Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PR spam today looks like email spam in the early 2000s

greptile.com

Post reply on HN
Print view View original

21–30 of 167 posts

Re: PR spam today looks like email spam in the early 2000s

#21

Post by margalabargala »

runarberg wrote: post #3

AI agents who review the slop created by other AI agents is not the answer here. I much prefer a blanket ban on PRs and issues created by AI agents (which is what I personally do for my repos; so far I have closed one[1]). In fact I would love a github alternative which considers AI contributions to be a breach of their terms of use and ban any people who let AI agents loose on their platform. 1: https://github.com/r…

I tend to disagree.

I think the comparison to email spam is apt. The answer to that problem was automated spam filters.

Imagine the difficulty you might find interacting with the world if your inbox was set up such that all emails not literally written by a human were auto-deleted. No account recovery, no receipts, etc. Individuals might choose to do that for themselves but it's not the general case answer.

Re: PR spam today looks like email spam in the early 2000s

#22

Post by forgotTheLast »

bluGill wrote: post #18
j2kun wrote: post #4

In my main project we added a new requirement that all new contributors meet a maintainer in a non-textual format before their first PR is merged. Seems to work well for a small project.

Only if you have maintainers everywhere. I live in a small city in the middle of the US - how far is it to a maintainer? 4 hours to Kansas City, or fly to San Francisco? Either way the burden seems far too high.

Non-textual can mean audio or video call, not necessarily in person.

Re: PR spam today looks like email spam in the early 2000s

#23

Post by bitmasher9 »

bluefirebrand wrote: post #12
Retr0id wrote: post #2

Maybe we should cut out the middle-man and make it easy for people to donate token credits to open-source projects, and let the maintainers decide how to use them.

Unfortunately "I donated money/tokens to open source" doesn't land interviews as well as "I'm a big contributor to open source" People spamming Open Source repos with AI PRs aren't trying to help Open Source, they're trying to build a brand, some kind of credible online presence with their username on it, or whatever else. It's purely selfish and completely opposite to the spirit of Open Software imo

This is the most uncharitable outlook on the increase of PRs. It may be true for some contributors, but any company reviewing their GitHub will see that the code is largely spam.

I think most AI generated code is people that want to help the project, but maybe aren’t familiar with the standards and norms.

Re: PR spam today looks like email spam in the early 2000s

#24

Post by cheald »

dkdbejwi383 wrote: post #10
kridsdale1 wrote: post #7

Earlier quoted context omitted.

I think there are a lot of “tech schools” overseas that require students to show proof of contribution to open source.

Open source contributions being a great way to learn and to pad out your CV has been considered good advice on all sides of the various seas I’ve lived throughout my career too - it’s not just a dubious code camp thing.

A robust open source profile is my single favorite hiring profile indicator. However, with the current state of things, if I get a whiff of AI-driven "contribution" it becomes an instant black mark against the candidate.

Re: PR spam today looks like email spam in the early 2000s

#25

Post by ffaccount2 »

bluefirebrand wrote: post #12
Retr0id wrote: post #2

Maybe we should cut out the middle-man and make it easy for people to donate token credits to open-source projects, and let the maintainers decide how to use them.

Unfortunately "I donated money/tokens to open source" doesn't land interviews as well as "I'm a big contributor to open source" People spamming Open Source repos with AI PRs aren't trying to help Open Source, they're trying to build a brand, some kind of credible online presence with their username on it, or whatever else. It's purely selfish and completely opposite to the spirit of Open Software imo

>People spamming Open Source repos with AI PRs aren't trying to help Open Source, they're trying to build a brand

I am certain many of them honestly believe that they are doing the right thing and that they are helping. After all hey, they implemented a feature or fixed a bug for the community! It's a grim worldview if you think they are all just selfish.

Re: PR spam today looks like email spam in the early 2000s

#26

Post by j2kun »

boredatoms wrote: post #14
j2kun wrote: post #4

In my main project we added a new requirement that all new contributors meet a maintainer in a non-textual format before their first PR is merged. Seems to work well for a small project.

Like a video/phone call?

Indeed, a request for a short video call filters out most of the people who are looking to pad their resume with LLM-automated contributions, while adding an extra layer of welcome to genuine newbies who want to join the community.

Re: PR spam today looks like email spam in the early 2000s

#27

Post by CapsAdmin »

runarberg wrote: post #3

AI agents who review the slop created by other AI agents is not the answer here. I much prefer a blanket ban on PRs and issues created by AI agents (which is what I personally do for my repos; so far I have closed one[1]). In fact I would love a github alternative which considers AI contributions to be a breach of their terms of use and ban any people who let AI agents loose on their platform. 1: https://github.com/r…

One interesting workflow I've seen is that the project maintainer simply rewrites and implements the pull request themselves and closes the PR.

LuaJIT has operated this way since 2012, though with a thanks and mention in the commit message. It seems like a good way to filter out people who prioritizes leveling up their github profiles.

Something a little bit similar, when I was hosting a social game server we had mods. And players always beg for mod status. At first I tried naming the admin group something weird like sandals, but eventually people would ask if they could be sandals too.

What worked best in the end was just hiding it completely making regular players see mods as other regular players. (mods would see who is a mod though)

I would also personally never make someone who asks a mod as it's almost always a sign of wanting power for the sake if it. I would instead just passively observe behavior until I trusted the player and make them a mod. I would then tell them that I don't expect them to exercise their power, but would demote if I see abuse of power.

Re: PR spam today looks like email spam in the early 2000s

#28

Post by parliament32 »

bluefirebrand wrote: post #12
Retr0id wrote: post #2

Maybe we should cut out the middle-man and make it easy for people to donate token credits to open-source projects, and let the maintainers decide how to use them.

Unfortunately "I donated money/tokens to open source" doesn't land interviews as well as "I'm a big contributor to open source" People spamming Open Source repos with AI PRs aren't trying to help Open Source, they're trying to build a brand, some kind of credible online presence with their username on it, or whatever else. It's purely selfish and completely opposite to the spirit of Open Software imo

For now. Give it another half year and "I contribute to open source" will carry the same weight as "I donate to charity" ie nobody cares because any idiot can do it.

I wonder how long it'll take before "I don't use LLMs for coding" carries weight.

Re: PR spam today looks like email spam in the early 2000s

#30

Post by sigbottle »

margalabargala wrote: post #21
runarberg wrote: post #3

AI agents who review the slop created by other AI agents is not the answer here. I much prefer a blanket ban on PRs and issues created by AI agents (which is what I personally do for my repos; so far I have closed one[1]). In fact I would love a github alternative which considers AI contributions to be a breach of their terms of use and ban any people who let AI agents loose on their platform. 1: https://github.com/r…

I tend to disagree. I think the comparison to email spam is apt. The answer to that problem was automated spam filters. Imagine the difficulty you might find interacting with the world if your inbox was set up such that all emails not literally written by a human were auto-deleted. No account recovery, no receipts, etc. Individuals might choose to do that for themselves but it's not the general case answer.

That's different though - those are services you explicitly agree to and sign up for, be it at checkout, be it at service signup time, be it because you are making a google account on the google platform.

For example, a github cicd automerge pipeline is still good.

Post reply on HN