Re: Linking Patchwork with Sashiko?

[Laurent Pinchart <laurent.pinchart@ideasonboard.com>]

Hi Roman,

On Wed, Jul 15, 2026 at 09:08:47PM +0000, Roman Gushchin wrote:
> Laurent Pinchart writes:
> > On Tue, Jul 14, 2026 at 07:00:54PM -0700, Roman Gushchin wrote:
> >> On Jul 14, 2026, at 5:59 PM, Laurent Pinchart wrote:
> >> > On Tue, Jul 14, 2026 at 10:55:42PM +0000, Roman Gushchin wrote:
> >> >> Mauro Carvalho Chehab writes:
> >> >>>> On Mon, 13 Jul 2026 12:41:20 +0300 Laurent Pinchart wrote:
> >> >>>>>>> Individuals can set their
> >> >>>>>>> spam filters up if they don't want to get these emails, I can't control
> >> >>>>>>> it. Providing individual authors an option "I don't want my patches
> >> >>>>>>> to be reviewed" sound strange to me. It's like "I don't want my patches
> >> >>>>>>> to be tested by unit tests".  
> >> >>>>>> 
> >> >>>>>> I agree with you, and, on my head, not sending e-mails to the author
> >> >>>>>> is a clear violation to one of the most basic net etiquette rule on
> >> >>>>>> mailing lists: any replies to posts there should reach the author.  
> >> >>>>> 
> >> >>>>> I don't know where that one comes from.
> >> >>>>> 
> >> >>>>> What happened to this other "most basic rule" that subscription to
> >> >>>>> services that deliver e-mails should be opt-in ?
> >> >>> 
> >> >>> Replying to an e-mail is not subscribing to a service. It is the
> >> >>> author's right to know if one replies publicly to his e-mails.
> >> >>> Explicitly removing him from the C/C of such replies is a violation
> >> >>> of his rights.
> >> >>> 
> >> >>> On other words, it is implicit that, if you post an e-mail, you'll be
> >> >>> expecting actions or answers to it.
> >> >>> 
> >> >>> Now, if one really doesn't really want to receive e-mails from a
> >> >>> particular sender, a block list solves it. Alternatively, a way to
> >> >>> opt-out is welcomed.
> >> >>> 
> >> >>> See, this is different than adding someone to a mailing list without
> >> >>> his consent: On such case, people receive e-mails unrelated to their
> >> >>> preferences. For those, opt-in is the right net etiquette.
> >> >> 
> >> >> I agree with this.
> >> >> 
> >> >> But also just practically: if someone who opted out from sashiko emails
> >> >> posts a patch and sashiko finds say a critical issue, do we expect the
> >> >> maintainer to go and manually check each time whether the author opted
> >> >> out and forward the review?
> >> > 
> >> > I expect maintainers who want to act on sashiko reviews to triage and
> >> > verify them first before bothering authors, yes. I believe we should
> >> > follow the first two recommendations of the Software Freedom Conservancy
> >> > on using LLM-backed generative AI systems for FOSS contributions ([1]).
> >> > 
> >> > [1] https://sfconservancy.org/llm-gen-ai/llm-backed-generative-ai-recommendations.html
> >> 
> >> I think it makes the point of sashiko - helping maintainers -
> >> unachievable.
> 
> Hi Laurent!
> 
> > Why do you think so ? As far as I can see, there are many maintainers
> > and contributors with a strong enthousiasm for generative AI reviews.
> > Assuming those tools would give a net positive result, isn't that
> > initial mass sizeable enough to help maintainers ? It could even be
> > argued that starting with enthousiasts will help convince some of the
> > sceptics over time.
> 
> At this moment there are 36 mailing lists who opted in for delivering email
> reviews over email (without counting linux-media@). In every single case
> it was based on maintainers requests in all cases of a disagreement
> between maintainers I took the conservative side.
> 
> Also:
> $ git log next/master --grep=sashiko -i --oneline | wc -l
> 826
> 
> This is in less that 4 month since Sashiko's public launch mid-March.
> Most of this commits are bug fixes for existing issues discovered by
> Sashiko as a byproduct of reviewing new changes, so arguably there is a
> larger set of bugs which were prevented to enter the kernel.
> 
> So it's fair to say that there are lot of enthusiasts and lot of data
> already which proves the usefulness of AI code reviews. If it's not
> convincing, I'm sorry, but it's unlikely I'll be able to convince you
> anyway.

Sometimes I wonder where I fail so blatantly in my communication. Until
I figure it out, I'll restate what I think I said multiple times in this
mail thread: I know there are technical merits to the tools. I know it
can catch bugs, both preexisting and new. You don't need to convince me
on that.

I also know there are lots of enthusiasts, that's even clearer :-)

> >> If the point to not use LLMs in general, let’s discuss this, not how
> >> to make each use case more complex.
> >
> > To be clear, that's not what I'm calling for. I'm asking for
> > contributors to not be forced to use LLMs. I'm not campaigning for the
> > kernel to ban their usage.
> >
> >> It seems like [1]  expresses a very anti-LLM position in general, which I can understand and I agree 
> >> with some of concerns. But I think it’s up to project leaders to decide if Linux in general  takes this 
> >> position and my take so far is that the answer is not.
> >
> > I would be surprised if Linus broadly agreed with [1] :-) I however hope
> > that we, as a community, have enough shared values to listen to
> > everybody.
> 
> The reality is that there are multiple actors in the world who are
> actively using AI for at least the security vulnerability scanning across
> ALL Linux kernel codebase, including your changes. And it's completely
> out of our control (ours as kernel community). And we can't ignore these
> findings completely (how to handle them it's a separate discussion).

So far, no disagreement. As much as I dislike this situation, I have
never pretended to ignore the facts.

> So there is simple no way someone who wants to contribute their code
> to the kernel can pretend to live in the world where ai doesn't exist.
> So the real choice is more like do we want to find (most of)
> AI-discoverable issues before they get merged or after.

I think that's a falso dichotomy. I find it odd at best that the answer
of Google, who has high financial stakes in the AI race with Gemini, is
to present usage of a product based on Gemini as an ineluctable
solution. And yes, I know that in theory sashiko could use different
models, but I don't think that changes the problem fundamentally.

Where are the AI companies when it comes to addressing the massive
underfunding and maintainer burnout problem, to help doing the ground
work making the kernel more secure ?

> (Obviously not all issues are security-related, but it doesn't change
> the point).

-- 
Regards,

Laurent Pinchart