PR spam today looks like email spam in the early 2000s(greptile.com) |
PR spam today looks like email spam in the early 2000s(greptile.com) |
People spamming Open Source repos with AI PRs aren't trying to help Open Source, they're trying to build a brand, some kind of credible online presence with their username on it, or whatever else. It's purely selfish and completely opposite to the spirit of Open Software imo
I am certain many of them honestly believe that they are doing the right thing and that they are helping. After all hey, they implemented a feature or fixed a bug for the community! It's a grim worldview if you think they are all just selfish.
I wonder if hiring adjusts to that but I doubt it. It might only push it even more towards "marketing matters most" instead of actual ability.
I think most AI generated code is people that want to help the project, but maybe aren’t familiar with the standards and norms.
Measuring open source contributions as a way to judge prospective employees used to be a good measurement.
Of course, prospective employees started to not only contribute to OS projects because it was good, but to make sure their contributions were high and noticeable — contributing not for the good of the project but for their own good, and now with amplification of AI 'contributions'.
So, measuring contributions to open source projects is now approximately worthless for evaluating prospective employees.
I wonder how long it'll take before "I don't use LLMs for coding" carries weight.
If the maintainers are that tired of it, they should update OpenClaw to prevent it from submitting PRs to their repo.
Could be used as a teaching experience that many maintainers would be happy to participate in, instead of feeling attacked with random low quality PRs.
I much prefer a blanket ban on PRs and issues created by AI agents (which is what I personally do for my repos; so far I have closed one[1]). In fact I would love a github alternative which considers AI contributions to be a breach of their terms of use and ban any people who let AI agents loose on their platform.
1: https://github.com/runarberg/markdown-it-math/pull/48#issuec...
Personally I just stopped accepting public contributions entirely. File issues, sure, but no PRs apart from accounts I added who have contributed before the slopageddon started.
Maybe the whole web-of-trust idea will make a comeback for code contributions, it seems like a clean solution.
I think the comparison to email spam is apt. The answer to that problem was automated spam filters.
Imagine the difficulty you might find interacting with the world if your inbox was set up such that all emails not literally written by a human were auto-deleted. No account recovery, no receipts, etc. Individuals might choose to do that for themselves but it's not the general case answer.
For example, a github cicd automerge pipeline is still good.
LuaJIT has operated this way since 2012, though with a thanks and mention in the commit message. It seems like a good way to filter out people who prioritizes leveling up their github profiles.
Something a little bit similar, when I was hosting a social game server we had mods. And players always beg for mod status. At first I tried naming the admin group something weird like sandals, but eventually people would ask if they could be sandals too.
What worked best in the end was just hiding it completely making regular players see mods as other regular players. (mods would see who is a mod though)
I would also personally never make someone who asks a mod as it's almost always a sign of wanting power for the sake if it. I would instead just passively observe behavior until I trusted the player and make them a mod. I would then tell them that I don't expect them to exercise their power, but would demote if I see abuse of power.
Some can fix real issues, with a well targeted fix (not rewriting the world), well defined test and write up. If you accepted PRs before for other issues, you should be able to review and accept those too.
It may happen on smaller projects with few users but not in meaningful large projects.
Building a brand doesn’t require submitting to someone else’s open source project. You can do the same thing by creating your own OSS project.
For a lot of them it’s probably a little of column A and a little of column B.
If people are submitting in their real name it’s more likely they’re building a brand. I also think it’s possible for someone to genuinely think they are helping without trying to build reputation.
yeah but, did they really?
All IMHO of course, but:
If they understand what they did, it follows that they understand someone has to approve/disapprove that contribution for it to land in the repo, and therefore, size their contributions accordingly to make reviewers lives easier.
If they do not understand what they did, they should not be attempting to land high-value high-complexity contributions yet; they should start with something smaller precisely so they can learn.
Edit: I realize I probably sound too grumpy about it, its just that they could be doing it in their own project, in their own repo, where they're free to go for anything they are comfortable with.
Think about it from the perspective of a non-programmer, or even total non-technical person. Vibe coding to someone like that looks like complete magic. Suddenly to that person, a whole new world has opened up. Ideas, features, bug fixes they've always wanted but could never do now look possible. That particular group of people don't see it as spamming the maintainer, they genuinely feel like they're finally able to help.
Tech hiring/interviews have almost nothing to do with assessing the candidates' ability to do the job.
Now that Claude is the best leetcoder in the world it would be great if companies which intend to hire humans would reconsider asking such dumb questions.