惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

H
Help Net Security
The GitHub Blog
The GitHub Blog
F
Fortinet All Blogs
cs.CV updates on arXiv.org
cs.CV updates on arXiv.org
Simon Willison's Weblog
Simon Willison's Weblog
D
Darknet – Hacking Tools, Hacker News & Cyber Security
Cisco Talos Blog
Cisco Talos Blog
P
Privacy & Cybersecurity Law Blog
I
Intezer
Y
Y Combinator Blog
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
CTFtime.org: upcoming CTF events
CTFtime.org: upcoming CTF events
N
Netflix TechBlog - Medium
The Hacker News
The Hacker News
AWS News Blog
AWS News Blog
aimingoo的专栏
aimingoo的专栏
A
About on SuperTechFans
Exploit-DB.com RSS Feed
Exploit-DB.com RSS Feed
Stack Overflow Blog
Stack Overflow Blog
Hacker News: Ask HN
Hacker News: Ask HN
酷 壳 – CoolShell
酷 壳 – CoolShell
量子位
K
KPMG report finds enterprise disconnect between AI and its ROI | CIO
B
Blog
T
Tor Project blog
C
Cybersecurity and Infrastructure Security Agency CISA
云风的 BLOG
云风的 BLOG
博客园_首页
V2EX - 技术
V2EX - 技术
T
Threat Research - Cisco Blogs
腾讯CDC
宝玉的分享
宝玉的分享
博客园 - 叶小钗
罗磊的独立博客
S
Securelist
The Last Watchdog
The Last Watchdog
Google Online Security Blog
Google Online Security Blog
Scott Helme
Scott Helme
博客园 - 司徒正美
W
WeLiveSecurity
有赞技术团队
有赞技术团队
OSCHINA 社区最新新闻
OSCHINA 社区最新新闻
S
Secure Thoughts
NISL@THU
NISL@THU
N
News and Events Feed by Topic
Cyber Security Advisories - MS-ISAC
Cyber Security Advisories - MS-ISAC
雷峰网
雷峰网
大猫的无限游戏
大猫的无限游戏
K
Kaspersky official blog
IT之家
IT之家

DEV Community

Authentication Security Deep Dive: From Brute Force to Salted Hashing (With Java Examples) Why AI Systems Don’t Fail — They Drift Spilling beans for how i learn for exam😁"Reinforcement Learning Cheat Sheet" I Replaced Chrome with Safari for AI Browser Automation. Here's What Broke (and What Finally Worked) How Python Borrows Other People's Work The $40 Architecture: Processing 1 Billion API Requests with 99.99% Uptime Vibe Coding: A Workflow Guide (From Zero to SaaS) Most webhook security guides protect the wrong side. The scary part is delivery. Headless CMS for TanStack Start: Build a Blog with Cosmic EU Age Verification App "Hacked in 2 Minutes" — What Actually Happened Comfy Cloud’s delete function does not actually remove files Running AI Models on GPU Cloud Servers: A Beginner Guide Event-driven media intelligence with AWS Step Functions and Bedrock I scored 500 AI prompts across 8 quality dimensions — here's what broke How to Call Google Gemini API from Next.js (Free Tier, No Backend Needed) The Portal Protocol: Reclaiming Human Connection in the Age of AI How to Fix Your Team's Scattered Knowledge Problem With a Self-Hosted Forum Intro to tc Cloud Functors: A Graph-First Mental Model for the Modern Cloud Designing Multi-Tenant Backends With Both Ownership and Team Access I Built a Neumorphic CSS Library with 77+ Components — Here's What I Learned PostgreSQL Performance Optimization: Why Connection Pooling Is Critical at Scale Cómo construí un SaaS multi-rubro para gestionar expensas en Argentina con FastAPI + Vue 3 🚀 I Built an Ethical Hacking Scanner Tool – Open Source Project I Replaced /usage and /context in Claude Code With a Single Statusline A Pythonic Way to Handle Emails (IMAP/SMTP) with Auto-Discovery and AI-Ready Design I Collected 8.9 Million Polymarket Price Points — Here's What I Found About How Markets Really Move EcoTrack AI — Carbon Footprint Tracker & Dashboard Everyone's Using AI. No One Agrees How. 5 self-hosted ebook managers worth trying in 2026 Building Your First AI Agent with LangChain: From Chatbot to Autonomous Assistant Common SOC 2 Failures (Real World) Stop Vibe-Checking Your AI App: A Practical Guide to Evals How to Use SonarQube and SonarScanner Locally to Level Up Your Code Quality Your Next To-Do App Is Dead — I Replaced Mine with an OpenClaw AI Sign a Nostr event in 60 lines of Python using coincurve — no nostr-sdk, no nbxplorer, no rust toolchain ITGC Audit Explained Like You’re in Big 4 Patch Tuesday abril 2026: Microsoft parcha 163 vulnerabilidades y un zero-day en SharePoint Stop scraping everything: a better way to track competitor price changes Listing on MCPize + the Official MCP Registry while routing payments OUTSIDE the marketplace — how I kept 100% of my x402 revenue Building an AI-Powered Risk Intelligence System Using Serverless Architecture Why We Ripped Function Overloading Out of Our AI Toolchain Testing AI-Generated Code: How to Actually Know If It Works SaaS Churn Is Killing Your Business. Here Is What to Do About It (Without a Support Team) The Speed of AI Is No Longer Linear - And Self-Improving Models Are Why How to Implement RBAC for MCP Tools: A Practical Guide for Engineering Teams From Standard Quote to Persuasive Proposal: AI Automation for Arborists I built a CLI that scaffolds complete multi-tenant SaaS apps Axios CVE-2025–62718: The Silent SSRF Bug That Could Be Hiding in Your Node.js App Right Now The dashboard that ended our friendship Data Pipelines Explained Simply (and How to Build Them with Python) The Hidden Cost of AI Systems Nobody Talks About. undefined vs undeclared, and how typeof behaves Switching from file-based jobs to NATS/Kafka in Rust without changing code io_uring Adventures: Rust Servers That Love Syscalls Why Agentic AI is Killing the Traditional Database The POUR principles of web accessibility for developers and designers Quantum Neural Network 3D — A Deep Dive into Interactive WebGL Visualization How To Install Caveman In Codex On macOS And Windows Automation Pipeline Reliability: Why Your Workflow Breaks When Nobody Is Watching I Built an 'Open World' AI Coding Agent — It Works From ANY Folder From Freelancing to Product: A Tech Service Company's SaaS Transformation China's AI Giants: Adding Tencent Hunyuan & ByteDance Doubao to AI University (74 Providers) On the Vibe Coders and Their Lies clerk: Auto-Summarize Your Claude Code Sessions AI Weekly — 2026/04/10–04/17 | The Model Lockdown Is Here, but the Toolchain Is the Real Battleground AI 週報 — 2026/04/10–2026/04/17 模型封鎖潮來了,但工具鏈才是真戰場 Maybe this is how Open-Source apps are born... 🚀 Fine-Tune LLMs with LoRA and QLoRA: 2026 Guide tRPC v11 + Next.js App Router: End-to-End Type Safety Without the Boilerplate ShadCN UI in 2026: Why I Stopped Installing Component Libraries and Started Owning My Components SaaS Billing in React Server Components: Stripe + Supabase Without a Single `useEffect` Join our DEV Weekend Challenge — $1,000 in Prizes Across TEN winners! Submissions Due April 20 at 6:59 AM UTC. Implementing FSRS Spaced Repetition in Flutter + Supabase — Adding Memory Science to an AI Learning App "I Texted My Localhost From the Train — Claude Code Fixed the Bug Before I Got Home" I Built a Sales Prep AI and It Went Deeper Than Expected Design to Code #2: One JSON, Eleven Outputs Solving the 100M-Row Problem: A Summary Table Pattern for High-Volume Push Notification Logs Flutter Web With Wasm: What Actually Changes For Developers I Built 50 Royalty-Free Soundtracks for My Side Project in a Weekend Using AI Music Generation The Vibe Coding Security Checklist: 7 Things to Check Before You Ship Stop Letting Googlebot Guess Fix Your React App's SEO Right Desconstruindo o Streaming do LinkedIn: Como Criar um Engine de Extração de Vídeo de Alta Performance com HLS e FFmpeg (EDA Part-1) EDA (Exploratory Data Analysis) Explained With Real Life — Why Looking at Your Data Is the Most Important Step in Machine Learning Brand Relationship Management at Scale: Our 4-Touch Outreach System for 200+ Brands Why String.fromEnvironment() Might Return an Empty String in Dart JGuardrails 1.0.0 — Hardening Java LLM Apps Against Jailbreaks, Toxicity, and Prompt Injection Plan and Schedule a Full Week of Threads Content From One Claude Conversation Coding Cat Oran Ep3, Five Tables Changed Everything Updated: BFF Pattern I'm done watching freelancers get buried by 200 proposals. So I'm building the alternative. This is my first post BFS Algorithm in Java Step by Step Tutorial with Examples Tracking LLM Pricing Monthly: An Open Dataset for 22 AI Models How We Measure Content ROI on a Comparison Site: Revenue Attribution Without Perfect Data Introducing Nova AI Ops: The AI-Native Operating System for SRE Teams I built a free desktop video downloader for Windows — Grabbit How Talkie OCR Helps Vision-Impaired & Dyslexic Users Read the World Around Them VRCFaceTracking安装和iPhone面捕配置教程,有bug Even CrowdStrike Can't See Your Agents The Automation Gold Rush: What n8n Workflows and Claude Are Opening Up for Developers Right Now
The Person, Not the Cards
Arthur · 2026-06-12 · via DEV Community

In December 2025, Anthropic acquired Bun, the JavaScript runtime written in Zig. In April 2026, the Bun team announced a 4× compile-time improvement on their fork of the Zig compiler — "parallel semantic analysis and multiple codegen units to the llvm backend", in their phrasing. They also announced they would not be upstreaming the work, "as Zig has a strict ban on LLM-authored contributions."

The framing landed badly with Zig observers, for two reasons. The first was that the framing made Zig's contribution policy the obstacle. The second, pointed out shortly afterwards by a Zig core contributor in the Ziggit thread, was that the patch had separate engineering reasons it would not have been merged regardless: "Parallel semantic analysis has been an explicitly planned feature of the Zig compiler for a long time", with "implications not only for the compiler implementation, but for the Zig language itself". The AI-ban explanation was, on a closer read, a tidy way of declining to litigate the engineering disagreement in public.

Both readings are useful. They are also both downstream of the actual rationale, which is one of the most carefully argued OSS-governance documents to appear in 2026.

What the policy actually says

The relevant clauses, in the Zig code of conduct under the section heading Strict No LLM / No AI Policy, are three:

No LLMs for issues.

No LLMs for pull requests.

No LLMs for comments on the bug tracker, including translation. English is encouraged, but not required. You are welcome to post in your native language and rely on others to have their own translation tools of choice to interpret your words.

The translation clause is the surprising one. It is also the one that disambiguates the policy from a code-quality rule. A blanket ban on LLM-mediated communication, including translation, is not a heuristic about whether agentic tools produce good code. It is a stance about what the project's communication channels are for.

Contributor poker

Loris Cro, Zig Software Foundation VP of Community and the author of the rationale post (April 29, 2026 — also discussed at Lobste.rs), gives the policy a name. The argument is short, and the structural moves are worth following carefully.

First, an empirical observation: "the reality of LLM-based contributions has been mostly negative for us, from an increase in background noise due to worthless drive-by PRs full of hallucinations (that wouldn't even compile, let alone pass CI), to insane 10 thousand line long first time PRs." The project has also seen, the post notes, "plenty of PRs that looked fine on the surface, some of which explicitly claimed to not have made use of LLMs, but where follow-up discussions immediately made it clear that the author was sneakily consulting an LLM and regurgitating its mistake-filled replies to us."

Second, and this is where the argument turns: the post asserts that the Zig project's normal answer to contribution overload is not to raise the quality bar. Cro writes that "we try our best to help new contributors to get their work in, even if they need some help getting there." The post explicitly frames this as the smart choice as well as the right one, because the project's primary investment is not the patch on the table; it is the contributor sitting across from the maintainer.

Third: LLM-mediated contribution breaks that arithmetic. Even a perfect LLM-mediated PR has the property that the time the maintainer spent reviewing it was not, in the structural sense, spent investing in a future contributor. It was spent reviewing, and only reviewing.

The metaphor Cro lands on — "In contributor poker, you bet on the contributor, not on the contents of their first PR." — is a tidy compression of the argument. The argument is not that the cards are bad. The argument is that the cards have stopped indexing the player.

Where other projects have landed

Zig's stance is on the strict end of a real distribution. Several other projects have published positions; the cluster of projects that ban LLM-authored contributions outright is concentrated in small-team systems software with high review-investment-per-contributor, but it is no longer a one-project pattern.

Project Stance on LLM-authored contributions Mechanism Stated reason
Zig Total ban on issues, PRs, and comments (incl. translation) Code of Conduct clause: Strict No LLM / No AI Policy Contributor cultivation: reviewing LLM-mediated PRs does not invest in future contributors
NetBSD LLM-generated code presumed tainted — not committable without prior core-team approval Commit Guidelines amendment, May 2024 License-compatibility risk: BSD codebase exposed to GPL or other incompatible-licensed training data
Gentoo Forbids contributions created with the assistance of natural-language AI tools Council motion of 2024-04-14, passed 6–0 (one absent), proposed Feb 2024 by Michał Górny Copyright, quality, and ethical concerns; explicitly preemptive, not in response to an incident
curl Bans AI-generated security reports; HackerOne program closed entirely on 2026-02-01 in favour of direct GitHub disclosure Daniel Stenberg's policy updates over 2024–2026 AI-generated reports were ~20% of submissions but produced zero valid vulnerabilities in six years of monitoring
Apache Software Foundation AI-assisted contributions allowed with disclosure Generative Tooling Guidance — Legal Affairs Committee Pragmatic neutrality plus license-clearance: AI-tool output must not be copyrightable subject matter; commit messages should carry a Generated-by: provenance token

The reasons line up across two axes that each project weighs differently. NetBSD and Gentoo emphasise the license-compatibility risk: the concern is that the model has trained on incompatibly-licensed code and might emit it. curl emphasises the volume and signal-to-noise economics of unsupervised AI-generated reports against a small maintainer team. Apache emphasises the legal-clearance pathway and assumes the project can absorb the disclosure overhead. Zig's argument is the only one of the five that is primarily about what reviewing is for, and it is also the only one with the translation clause.

The 2026 argument

The HN thread on the rationale post drew 415 comments, and the structure of the disagreement has settled into a recognisable shape. The strongest pro-policy argument that has come out of testimony in the thread, and from related discussions, is one an HN commenter relayed from a colleague: "We do not need a middleman to talk to AI models. We are not bottlenecked by coding." If the maintainer's bottleneck is reviewing, and the LLM-mediated PR concentrates the reviewing cost without distributing the contributor-development benefit, the asymmetry is structural rather than contingent.

Several variations were aired. One commenter argued, on the structural point, that in any real workload with good processes, code review makes the speed of code generation a moot point. A second made the corollary observation: an LLM that produces code cannot substitute for the verification step, because the verification is where the review-load actually lives. A third, agreeing with the policy in spirit but disagreeing on scope, framed AI as assistive technology — comparing it to a screen reader or a robotic exoskeleton that lets people who otherwise could not contribute become contributors at all.

That last argument is the live one. It is also the one Cro's post does not directly engage. The post is explicit that the policy will produce false negatives: it will reject contributors whose use of LLMs is exactly the careful, iterative, verification-heavy use that the post itself acknowledges produces good code. The policy chooses the false negatives anyway, on the grounds that the contributor-investment problem the project is solving is better served by accepting them.

The crisis-mode reading

One commenter offered a reading worth pausing on: that contributions to free and open-source projects were already in "borderline crisis mode" before LLMs arrived, and the policy is the answer of a project that has done the math on how many active reviewers it has and how many real contributors it can plausibly cultivate per year. From that reading, the policy is not a stand against LLM correctness; it is a triage decision under a constrained reviewer budget.

Another, sharper, reading came from a commenter making the long-term case against: that the next generation of developers will, for better or worse, grow up using AI assistance to write their code, and that none of those developers will ever become Zig contributors under a policy that bans the assistance from the start. The policy may win at contributor poker in the short term, the argument runs, and lose at it on a longer horizon.

Both readings can be right. The question is which becomes load-bearing first.

Coda

The Zig policy is most precisely read not as an anti-AI policy but as a contributor-cultivation policy that happens to forbid the input class most likely to produce contributions that don't grow contributors. Whether the policy is right depends on what the project is for; reasonable projects can disagree about that, and several do, and they are starting to write down which.

The diagnostic over the next eighteen months is whether other mid-tier projects publish similarly reasoned policies — Cro-style arguments grounded in what the project is doing with its reviewer budget — or whether the field instead settles into vibes-based defaults on either side. The Bun-Anthropic-fork story is a small first sample of the new genre: a contribution offered, a policy invoked, a separate engineering reason left politely unspoken. The interesting question is not whether Zig is right. The interesting question is which other projects are now obliged to write down the policy they have been operating without one.