Live data from Hacker News

I don't want your PRs anymore

dpc.pw

101–110 of 148 posts

Re: I don't want your PRs anymore

#101

Yes, reviewing might take 1 hour but taking the PR and using it to guide an implementation also takes 1 hour. Thank your contributor; then, use the PR - and the time you’d have spent reviewing it- to guide a reimplementation.

My coworkers just let Claude review the PR now instead of reading the code. It seems the entire contract is broken now.

Submitters use LLMs to generate the code and reviewers use LLMs to review it.

Re: I don't want your PRs anymore

#102

Earlier quoted context omitted.

Neither are bug reports or feature requests.

bug reports should be reproducable. They may even be statistically reproduceable. A bug report that cannot be reproduced is worthless.

It is not worthless; that means you need to work on making it easier to detect and report bugs.

Re: I don't want your PRs anymore

#103
post #66

Earlier quoted context omitted.

Recently I've been air-dropped into such a legacy project at work in order to save a cybersecurity-focused release date. Millions of lines of open-source code checked in a decade ago prior to the Subversion-to-Git migration, then patched everywhere to the point where diffs for the CVEs don't apply and we're not even sure what upstream versions best describe the forks. By the end, the project manager begged me to turn…

> west manifest Zephyr-based project?

No, it predates it by a couple of decades.

But our modern embedded firmware projects all use Zephyr and west, so I just created a west manifest, stole parts of the scripts/ folder from the Zephyr repository to have a working "west patch" command and went to town. If I had more time to work on it, I'd have gotten "west build", "west flash" and "west debug" working too (probably with bespoke implementations) and removed the cargo cult shell scripts.

You can use west without Zephyr, it's just that by itself it only provides "west init" and "west update".

Re: I don't want your PRs anymore

#104

Yes, reviewing might take 1 hour but taking the PR and using it to guide an implementation also takes 1 hour. Thank your contributor; then, use the PR - and the time you’d have spent reviewing it- to guide a reimplementation.

My coworkers just let Claude review the PR now instead of reading the code. It seems the entire contract is broken now. Submitters use LLMs to generate the code and reviewers use LLMs to review it.

> Submitters use LLMs to generate the code and reviewers use LLMs to review it.

This just like my favorite, “We can use LLMs to write the code and write the tests.”

Re: I don't want your PRs anymore

#105
Bugs aside, code generated by an LLM is NOT more trustworthy than a drive-by PR, you should review them just as closely. The slop machine doesn't care, it will repeat whatever pattern it found on the Internet no matter who originally wrote it and with what intent. There have been attacks poisoning LLMs with malicious snippets and there will be many more.

Re: I don't want your PRs anymore

#106
post #76

Earlier quoted context omitted.

I firmly believe the author's stance should be the default policy of just about every open source project. I don't even write my own code anymore, I sure as hell don't want to deal with your code. Give me ideas. Report bugs. Request features. I never wanted your code in the first place.

You believe. So it applies to projects you maintain. It doesn't mean it applies to project I maintain, or anybody else maintains. So this shouldn't be any more default than any other mode. And probably less default, since people generally developed other conceptions about "defaults" of etiquette in open source projects over the last 15 years.

I'm not exactly disagreeing with you. I appreciate the author's stance, and I appreciate the blog post making it to HN. I think the author's stance should be widely adopted. If they had simply stuck their blog post into CONTRIBUTING.md in their repo, no one would have seen it. Now it's being more widely disseminated, and in a longer form with good reasoning attached.

Re: I don't want your PRs anymore

#107
post #91

Somehow, this seems like a serious negative consequence of LLMs to me. We should consider how security patches move through the ecosystem. Changes like this are understandable but only because PRs from LLMs are so bad and prolific. When a new exploit is discovered, the number of sites that require a change goes up exponentially due to LLMs not using libraries. At the same time, the library contributors will likely no…

Code changes are cheaper to make now and kind of more expensive to verify. So you can still contribute, you just not need to provide the code, just the issue. Which isn't as bad as it sounds, it kind of feels bad to rewrite somebody's code right away when it is theoretically correct, but opinionated codebases seem to work very well if the maintainer opinions are sane.

And if the maintainer doesn't understand something about how the exploit works? Also, code changes aren't cheaper, its just that you can watch YouTube instead of putting in effort now. But time still passes and that costs the same. Reviewing the code is far more expensive now though since the LLM won't use libraries.

PS The economics of software haven't really changed, its just that people (executives) wish they have changed. They misunderstood the economics of software before LLMs and they misunderstand the economics of software now.

PPS The only people that LLMs benefit are the segment of devs who are lazy.

Re: I don't want your PRs anymore

#108

Given that submitters are just using LLMs to produce the PR anyway, it makes sense that the author can just run that prompt himself. Just share the 'prompt' (whether or not it is actually formatted as a prompt for an LLM), which is not too different than a feature request by any other name.

Yes. At this point a prompt that produces the desired result is more useful than the resulting code in a PR. Effectively the code starts to have properties of a resulting binaries.

Re: I don't want your PRs anymore

#109
post #86
post #27

I think every maintainer should be able to say how they want or don't want others to contribute. But i feel like it was always true that patches from the internet at large were largely more trouble then they were worth most of the time. The reason people accept them is not for the sake of the patch itself but because that is how you get new contributors who eventually become useful.

> But i feel like it was always true that patches from the internet at large were largely more trouble then they were worth most of the time. Oh god, I needed to add a feature to an open source project (kind of a freemium project) about fifteen years ago. I had no experience with professional software development nor did I have any understanding of pull requests. I sent one over after explaining what I was trying to…

curious, what happened, and what did you learn?

if they merge something blindly, then it's really on them if it makes a mess.

Re: I don't want your PRs anymore

#110

If they are willing to feed a bug report to their LLM, then perhaps they can also feed a bug report + PR to their LLM and not make a big fuss out it. Also, at the point they actively don’t want collaboration, why do open source at all? Strange times, these.

If you read the post till the end, I am open for lots of forms of collaboration. Its just sending chunks of code diffs around is becoming increasingly like sending diffs to resulting binaries. Just inefficient.
Post reply on HN