On Tools and Tempests: What TYPO3 Might Learn from a Kernel Argument

Linus Torvalds does not write often anymore, at least not with the old ferocity. So when he does, people notice. Last week, on a thread about linking Patchwork with an AI-assisted maintenance tool called Sashiko, someone raised a familiar worry: that the drift toward caution around AI contributions was quietly becoming a drift toward rejection. Torvalds answered the way only a founder with three decades of unquestioned authority can. Linux is not an anti-AI project, he said, and if that troubles you, fork it, or walk away. AI is a tool. Whether it is useful is no longer a question worth asking. The only real question is whether we make it help the people who maintain the project, or let it become one more source of pain.

It is tempting to read this as a Kernel story and move on. I think it is worth sitting with a little longer.

Not long ago we had a message that echoed Torvalds’ framing, though with none of his certainty. He was not complaining about any one person. He was naming something quieter and more troubling: that nobody in the core was particularly excited about AI, that the caution had good reasons, and that the shared instinct that this, too, shall pass might be exactly what costs the project its future relevance. A REST API sturdy enough to enable MCP integration is not a moonshot. The technical foundations- DataHandler, reactions, webhooks, existing headless extensions- are already there. What is missing is not capability. It is a decision.

Here the difference between a kernel and a CMS association is instructive rather than incidental. Torvalds can simply decide, because Linux has one maintainer at the top and always has. The TYPO3 Association is a different kind of body, a registered nonprofit with an elected board, built so that no single voice declares a technical direction by fiat, however well-intentioned. That is not a weakness. It is the shape of the thing we chose to build, and it comes with its own obligation. We cannot decide the way Torvalds decides, but we still have to decide, only through the mechanisms we actually have.

Which is why I think this thread should end with an RFC, not more back-and-forth on Slack. Not because the debate needs to be silenced by decree, but because a community that keeps having the same unresolved conversation is spending its energy on the wrong kind of friction.

An RFC gives the question a place to live, a named owner, a timeline, and an actual decision at the end. What we take from Torvalds should not be the tone. It should be the discipline of treating usefulness as settled and channeling the real energy into how the tool is integrated so it helps the people doing the work, rather than adding to their load.

So where does this RFC start?

https://lore.kernel.org/all/CAHk-%3Dwi4zC%2BZe8e%2Bp3tMv8TtG_80KzsZ1syL9anBtmEh5Z40vg@mail.gmail.com/

Are there already licensing issues cleared up? If we use AI tools to add algorithms that might be incompatible to our license? Do we need contributor agreements that vouch they hold a copyright?

i think this needs to be tackled before we can say “use it” or “you must not use it”.

We could also say “use it to review bugs, explain code - but do not use autogenerated code”. Or we might need constant lawyering to check which pieces of code are non-licenseable.

(This is especially important in terms of CRA and maybe also the TYPO3 Suite partner-licensing)

I have a draft idea here. TLDR; DR: It’s the contributor who will certify that the code has been vetted by him. But let us assume we can use AI as a tool, such as an IDE with code completion.

I have some ideas on an emerging standard called git-ai and extended code sign-off. But I am curious about how to start the RFC in our community.

Such an agreement of course will be a barrier compared to today, but I guess we’ll need it now.

I disagree that LLMs are like IDE autocomplete: IDEs autocomplete based on algorithms on a CODE insight basis. It’s reproducible and sound and only uses what’s available.

OTOH LLMs autocomplete from a body of preexisting code, all mangoed together, pure “stealing” without knowing where it came from exactly. That must be taken into consideration.

AI-assisted != LLM. Can be a specialized MCP querying Code Graphs. Knowledge Databases or whatever comes to our minds.

How do we guarantee this now? As we do not have a CLA (Contributor License Agreement). The Commit Message needs an update, too.

Understood, indeed. I’d argue though most people lean towards focussing on LLMs.

To my knowledge there is no RFC process for us in place. It comes up every now and then, so maybe now is the time to establish it. Ideally as part of the unit restructuring to establish new team rules.

Quickly weighing in here. Regarding the two different points addressed in this thread:

  1. We (as Association Board) have already been asked about a statement regarding license compatibility of AI generated code. This statement will be published together with the minutes of the last Board meeting (I’ll post the link here). That being said, it’s “just” a position statement, and not any kind of solid legal advice (neither of us is a lawyer, after all).

  2. For Association policies, we’re currently already in the process of adopting a Git-based governance workflow in the TYPO3-Documentation/Policy repository (which you @ghi might’ve noticed :winking_face_with_tongue:; thanks for helping out with the GitHub access rights). This policy defines how decisions are documented (as RST files in the repo), who owns certain documents and what kinds of changes require which kind of approval processes (for example, a “simple” Board majority decision or a General Assembly vote).

    Right now, this is an (until now) Board-internal process, which we’re now executing in the public. However, in practice, that same workflow will (and should) also work for policy changes initiated by the community: open a PR, discuss and refine, document the decision by the owner, merge.

    If that works out, I’m hoping that we might use that process as template to offer to other teams (or units, in the future), or even propose it as a cross-unit workflow. For inspiration, one could also look at at how other Open Source projects do this; Kubernetes for example, has a similar Git/Pull Request-based workflow; in the end, each RFC is just a markdown file, and the acceptance of a proposal is decided via Pull Requests. Doesn’t have to be all that complicated.

Here’s the link to the TYPO3 Policy approval thing, btw: [TASK] Implement T3A Board policy for policy+bylaw change approvals by martin-helmich · Pull Request #45 · TYPO3-Documentation/Policy · GitHub

First of all: I’ll follow whatever will be decided. Still let me add my own personal opinion, which you don’t need to like or follow. But the dialogue day showed me we need to speak up and listen to each other.

For me, it is mostly about: Ethics and Environmental impact. Does TYPO3 want to be built with something that’s leading to a faster destruction of our own world? Does TYPO3 want to be built on something unethical? For me the entire AI topic is unethical and destroying our world way faster than we do anyway. That’s the two main reasons why I still refuse to actually even give AI a try.

We do open source, we say we want to respect people ( https://docs.typo3.org/permalink/guide-policy:coc-basic-rules ). This is also political, this is about humans. If I’m not mistaken @oli4 also said we should think broader than just TYPO3, we should think about humanity and our impact in the world.

Using AI has an impact, it says: We are fine with the companies that build the “tools” and how they build them. And I’d like to say no: We are not fine with that. And we are also fine with destroying our own environment for ourselves quicker. It is okay to destroy islands and lives. Which I find strange for an open source project that want to expand in the world.

We should also respect that there is a huge community out there that is against AI, e.g. take https://codeberg.org/ethical-foss/open-slopware .

Anyway, I’m happy if there is a decision, and we can focus on other things than to think and discuss this topic. But maybe this topic will come up anyway from time to time, as things might change and need a new decision.

Also in the end: You never know if any contribution was done with help of any AI. So the decision made by TYPO3 as project will mainly be a statement and impact how others think about AI. And some might follow the decision and contribute or not contribute with help of AI. But some might just not care, maybe not even read the decision, and contribute with or without AI anyway.

One addition: TYPO3 itself is suffering from the AI landscape, maybe Server Team has more concrete insights. But it seems the ydeploy Anubis to block AI scraper on various parts of our own infrastructure, e.g. see: Slack and some meeting minutes. Anubis right now seems to be deployed in front of:

So we as TYPO3 already fight against AI scrapers.

So TYPO3 would, if it allows AI contributions, somehow say it is fine to increase the resource usage and pressure on our own infrastructure, as well as everyone elses infrastructure.

I second that we need to look at ethics as well. Is it compatible with TYPO3’s values to contribute and profit from an industry that is incompatible with keeping our earth inhabitable? Or, as a data center lobbyist put it: “Europe must choose between AI and climate goals

I’m not a developer, so I won’t weigh in on the technical or licensing questions others here are far better placed for that.

But I want to raise one procedural point, because I think it matters for the legitimacy of whatever gets decided.

A decision like this (one that effectively determines whether AI-assisted contribution becomes normalized in TYPO3) should not be settled by the handful of us who happen to be active in this thread. We all need to get more people to take part in this discussion.

So before this moves to an RFC and a vote, I’d ask that we deliberately reach out and make contributors aware of it: post it where core, documentation, extension and server teams actually look, name it in the relevant channels, and give people a real window to respond.

My only ask: make the participation as broad as the decision is consequential. Actively invite, don’t just leave the door open.

I second what @layne.obserdia wrote: For me, using AI is not only a technical decision. If we discuss this as a community and want to reach a consensus, the political and ethical factors need to be part of the discussion.

Over the last few months, LLMs clearly became much better at writing code, however at the expense of rising power usage, chip shortages, job loss and severe environmental impacts (to only name a few). I personally am not strictly against AI usage, but TYPO3 should acknowledge that our actions have consequences and that we should at least think carefully about where and how we deploy LLM-based solutions. I see a lot of areas where AI is used just because our deterministic tooling isn‘t good enough, which from my point of view is a waste of resources and should motivate us to focus on these areas (maybe even with help from AI).

Building on my earlier comment: We’ve now released our statement on the license compatibility of AI generated code (disclaimer: this is not legal advice and just reflects our standing on this matter on this specific point in time; meaning that it may also change in time).

We’re also been working on a draft for a broader “Policy on AI-generated code” for a while now, which I’ve just posted as a draft PR in the Policy repository to allow for early community review and comments. At the moment, this policy draft takes a rather permissive stance (focusing on providing provenance using a Developer Certificate of Origin and disclosure using lightweight Git commit annotations), but that’s all still open to discussion.

While I (personally) am unsure if outright forbidding AI usage is the right way to go, I greatly appreciate the ethical and sustainability aspect (thanks @ghi, @layne.obserdia, @oliklee and @s2b), which I think may be possibly coming a bit too short in our current draft. I’ll see if we bring that aspect in there somehow (might ping you for a review :wink:).

My suggestion would be to create a second track on advising on the ethical and ecological use of AI.