Some good questions in the comments:
What does “written by” mean? Who defines authorship? What does “mostly” mean? Who defines ratio? Is this going to be enforced in practice? Who is going to enforce it? Based on which reporting?
this post was submitted on 22 Jul 2026
313 points (99.7% liked)
Programming
27857 readers
265 users here now
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Rules
- Follow the programming.dev instance rules
- Keep content related to programming in some way
- If you're posting long videos try to add in some form of tldr for those who don't want to watch videos
Wormhole
Follow the wormhole through a path of communities !webdev@programming.dev
founded 3 years ago
MODERATORS
Yeah, this makes sense. They won't be able to kick every vibecoded project off, but it gives them a rule to point to when they do find and remove slop.
Some of the commenters on the Codeberg issue are expressing concerns about copyright status, but my main concern is security issues with these projects, which I have expressed before. Somebody vibecoded a script to sort files? I don't really care.
Someone vibecoded a network facing application, shipping a docker container, and is trying to encourage people to deploy it? If I investigate, and see the bad security practices common to vibecoding, I wouldn't want to be providing that for people to download. Even though I'm technically not responsible for it, it just doesn't feel right to host something that could explode later. I would want to be able to take it down, and having a rule to point to prevents complaints when Codeberg does so.
while I agree with the sentiment. what if someone just sloppily hand-coded an insecure docker container, should you be able to kick that off too? I fear security isn't a good baseline to decide if a project should be hosted because security is a gradient and it becomes very subjective to say what constitutes secure. following that, would you give remediation opportunities for hand-coded insecure projects? It's a can of worms.
I would argue that they can argue it purely from a capacity perspective.
They can estimate the scale of handwritten code growing over a period of time, but not the scale of AI written code scaling, meaning their platform cannot anticipate the scale and therefore it is unsustainable. And at that point the scale of security awareness as a whole can be considered, e.g. "how many attack surfaces, e.g. repos, are we hosting?" vs "how many of our repos are insecure?"
what if someone just sloppily hand-coded an insecure docker container, should you be able to kick that off too?
I can talk to them and have them fix it without them being weird about it. But if they don't understand the poor design decisions in the first place then I have no confidence won't be able to actually fix it, and keep it fixed in the future.
It's fuzzy, and many generalizations are gonna be made.
Ultimately, it really comes down to human judgement and not your instance not your rules. They are hosting for free. They don't have any obligation to host your projects. The rules and everything are nice conventions, and a good attempt at transparency, but at the end of the day, there is someone with access to the admin panel who is going to make the decisions, and you're not really going to be able to do anything about them.
It's the same thing with lemmy tbh, although it's less annoying because it's much easier to self host and migrate to Forgejo, as opposed to hosting Lemmy. That's why I phrased it as "I would feel uncomfortable hosting this content" rather than trying to address the fuzzier arguments about the necessity of human judgement, the difficulty of detecting LLM generated code, or the possibility of incorrectness.
Hot take: I don't like this. It states a rule, but the line is vague.
How is vibe coding detected? How much is too much? How does this apply to my personal vibe coded util™? Does this apply to private repos?
The rule feels ill defined while the consequences are quite extreme.
I think in practice they are saying that any shit that happens cant be blamed on anything but the submitter.
You can already make a project out of copypasted bits of code. So long as you understand what they do, vetted and vouch for it...it's fine, no?
The change feels like a slippery slope where it could be easily abused if there's enough incentive. Like the DMCA (I think that's the acronym) process on youtube or github, or etc.
Maybe you're right, time will tell.
I'm perfectly happy with this.
Why?
Because at the end of the day, the users of the code forge can be broken up into three categories:
- Traditional coders with human made projects
- Vibe-coders who slop out 100 throw away projects, each of which is a dead project as soon as that user moves onto the next project
- Vibe-coders who focus work on only a single project.
Category 1:
- Code forges were already valuable before LLMs, so we already have a proof of value/utility/whatever for hosting projects from users in category 1.
Category 2:
- Projects from the users in category 2 have a half life of a couple of weeks.
- They're so quickly made that most of their contents is going to be rehashes of previous existing content, so there's a reduced value holding on to them as reference when the original sources exist.
- Since they were generated so quickly, a more up-to-date version can be generated in the future if they're ever needed again.
- Since the projects aren't going to be used by others, they don't actually use the features of a code forge, so it's not a great idea to allocate so many resources that aren't going to be utilised to host them on a community code forge. A better place for them would be cloud storage (dropbox, google drive, etc...). Most cloud storage services have a free tier. Anyone with a crazy amount of projects and assets that would exceed free tiers and who just wants to hold onto the projects for the future can use something like S3's glacial deep archive which is about $1.20USD a year to hold onto 100GB of zipped up projects.
Category 3:
- These projects may actually get used by people
- Since they're developed with LLMs, there's so much churn that there's no actual point of reading the code since it's quickly out of date. That means there's no use for using the code forge's source file features
- Issues that reference code will go out of date as soon as the code goes out of date which is far more likely than with category 1 users.
- These projects tend to have so much code churn that their builds are more inefficient than hand coded projects. This means that they'll tend to want more powerful hardware to run their CI/CD pipelines than a community code forge can provide. So from their perspective, they're better off running their own code forge anyway.
Keeping category 1 users on community code forges, saving the code forge's resources from being used by community 2 users, and letting community 3 users tailor their own code forges for their own needs seems like a win for everyone actually using the community code forge, and not those treating it as a file dump.
While there are cases, when the garbage nature of genAI code wouldn't cause that much of an issue, the issue will be that these projects ultimately will drive attention away from human-made code, which can have devastating effects on said projects.
I don't really understand that line of reasoning. By definition if genai code is garbage, a human made competitor would be better. Why can't it stand on its own qualities rather than rely on blanket banning the alternative?
I think it's a matter of volume, it's extremely easy and quick to publish large amounts of generated code, and by far most people won't go searching your codebase in depth to see if the code is decent, if it works as advertised they don't have a reason to look into it further. If you add a third party to vet all code then you're still giving massive amounts of work to whoever has to review the mountains of slop.
It's not like we didn't have an issue like this before, about people copy pasting without understanding anything, but these tools made it more accessible and streamlined, and the worst part is that vibe coders believe sharing their slop is of value.
How the hell does a user see a voting like this? I'm using Codeberg for quite a while and reading here something like "vote closed" is weird to me.
Now I'm not talking about the content of the core itself here.
Are you a member of Codeberg e.V.? Votings are exclusive to members AFAIK, and get announced via mail.
Correct. Membership to the nonprofit Codeberg e.V. is 24 Euro a year (potentially less if you request a discounted rate and are approved). You will be supporting Codeberg's mission and can optionally take part in these discussions and votes. There is an organization on Codeberg you'll be added to where discussions occur and then vote notifications are sent out by email.
See also: what is codeberg e.V.?
I applaud this at least in theory. As others have pointed out this may prove thorny to implement. But, I love the sentiment and hope it goes well for them.
Seems reasonable but good fucking luck enforcing that.
IMO they should instead simply charge cost price for hosting. It can't be much surely?
I don't think the cost of hosting the repositories itself is the issue, more the legal problems and the fact that real projects get drowned out by the noise
Did Codeberg even have a slop repo problem?
I can't imagine a person who chooses to use Codeberg will be bad at utilizing LLM's in any case, especially since SlopHub is right there for the worst sloppers to publish in and maybe win some fake points.
This just feels like some people couldn't stop themselves from doing some posturing!
Considering AI generated code is public domain, so not exactly open source licensed, this is a good move.
Should users who don't self-host start recording themselves while coding just as a precaution, in case their host will ask for evidence of work authenticity?