Comment by mmooss | Hacker News Reader

Comment by mmooss | Hacker News Reader

From Proposal A:

> LLM output has very unclear legal status: it may be possible to copyright on its own merits, or not; it may be affected by all of the licenses and copyrights in the training data, or not. Debian Policy and the DFSG require absolute clarity for licensing and copyright[1][2]. Software and other contributions written conventionally by humans with unclear copyright or license status are not allowed in Debian; LLM output should not have a special exception to this.

The way the proposers portray it, this problem is a dealbreaker. Is the problem as portrayed? Do LLM vendors attempt to copyright the output?

Proposal B tries to solve one aspect of it:

> 2. Licensing and Attribution: If any pre-existing copyrighted materials (including pre-existing code licensed as free software) authored or owned by third parties are included in the AI tool’s output, prior to contributing such output to the project, the contributor should verify they have the right to submit it under the relevant open source license.

> 3. Accountability: Contributors assume full responsibility for their contributions, including vouching for the technical merit, security, license compliance, and utility of their submissions. The contributor remains solely accountable for the entirety of these contributions. Contributors should fully understand the proposed changes and be prepared to justify them.

How can a contributer know if LLM output includes "pre-existing copyrighted materials (including pre-existing code licensed as free software) authored or owned by third parties"? They can't be familiar with all pre-existing code in the world.

Maybe Debian could provide a search engine that looks for copyright violations, but do they really want to take responsibility for an issue with the risk of high liability? What if their search engine fails - maybe they could be sued for that too.

Also, that doesn't seem to address the IP of the LLM vendor.

> How can a contributer know if LLM output includes "pre-existing copyrighted materials (including pre-existing code licensed as free software) authored or owned by third parties"?

I use an LLM to write code, but 90% of that usage is code review which raises suggestions or fixes which I go and implement myself. Occasionally I also have the LLM complete a single function that I know it will do correctly because the requirements are all present and unambiguous. Because the content of the function is all based on the unique context of my codebase, it has about the same chance of reproducing someone else's code that I have, nearly zero.

Under those circumstances, I'd be comfortable taking the responsibility that the code is free of legal issues. The LLM assisted review also would make me more confident of the quality of the code and capable of explaining it and justifying it.

This is vastly different from a scenario where a developer has an agent coordinate and write most of the content. There are many different ways to use LLMs and it seems like these policies need to take them into consideration. Developer responsibility for the legality/quality of the code should be no different than non-assisted code, but they could also give examples of safe and beneficial LLM use.

>The way the proposers portray it, this problem is a dealbreaker. Is the problem as portrayed? Do LLM vendors attempt to copyright the output?

They're right that this has not been fully tested in court (though neither have some other open source licenses). There's a pretty clear direction that the wind is blowing in, though (you can see in most related cases that the judges focus on issues surrounding the core idea of using copyrighted data for training, and mostly don't give credit to the idea that all of a model's output is a derivative work of all of the input). I don't believe any LLM vendors try to claim copyright on the output of the models.

>How can a contributer know if LLM output includes "pre-existing copyrighted materials (including pre-existing code licensed as free software) authored or owned by third parties"? They can't be familiar with all pre-existing code in the world.

This is a common objection/worry. It seems relatively clear that even if most of the output of an LLM is not subject to existing copyright, some of it could well be (especially if, e.g. you feed an LLM a codebase and ask it to just output it again verbatim or with different variable and function names). What exactly the risks are if you are if this happens while you are using the LLM in good faith is pretty unclear (the vendors pretty much just say "It's at your own risk").

(This case felt a little surprising to me, BTW: https://petapixel.com/2026/07/22/dog-photographer-loses-copy... . But copyright case law is weird, arbitrary, and somewhat capricious about what aspects of a work are and aren't protected by copyright. With code this can also potentially be weird because in principle the functional parts are not protected, only the human expression components are. Untangling this can be time consuming, expensive, and ugly)

Copyright law varies across jurisdictions, and it's not obvious how training for AIs would align with https://en.wikipedia.org/wiki/Fair_dealing (and it appears a recent push to re-examine copyright law in Australia ended due to AI companies getting involved).

Exactly. This is like proposing to solve memory safety by asking programmers to simply not make any mistakes. Simply specify that "the contributor should verify" that the code has no use after free, no out of bounds access, no undefined behavior, etc., for which they "assume full responsibility".

At the same time, how can a human know if they accidentally rewrote exactly some code they read in the past from a codebase with an incompatible license?

Accidental copies happen all the time in code, music and art. Not all of it is necessarily super original, but that's beside the point and it happens.

So while we think we can hold AI tools to higher standards than humans, they are still modeled after human thinking and will make the same mistakes. Is this really the right thing to do and is it entirely practical?

This argument is almost algorithmic: Take the concern about <TECH>, substitute 'human'. Also, another popular response: don't address questions, instead try to put the person asking on the defensive.

The main point is the implicit argument that humans and machines are equivalent.

Sure. But in the end, it's just a tool that is used to assign blame when there are issues, and humans are more comfortable when another human is to blame rather than a machine as it means they are still in control (or have the illusion of).

Reply on news.ycombinator.com