the BSDs in the AI Age

[Edward Capriolo]

On Tuesday, April 7, 2026, Raúl Cuza <rac at conpocococo.org> wrote:

> On Thu, Apr 2, 2026, at 09:14, George Rosamond wrote:
> > I want to initiate a thread on the "BSDs and AI today."
> >
> > A few things first.
> >
> > There are many levels to this discussion, and for the sake of clarity
> > and sanity, please top posting. All replies should be inline.
> >
> > This is useful:
> > https://subspace.kernel.org/etiquette.html#do-not-top-post-when-replying
> >
> > I'm looking to do a presentation on this in the summer for NYC*BUG.
> > There hasn't been anything in our community which provides the
> > high-level overview of the impact of AI, covering things from the impact
> > on the BSD operating systems to the impact on $job, etc. Hopefully this
> > thread can provide some raw materials, and become an outlet for
> > individual experiences and more general views.
> >
> > I initiated a similar fruitful (but private) discussion for another
> > open-source project, and think it's high-time for us to do the same on
> > a public list.
> >
> > ***
> >
> > There's a few layers to this discussions. Note these are discussions
> > points, not "Yes" or "No" surveys.
> >
> > * How are LLMs (big tech or otherwise) impacting $job now? Are you using
> > Claude Code or similar tools for day to day? Was it required or was it
> > your choice? Was there expectations from this tools in terms of
> > productivity, etc? This question raises the impact of AWS Bedrock/Kiro...
>
> I have heard companies that talk about these tools as enabling 1000x
> developers. The wise ones still see LLM use as experimental, but enough
> people have produced production ready code in record times that every
> developer is expected to join the experiment.
>
> To go on a tangent about people becoming unnecessary... I don't think
> technical people will become unnecessary. As stated in other answers,
> coding agents need people to give them the feedback that what they are
> doing is what is required. Whether it is in Rust or a series of precise
> project specifications and test requirements, someone who understand the
> problems needs to be involved. As a 2016 cartoon put it, "Do you know what
> the industry term is for a project specification that is comprehensive and
> precise enough to generate a program? Code." [
> https://www.commitstrip.com/en/2016/08/25/a-very-comprehens
> ive-and-precise-spec/?]
>
> So, to answer your question, the expectation is to use LLMs but also to
> still get things done. This is stressful, but similar to the stresses of
> how to be a SysAdmin to 10's of thousands of servers as opposed to 10's of
> servers.
>
> > * Should BSD projects have explicit LLM-focused policies? Look at the
> > 2nd point in the NetBSD "Commit Guidelines" at
> > https://www.netbsd.org/developers/commit-guidelines.html. OSS-Security
> > already discussed the issue with alleged CVEs discovered by people with
> > LLMs trying to stack their resume with credentials.
>
> I don't agree that code from LLMs is tainted, in the licensing sense of
> the word. I think it is completely public domain, but that is my opinion.
> What comes from an LLM is a generalization of all the different things that
> were inputed into the models. It is very rare that the input comes out
> unaltered and unprocessed. That is why I think it is something new.
>
> Now the legality and morality of how the LLMs were built is another
> matter. One I will opt to not discuss at this time.
>
> I do agree that each BSD should adjust their policies in so far that LLMs
> will change the volume and nature of code submitted to them. Existing
> policies will probably be challenged by these changes. The policies should
> get ahead of problems as much as they can.
>
> > * How should the BSD projects themselves be using LLMs? Integration in
> > the shell (oh, please no...)? Porting of APIs for big tech LLMs?
> > Utilizing LLMs to discover bad code, CVEs, undiscovered vulnerabilities?
>
> I think LLMs can offer hackers relatively inexpensive ways of fining novel
> bugs, zero-days, and chained vulnerabilities in any code base. BSD projects
> should do this work themselves and fix the problems as best they can.
>
> > * How should individual developers and users consider LLMs as tools for
> > contributing to the BSDs and other open-source projects? I happily used
> > a big tech LLM to deal with an rc file for some very Linuxey software
> > wrapped up in systemd clutter.
>
> LLMs are great at "talking to a code base". I think LLMs will make it
> possible for individual developers to hack on BSD and other open-source
> projects in novel ways.
>
> I don't think BSD projects or any developer should become 100% reliant on
> LLMs though. As others have stated, these models are dependent on large
> corporations that have nothing FREE about them.
>
> I would love to see local models that run on BSD on a PC get to the point
> that they can create the sense of coding in the same room as Guido can
> Rossum or Stephen Bourne. But I have not dived that deep into AI tooling to
> know how realistic that is.
>
> - r
>
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297698

https://github.com/edwardcapriolo/edgy-ansible/blob/main/releases/trusted-
opencode-0.0.3-airlock.md

I do a lot of ai aided development. The freebsd port above was made almost
entirely by prompting. More or less i said, "i have this java inference
engine build me a port"

The question of how small can you go is an interesting one. Models that are
very small like qwen 06b generally can call tools, however they get easily
confused. For example, if you have a tool called calculator-add that takes
two arguments and instruct "Add 5 and 6 using the calculator tool" it may
not have enough intelligence to realize and instead try to answer with
prose.

For "chat with the code", I have a little rag tool. It will scan a
directory and load the files into the rag db. Then if you tell a model
"here is a rag tool. tell me about abc.java." It will search feeding the
results into the context and issue another prompt asking for a summary.

If you dont have a rag tool. It might realize it had a shell and run 'find
. -name abc.java'. If it finds something it might be clever enough to run
javap and print rhe headers of every class/method.

Openai can brute force it. It isfaster and can hold a bigger context maybe
it does it in 20 seconds ith no rag db, but ends up costing 10 cents.

The problem becomes feedback loops. If you generate a port how do you know
it works? You have to run it. It has to be smart enough to run it. If it
and it produces 500 lines of output. It has to be smart enought to
interpret the output.

Also it becomes a drug. My goal was a port, I dont like makefile writing,
The model did it all. I guided by saying "Do it like the other java ports
so it wont get rejected". Tell me what that means for "copyright" :)i had
the clever idea of having the make test bring up the model and write the
blurb about freebsd and ai.

I can have the ai review my port again and again. I can have the ai write
comments to the bugzilla begging for review. Hence the "drug problem" there
isnt actually anything for me to physically do if I want to pay the problem
away and have my agent so it. I can Turtles all the way down the problem, "
use mcp tool take over my browser and ask for review"

In the old days, I would have to spend days making the port. Now, it took
me about an hour. Same old problem: stuff sits on the queue waiting for
reviewers. My costs are lower i get less worked up since I didnt blow two
days of my time. (dont take this as a review process criticism)

You dont need ai to find "zero day bugs". Honestly ai creates more then it
finds. Even the best models seeded with " best prompts and skills" fail to
create unit tests fail to writing documentation even though I say to
clearly.

I use the ai to write my inference engine. It wrote code that loaded
tensors in gpu. It never thought to unload them :). After running for one
and a half prompts it exploded. 6 crazy iterations later, I helped it come
to thr conclusion that the gpu only has 8192 tensor slots. After that it
wrote an eloquent description of what it missed and used 6 cents of tokens
for an apology.

This is ai. You can have it to everythibg or nothing. They problem of
having it do "everything" is not miles of code to review. For me I become a
hands off manager. "Make that method "  "run that test" "Write the entire
kernel in c++". You can go outside and go for a walk you dont feel very
connected to the result.






-- 
Sorry this was sent from mobile. Will do less grammar and spell check than
usual.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.nycbug.org:8443/pipermail/talk/attachments/20260829/4665dec6/attachment.htm>