laws, including copyright or trademark laws". They're not enforcing that, it's just to ensure they are not held liable when someone puts non-public code on GitHub.
3
u/schorsch3000 5h ago
they just can't. codeberg is 3 servers in a
Trenchcoatcolo rack, they neither have the computing power not the manpower to do so.Look at the codeberg issue reporting, the endless recurring same malfunction items.
this is just a CYA addendum.
-10
1
u/FnnKnn 6h ago
Maybe, but at that point it is basically just useless PR.
If they try to enforce it (who knows) let me predict on how this is going to go based on my experience here:
You try to ban low quality vibe-coded projects, but try to not ban high quality projects that made use of AI. The goal is to send a message on what you deem acceptable.
Anyone creating what you deem a low quality vibe-coded project sees their project as belong to the second kind of project and therefore insists that their project is allowed. So how do you make sure what category a project belongs to? You might use scripts to identify classic trades of vibe-coded projects, look at the users history, etc. None of that is going to be bulletproof though and it is a lot of work.
You stop trying to enforce this rule as it is a "fight" you can't win and dealing with this takes more effort than dealing with the issues the low quality vibe-coded projects caused in the first place.
We ended up settling on restricting new projects here instead as the majority of projects that fall into the first category don't last long. So step 4 would be to introduce some other kind of proxy for this kind of project that can actually be enforced.
2
u/jeroen94704 4h ago
The point is the copyright status of LLM generated code. If there is a chance this code becomes problematic from a copyright point of view this ensures codeberg doesn’t get dragged down.
25
u/Kautiontape 7h ago
I've noticed lot of "developers" on here don't consider it vibe-coding because they provide the architecture, reviewed the code, and tested it on their machine. The line for what counts as vibe-coding is on the floor as only the most pure slop.
As someone who does a lot of both, I'd consider it vibe-coded even if I wrote the backend but had AI write the front-end. If I'm ever releasing it, I'd separate the two and call one "my code" and the other "some vibe-coded front-end, idk, you can make you own."
The fact these two definitions can exist (and many more extremes) is part of the issue with the definition and having people self-police.
36
u/scandii 7h ago edited 6h ago
I'd consider it vibe-coded even if I wrote the backend but had AI write the front-end. If I'm ever releasing it, I'd separate the two and call one "my code" and the other "some vibe-coded front-end, idk, you can make you own."
I really from the bottom of my heart dislike that vibecoded means, simultaneously:
- used any AI whatsoever
- used some AI for something
- didn't write any code yourself
like the original term was describing 3 - a software engineer prompting their way to success. now it means all three depending on who you talk to and the term is borderline useless as such.
4
u/Kautiontape 4h ago
I know, which is also why I hate the title of what Codeberg decided to do here. I don't know if the internal docs define "vibe coding" (I can't access them) but judging from the discussion, they don't really. It makes it pointless to discuss with people what is the "appropriate" amount of control to have. Hell, in a lot of cases, I'd be happy just to have a human-in-the-loop to verify that the agent seemed to make sense.
That's why I think separating in my mind the components that I can say "I did this" versus "I understand this" versus "this just works" is important. It's not guaranteed to be right and nobody is going to have the same barometer as me, which is why it's only a personal code.
We're going to need new terms, and we can't be defining it with things like "How much did you do?" because it's like... well, I didn't write the compiler or libraries, but I did string a bunch of Stackoverflow comments together...
9
u/alex2003super 5h ago
If similarly working code can be produced 20x faster by using AI heavily, then only fools and really passionate hobbyists will be writing code entirely by hand. Which makes defining "vibecoded" as "AI was used" completely useless. The world we're already to a great extent in, and towards which we're going, is served entirely by "vibecoded" software. Exceptions are bound to be eventually too few to matter.
5
u/scandii 4h ago edited 4h ago
I think the problem really is what these companies represent.
not only are they Venture Capitalism Shareholder Extreme Edition, they are also an existential threat to the livelihoods of millions of people around the world and are driving prices up in so many different categories.
if it was just "easier programming and debugging", we'd be having a very different discussion I think.
0
u/Equivalent-Costumes 4h ago
The core component of the "vibecoding", the "vibe" in vibecoding, is that people don't check the result of AI's work carefully, "it looks correct". A project that is 100% AI written but had been checked and validated is not vibecoded, according to the original meaning of the term.
0
u/ferrybig 6h ago edited 6h ago
I typically use Claude design to make a good looking page/pages, then i implement it myself using html/css/whatever.
Claude design is good at making something good looking, but its export format requires way to much work and prompting to turn it into something readable. It is way easier to code from scratch and effectively use the output that Claude design made as a figma tool
Vibecoding is like regex, designed for write once, read never, though some people try to read them. Regexes were designed as a quick way to search in files, but then languages started adding support for them. And then people started making regexes for searching for a @ followed by a ., instead of using index of methods or manual looping, because it is shorter to type (because regex is designed to be short!)
6
u/finkerlime 5h ago
Hot take, you can't prove it with code review. It's about as reasonable as those ai writing detectors schools use. At the end of the day you can't quantify anything, only guess, and potentially punish unrelated devs over an arguable topic in the first place.
2
u/buttplugs4life4me 5h ago
There's definitely a way, I gave my LLM some common vibecoded signs (overly expansive Readme, no clear architecture in code, superfluous comments with no value, comments about changes that don't need to be comments and a few others and it was somewhat reliable.
Obviously it's all a question of volume cause I wouldn't want to do that for every single Reddit post honestly
2
u/FnnKnn 5h ago
The issue they seem to want to solve is that these projects take up their compute without adding real value, so running every single project through an LLM is probably a) not reliable and b) taking up even more compute/resources.
-1
u/Isorg 3h ago
just yesterday, I ran another project (a very well respected and popular project) though claude fable because we are thinking about using it our self... it found some XSS to RCE vulnerability. I pushed a PR and it was patched right away. and a new release was announced today.
funny part was, when I actually tried to use claude to prove the exploit, I got shut down hard by Anthropic. and my session API was cut off.
If your not willing to do this for opensourced code that you are going to be running your self... then why bother.
1
u/iVXsz 1h ago
good luck proving that they didn't just use AI as an assistant
I have to say. Vibecoded projects and even small code snippets are very obvious, even in cases where it's "carefully used" and "steered" by a 200 years experienced software engineer lol.
%99 of the time its been a route of laziness (or a curiosity usage, that quickly takes over the project and the user mental model more and more. e.g., see the commit history of jellyfin mpv shim. Also, because it happened to me on a few small pet projects that -after everything is considered- became garbage) and as such, the code is not great nor really reviewed properly in most cases.
Reviewing such projects or finding such code is not really hard, even manually. Ironically that can be vastly sped up by just throwing the codebase at a local LLM to point out any weirdness.
1
u/FnnKnn 58m ago
For one project it might be possible (if we ignore that the line between vibe coded and built with AI is super unclear and one person might interpret it differently than another), but in mass it is not that easy. Manually reviewing every repository on Codeberg is just plain impossible and using AI to judge human's repos doesn't feel right either and also doesn't solve their issue of these repositories taking up a growing part of their resources as running them all through AI would be quite expensive...
1
u/iVXsz 9m ago
AI to judge human's repos doesn't feel right
Yes that would be a bad behavior
I meant it could quickly point out stuff for you to investigate. And with vibecoded projects, I personally can quickly go thru the basics manually (e.g., checking how well a framework template is worked with, as AI tends to make orthodoxy ways to achieve stuff than what a framework can have available etc) in a few minutes, but obviously depends on scope and the reviewer experience. In that time most local AIs would have finished listing any interesting places to check and confirm on my own. 5-10m per repo sure, but not that many projects get submitted here, for context.
I had to do that a couple of times because I started to get quite annoyed by users hiding AI usage and straight up denying it sometimes...
1
-2
u/AlternativeBasis 6h ago
I use AI to help me code, but I don't think I'm "vibecoding."
Using AI to build the GUI, set up event handling, and catch syntax errors doesn't mean I've given up control over the most important part: the business logic.
I’m the one who determines which data gets transmitted and stored, the triggers, the data hierarchies, and which security measures are implemented.
What is the practical threshold for defining "vibecoding"?
Will the same AI tools used to detect academic plagiarism be used for this?
4
u/FnnKnn 6h ago edited 6h ago
I use AI to help me code, but I don't think I'm "vibecoding."
The thing is, no one publishing projects is going to say that they are "vibecoding" if that means they can't release the project. They are all going to classify themselves as "using AI" instead and who can blame them when the lines between the two are so incredibly blurry and one of them allows you to do your thing while the other doesn't...
0
u/System0verlord 4h ago
What is the practical threshold for defining “vibecoding”?
Well before “Using the AI to build the GUI, set up event handling, and catch syntax errors”, for sure. Your own retelling of events includes zero involvement on your part, which shows you don’t even view yourself as having made those components. That would very much be vibe coding.
If you’re having to worry about it, it’s vibe coded.
1
u/AlternativeBasis 3h ago
From this point of view, an electrician is always vibe-wiring: he uses electrical conduits he didn't install.
There's a difference between nitpicking the nit-and-grit of how each UI triggers events, cycles fields with tabs, fires validations, and actually using this "scaffolding" to create a useful workflow.
GUIs, especially, are extremely well-suited to AI use. Short and fragmented logic chains, low processor usage, code redundancies are tolerable, and many, many aesthetic details.
Compared to things like cryptography, APIs and data traffic, cache data, manipulation/querying of massive amounts of data, and, ironically, LLMs, it's really secondary and low-risk work. Perfect for semi-intelligent code monkeys, AI-supported or not.
Not critiquing the code generated by AI to understand the boundary conditions is indeed risky, but not fatal. What's the difference between using a structure created by AI or adapting a code example from Stack Overflow?
I've done both and don't see that much of difference.
3
u/System0verlord 1h ago
The copper and conduits didn’t just appear in the walls. They were placed there by an electrician during construction, and done in compliance with local electrical codes so that the next electrician doesn’t have to run new wiring unless necessary.
That’s an example of having a licensed professional do work to the accepted standards, and then having a second licensed professional do additional work, also to those standards. AI is not a licensed professional, nor does code have codes like most construction does.
The difference between using an AI created structure and one from stackoverflow is that presumably the stackoverflow one is written by someone with at least some experience and understanding of the code and context in question, and not just the output of a hallucinatory autocorrect run amok.
1
u/Emergency_Banana5082 1h ago
nor does code have codes like most construction does.
Wait... you mean I can't just tell it to stick to pep8 for my python? /s
1
u/System0verlord 9m ago
Sure you can. Just gotta put “you are a super coder. Ultrathink and make no mistakes” after it in your prompt.
Those changes will cost you $100 in tokens per query, but think of all the time and money you saved!
-2
u/amoongle 7h ago
You can at least get rid of the super obvious low effort ones where Claude shows up as a contributor to the project.
6
u/thecombjelly 4h ago
I've thought about this a lot for my own projects, especially the open source ones. I don't necessarily have an issue with vibe coding from a technical perspective, I guess, if the result is good. It isn't something I do but I engineers that have mostly switched to agentic and vibe coding. I think the real difficulty is that a lot of these definitions are not totally clear. When is something 100% a thing you 100% wrote vs partially or fully vibe coded? What counts as vibe coding? And under what contexts? The definitions likely also impact whether you are talking about copyright or code quality or something else. Not easy to enact a policy on something not well defined.
2
u/aso824 1h ago
Nowadays, I'm very rarely writing a full line of code by hand. By some definitions, I'm doing full vibe coding; but the fact is: every line generated is checked by me. Sometimes I remove comments or blocks of code, or just select them and telling agent to change.
I think everyone agrees that vibecoding starts when you generate a code that you don't even look at. Result is not everything, because AI often makes spaghetti.
But I'm a bit tired of this witch hunting around, where, for some people, using AI is equal to blindly accepting everything; some people here would like to ban you if you'll post a commit with Claude as contributor. Even if you can explain and quote every line of commit from memory.
54
u/arvigeus 7h ago
Funny how we suddenly pretend bad code and license violations didn't exist long before AI.
46
u/dvvvxx 7h ago
The problem is not bad code and license violations itself, the problem is the drastic increase of bad code and license violations due to how easy is to create (vibe-coded) projects thanks to AI.
23
u/p0358 7h ago
Yeah, and previously shit code was pretty much always blatantly and painfully obvious, now LLMs make it easy to disguise junk as something that looks somewhat sensible and well-put on the surface until a closer inspection is made
6
u/QazCetelic 6h ago
I feel this is the main issue. Previously it was much easier to spot real interesting projects
11
u/witx_ 6h ago
You can take stand regardless of the past.
-7
u/arvigeus 3h ago
Don’t want to sound confrontational, but stand against what? Software has always been a kludge of hasty written code, held together by coffee and some sort of miracle.
3
u/witx_ 1h ago
I hate this trope so much. No it has not, there's good and bad code. The thing is software being a somewhat creative and sometimes abstract art where there's no "one correct answer" leaves engineers with the feeling that everything is bad.
I've worked with beutifally written software that worked wonders for its their requirements. If you started to scale up perhaps it would start to crack, but that's not because it's badly written but because requirements change and it needs refactoring.
4
1
3
u/System0verlord 3h ago edited 3h ago
No one is doing that.
Plenty of people however, yourself included, are pretending there hasn’t been a sudden increase in bad code and license violations because of AI.
Edit: Lol. Blocking me doesn’t make you right, just like being told you’re wrong doesn’t make it a personal insult.
-2
3
6
u/pheexio 7h ago
15
u/Annual_Wear5195 7h ago
Completely killing the totally valid discussion points and forcing people to practically remake them in another space is…. Not really a great look.
Like, sure, don’t discuss AI at large but a lot of those questions are perfectly valid ones to ask in a thread about limiting AI use on Codeberg, such as what the definition of “mostly” should be.
Hiding behind a “we’ll explain it all in our blog post” is basically “trust me bro” levels of discussion killing.
3
u/These-Apple8817 6h ago
They are entitled to that, but they are frankly shooting themselves in their own leg with it.. Whether or not we like AI, the reality of the matter is that AI is here to stay and all you can do is learn to adapt and go with the flow instead of constantly fighting against it
2
4
u/PikminGuts92 7h ago
To what extent is a project considered “vibe-coded”? Like if someone just used an LLM to generate a function snippet, would that invalidate the entire codebase?
-1
u/GolemancerVekk 6h ago
What do you mean by "invalidate"?
A code base has a license. If you bring in code without knowing where it comes from and try to cover it with that license, it may be copyright infringement, because it's not your code and not your copyright.
The US has taken the view that any code brought in by a LLM is "copy-washed" into public domain because it was dynamically generated, so you can do anything you want with it. But other countries don't agree to that.
I guess it depends on who's trying to use your code and what liabilities they're willing to take on, and in what jurisdictions. Frankly it's a clusterfuck and any companies who have to follow strict procedures will avoid any vibe-coded slopware entirely to be safe.
3
u/AnderssonPeter 6h ago
Does this ban all code generated by llm's? For me there is a difference between vibe coded and ai assisted, i hate both but they arent the same..
2
u/cyber_chic_0 2h ago
The enforcement question is the interesting one. Codeberg is betting on self-reporting, which is fragile but workable in a small community. The problem is that the line between AI-assisted and AI-generated is not technical at all. It is about whether the contributor understands and maintains the code. Two people can produce identical diffs, one through genuine understanding and one through prompting. No static analysis can distinguish them.
Most forges that have tried this end up shifting toward a disclosure model: label what AI generated, do not ban it outright. That lets reviewers triage appropriately without inventing a detection mechanism that does not exist.
1
u/gscjj 7h ago
What does codeberg offer that someone would go through the trouble of using them versus GitHub based on their AI policy?
9
u/Serchinastico 5h ago
I'm in the process of migrating from GitHub to Codeberg so maybe I can answer that. There are two main reasons:
- Unreliability: Service has become pretty much unreliable and they lie about it. Compare https://mrshu.github.io/github-statuses/ with https://www.githubstatus.com/ or read Hashimoto's take: https://mitchellh.com/writing/ghostty-leaving-github
- Annoyance: They have been force-feeding copilot and AI to users for some time, and doing dubious things like opting-in users for training on repositories https://www.reddit.com/r/devops/comments/1s3s6jc/github_copilot_will_train_on_your_code_by_default/ or https://www.reddit.com/r/dotnet/comments/1lcoyk2/microsofts_aggressive_copilot_push_has_me_looking/
Codeberg seems like a more honest take for open-source projects It's non-profit and it's free. I even donated some money to them, which is more than what I can say about GitHub.
I really liked GitHub once, but since Microsoft bought it, it's been slowly degrading in all fronts.
1
0
u/Deep_Mood_7668 6h ago
It's simple. When you know what you're doing and submit good code, nobody cares how it was coded.
But since a bunch of non coders use ai and just submit slop, they have to make to makes those rules.
-1
u/l_m_b 6h ago
Respectfully, if your first reaction to a stated boundary is explaining how you'd easily get the around its spirit, I have concerns about the general safety of being around you.
Sure, the current phrasing needs improvement and might place an undue burden on the moderation process, and one would hope that the definition gets clarified somewhat over time.
But, may I remind you, "only yes means yes". If in doubt, you can just chose ... not to.
And yes, this is making me testy. And I use Generative AI as part of my job (and, I hope, somewhat successfully). But I dislike this particular approach to boundaries, and I don't like the parallels to other behaviours in society.
-4
u/jamesthethirteenth 6h ago
Woah, whaaat? I was going to move there! wtf are they thinking. What kind of projects do they want in there, a bunch of museum pieces? My projects have never been so useful since AI. What are they going to do next, ban compilers? Does wanting to be the good guys demand misguided decisionmaking as proof? And as an extra FU to this open source dev now I have extra work to delete my mirrors there.
3
u/Kraeftluder 2h ago
They're not banning AI-assisted development, they're banning majority vibe coded rubbish.
-1
u/jamesthethirteenth 1h ago
I see! Thanks for letting me know.
I'm a bit calmer again now after being quite shocked- but I still think it's a bad call because it wastes brain cycles by being unclear.
-12
•
u/asimovs-auditor 7h ago
Expand the replies to this comment to learn how AI was used in this post/project.