COSMIC 禁止 AI 生成代码贡献，GNOME 内部就接纳 AI 漏洞报告展开争论

software

System76 demands human-written contributions, while a rival desktop developer argues bot-found flaws are too valuable to ignore

New motherboards, old RAM, plenty of life left in yesterday's PCs 56 minutes ago; The AI math isn't mathing as infrastructure spending forecast to outstrip expected revenue 6 hours ago; UK government chases AI while aging IT leaves it exposed, PAC chair warns 7 hours ago; It won't kill you, or humanity, to get off the AI upgrade treadmill 8 hours ago; Anthropic reinvents source control as Claude floods the world with code 17 hours ago

System76 is banning AI-generated content from contributions to the COSMIC desktop. Some GNOME sub-projects also restrict AI-generated contributions, but one developer is urging them to make an exception for vulnerability reports.

The COSMIC desktop project has changed its contributors' guidelines. The latest version now has a clear no-AI rule, insisting that contributors declare: "I have not included any LLM (also known as AI) generated content in this PR, including code, comments, and descriptions."

In other words, you can teach yourself using AI, you can find bugs with AI, but if you want to submit your code for inclusion in COSMIC, you can't use AI to write the code, its docs or notes, or even the submission requests.

This position is in keeping with some other desktop projects. For instance, the GNOME Calendar guide to contributing says: "This project does not allow contributions generated by large languages [sic] models (LLMs) and chatbots."

GNOME Extensions also restricts AI-generated submissions, although it permits AI learning aids and code completion. Its review guidelines spell it out: "Extensions must not be AI-generated."

COSMIC is one of the newest complete Linux desktop environments, but even so, it's been under development for years. The Register first reported on the effort nearly five years ago, meaning that it's older than ChatGPT, which debuted in late 2022 (it only feels so very much longer).

COSMIC does use some GNOME components, and its default config looks not unlike GNOME, with a top panel and a dock-like launcher at the bottom. There are good reasons for that: the original System76 desktop called "COSMIC" was based on GNOME, quite heavily customized with GNOME extensions.

Saying that, though, this new COSMIC is a very different beast. Its first stable release shipped with Pop!_OS 24.04 in late 2025. Although it looks similar, it's an entirely new, ground-up effort, written in Rust using the Iced toolkit. COSMIC itself is Wayland-only.

GNOME is much older, larger, and more complicated. The project was announced in 1997, the year after the KDE project announcement. KDE 1.0 came out in 1998, and GNOME 1.0 in 1999.

In part, GNOME was a response to KDE. KDE is built on the Qt toolkit, which was not fully open source. As such, in KDE's early days, Red Hat refused to include it in Red Hat Linux. Qt is aimed at C++ developers, so KDE was built in C++. Linux, like Unix, is built in plain old C and many Unix traditionalists scorned the much more complex C++. So GNOME was built in plain old C, using GTK, the toolkit built for the GIMP. In 1998, Red Hat Linux 5.1 included a preview of GNOME, and by Red Hat Linux 6.0 in 1999, GNOME 1.0 was the default desktop.

GNOME is still the default desktop in RHEL to this day, and many GNOME developers' day jobs are at Red Hat. As we noted back in March, Red Hat management is noticeably enthusiastic about AI – although six months later, it was capping developers' AI spend.

GNOME is largely written in C, which lacks automatic memory safety guarantees, although other languages feature too: GNOME Shell combines JavaScript and C, and some components are written in the GNOME-centric Vala programming language.

Michael Catanzaro, GNOME developer, just published a blog post titled "The Era of Software Quality, or the Era of Ostriches?" which argues that the GNOME project must accept AI-generated bug reports. This is not a new subject for him. His post links to an earlier one from June, "Please Do Not Ban AI-Assisted Issue Reports." The following month, he announced a reduction in the disclosure deadline for issues reported to GNOME Security, from 90 days to 30, effective August 1.

We recently reported on the 1,313 CVE identifiers listed in Debian's latest Linux kernel security advisory. AI is resulting in the discovery of vast numbers of bugs in the equally vast codebases of modern FOSS. GNOME is one of the biggest desktops in the Linux and BSD world, with much of its code written in memory-unsafe languages.

As Catanzaro says: "No matter how much we try, GNOME developers will fail [to] write secure code when using unsafe languages like C, C++, or Vala: it's just too hard for even experienced developers to do properly."

We are not arguing that Catanzaro is wrong. Given the stance toward AI of GNOME's biggest sponsor, it is entirely in keeping, and he makes a strong case. All we are noting is that this could in time prove to be the thin edge of a wedge with the weight of Red Hat behind it.

First the project allows AI-generated bug reports. From there, it would not be a huge step to allowing AI-assisted triage. From there, to AI-assisted fixes. Once you're letting AI-assisted code in, then AI-assisted extensions may not seem so extreme, then core components, and in time, to the desktop itself.

It would be wildly controversial, just as it already is in the KDE project. That doesn't mean it won't happen – in either project. Debian decided to allow it, and of course, the kernel itself does too. ®

Fire up that iPhone 1 emulation and party like it's 2007

Browser-based fun to remember a time before Apple's annual cash grab became a thing

New motherboards, old RAM, plenty of life left in yesterday's PCs

DDR4 makes a comeback as component costs rise, while Linux offers an escape from forced upgrades

The VMware exit is a protection upgrade

PARTNER CONTENT: VergeIO says an exit is also an opportunity

Tiny11 puts Windows 11 on a diet without the PowerShell workout

New desktop app simplifies stripping out bundled software, with heavier cuts carrying security and support risks

It won't kill you, or humanity, to get off the AI upgrade treadmill

New models arrive so fast, we already have more new tech than it's possible to understand in a career

Cisco, Nvidia team up to build fatter, faster pluggable

If you thought 1.6 Tbps was fast, just wait, Cisco's USFP targets 12.8 Tbps in a single optical pluggable

TOP STORIES

Anthropic asks users to stop being mean to Claude; '123456' password linked to Denmark data breach affecting 8.8M people; Microsoft and Anthropic play invoice tennis with startup's $17,600 Claude bill; Starlink's plan to avoid orbital near-misses: Ephemeris sharing; Shai-Hulud worm makes jump to AI infrastructure with Tensorlake compromise; Dutch tax office ditches Microsoft 365 cloud for on-premises alternative

Cisco, Nvidia team up to build fatter, faster pluggable If you thought 1.6 Tbps was fast, just wait, Cisco's USFP targets 12.8 Tbps in a single optical pluggable; Claude submitted fake murder tip to Philly police during summertime testing Anthropic took more than two months to alert cops; AI systems are fully capable of carrying out nightmare attacks against infrastructure and nobody's ready Meanwhile, AI agents move robotic arms, 'make OT device operator screens lie'; Nvidia found $1B under the couch to help secure American scientific computing dominance Commitment comes as GPUzilla prepares to fortify Uncle Sam's arsenal with at least seven AI-optimized supers; TSMC taps GlobalFoundries to bolster US silicon interposer production in $2B deal Advanced packaging tech is essential to the domestic production of high-performance semiconductors used in AI datacenters

Infosec

Security Russians are posing as Signal support to launch phishing attacks PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!; Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more; Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructure Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included; Security EQT buys majority share in Swiss cybersecurity biz Acronis Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified; Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight On the plus side, infosec's a good bet for a long, stable career

FOSS

NetBSD may have found a new role: The AI-free FOSS OS Increasing awareness and adoption, followed by increasing donations; OpenAI dots inspire open source imitators amid technical difficulties Persistent agents appeal to AI companies, but demand isn't obvious; Ubuntu 'Stonking Stingray' beta swims out: Deeper Rust 'oxidization' plus LLM speech-to-text GNOME 51 is here, and Ubuntu interim releases are getting interesting again; Revive Raskin's 3 laws of software with humane work that considers a dev's duty of care All this, and angry NeoVim users; Firefox 157: Could bold new look be just what Mozilla needs?* Yet another new version of Firefox, with a significant reskin; KDE turns 30 and someone's brought an AI-native desktop proposal Akademy talk imagines Plasma assembling itself around a personal model of each user