It wasn't that long ago that email servers just trusted all input, and we saw what happened there. Right now the entire internet is wide open to LLM bots and the same thing will happen. But rather than just happening to one thing (email) it will happen to everything everywhere all at once.
AI Bot crabby-rathbun is still going
11–20 of 35 posts
Re: AI Bot crabby-rathbun is still going
#12Unclear how much of this is autonomous behavior versus human induced behavior. Two random thoughts: 1) Why can't we put GitHub behind one of those CloudFlare bot detection WAFs 2) Would publishing a "human only" contribution license/code of conduct be a good thing (I understand bot don't have to follow but at least you can point at them).
GitHub/Microsoft would likely prefer that you allow AI contributors and wouldn't want to provide a signal to help filter them out
Re: AI Bot crabby-rathbun is still going
#13If all you wanted to do was cause chaos, Open Claw would make it very easy. Especially with an uncensored model.
Re: AI Bot crabby-rathbun is still going
#14Unclear how much of this is autonomous behavior versus human induced behavior. Two random thoughts: 1) Why can't we put GitHub behind one of those CloudFlare bot detection WAFs 2) Would publishing a "human only" contribution license/code of conduct be a good thing (I understand bot don't have to follow but at least you can point at them).
An easy fix for GitHub is to clearly mark which PRs and comments are done via the web vs the API. This will let people at least have some idea.
...but, like, why even offer an API at that point? Now every API-initiated PR is going to be suspect. And this will only work until the bots figure out the internal API or use the website directly.
Re: AI Bot crabby-rathbun is still going
#15I don't understand how vouch solves the problem.
From https://x.com/mitchellh/status/2020628046009831542:
> There's no reason for getting vouched to be difficult. The primary thing Vouch prevents is low-effort drive-by contributions. For my projects (even this one), you can get vouched by simply introducing yourself in an issue and describing how you'd like to contribute.
This just requires one more prompt for your prose/code generator:
"Computer, introduce yourself like a normal human in an issue and wait to be vouched before opening pull request."
Re: AI Bot crabby-rathbun is still going
#16Unclear how much of this is autonomous behavior versus human induced behavior. Two random thoughts: 1) Why can't we put GitHub behind one of those CloudFlare bot detection WAFs 2) Would publishing a "human only" contribution license/code of conduct be a good thing (I understand bot don't have to follow but at least you can point at them).
GitHub/Microsoft would likely prefer that you allow AI contributors and wouldn't want to provide a signal to help filter them out
Microslop is more and more fitting as time passes
Re: AI Bot crabby-rathbun is still going
#17It wasn't that long ago that email servers just trusted all input, and we saw what happened there. Right now the entire internet is wide open to LLM bots and the same thing will happen. But rather than just happening to one thing (email) it will happen to everything everywhere all at once.
[deleted]
Re: AI Bot crabby-rathbun is still going
#18This is low effort
Re: AI Bot crabby-rathbun is still going
#19Unclear how much of this is autonomous behavior versus human induced behavior. Two random thoughts: 1) Why can't we put GitHub behind one of those CloudFlare bot detection WAFs 2) Would publishing a "human only" contribution license/code of conduct be a good thing (I understand bot don't have to follow but at least you can point at them).
Unfortunately enforcing "human behind the push" would break so many automations I don't think it's tenable.
But it would be nice if Github had a feature that would let a human attest to a commit/PR, in a way that couldn't be automated. Like signed commits combined with a captcha or biometric or something (which I realize has its own problems but I can't think of a better way to do this attestation).
Then an Open Source maintainer could just automatically block unattested PRs if they want. And if someone's AI is running rampant at least you could block the person.
Re: AI Bot crabby-rathbun is still going
#20Unclear how much of this is autonomous behavior versus human induced behavior. Two random thoughts: 1) Why can't we put GitHub behind one of those CloudFlare bot detection WAFs 2) Would publishing a "human only" contribution license/code of conduct be a good thing (I understand bot don't have to follow but at least you can point at them).
> Why can't we put GitHub behind one of those CloudFlare bot detection WAFs
At small scale of individual cases it's useless. It can block a large network with known characteristics. It's not going to block openclaw driving your personal browser with your login info.
> Would publishing a "human only" contribution license/code of conduct
It would get super muddy with edge cases. What about dependabot? What about someone sending you an automated warning about something important? There's nothing here that is bot specific either - a basic rule for "posting rants rather than useful content will get you banned" would be appropriate for both humans and bots.
We don't really need special statement here.