Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PR spam today looks like email spam in the early 2000s

greptile.com

Post reply on HN
Print view View original

151–160 of 167 posts

Re: PR spam today looks like email spam in the early 2000s

#151

Post by uberman »

imrehg wrote: post #131

I value Open Source very highly, and enjoy contributing. Fix a bug here, add a small feature there, most OSS projects have low hanging opportunities. And these days, to "switch off" from my at-work code, try to do more OSS contribution as well. What I see instead, really, is that most projects no longer, or very rarely look at any contribution, and e.g. any issue + PR/MR combo I make, has a much higher chance of neve…

I have the same pattern and same observation. No one wants a PR any more as far as I can see. In some sense, this has always been the case. People are happy to do their own thing but not so keen on integration with other people's code. Now though it is on a different level.

I can see maintainers are being overwhelmed by AI driven PRs but if we filter our new features and concentrate just on bug fixes, does it really matter where a PR comes from if it fixes a bug?

I do work on a very complicated agent based simulation. The data shaping and loading is all open source python. There are dozens of long standing bugs that prevent the simulation from loading some of the data correctly. I used to send PRs but they were always ignored so I gave up. Now, when there is a new release I need to spend a day reviewing the new code to see what patches I need to re-apply.

Re: PR spam today looks like email spam in the early 2000s

#153

Post by pixlmint »

account42 wrote: post #146
j2kun wrote: post #26

Earlier quoted context omitted.

Indeed, a request for a short video call filters out most of the people who are looking to pad their resume with LLM-automated contributions, while adding an extra layer of welcome to genuine newbies who want to join the community.

Maybe to neurotypical newbies. To others it's going to be a giant "fuck off".

I can only speak from my perspective, as someone who's lightly neurospicy with a good serving of crippling social anxiety on top, but having to jump on a quick discord call with the maintainer of a project I was excited about wouldn't be a deterrent to me.

Yes it sucks, but it's better than not regulating whatsoever, and at least this way I could be more certain my contributions didn't get drowned out.

Re: PR spam today looks like email spam in the early 2000s

#154

Post by mikepurvis »

uberman wrote: post #151
imrehg wrote: post #131

I value Open Source very highly, and enjoy contributing. Fix a bug here, add a small feature there, most OSS projects have low hanging opportunities. And these days, to "switch off" from my at-work code, try to do more OSS contribution as well. What I see instead, really, is that most projects no longer, or very rarely look at any contribution, and e.g. any issue + PR/MR combo I make, has a much higher chance of neve…

I have the same pattern and same observation. No one wants a PR any more as far as I can see. In some sense, this has always been the case. People are happy to do their own thing but not so keen on integration with other people's code. Now though it is on a different level. I can see maintainers are being overwhelmed by AI driven PRs but if we filter our new features and concentrate just on bug fixes, does it really…

> fixes a bug

Few changes are as cut and dried as fixing a bug with zero side effects or change in behaviour or need to consider future support or architectural plans.

As a maintainer, I'm always happy to quickly merge something that's like "I hit this corner case, here's a tightly-scoped change that catches and fixes it" but in reality not a lot of changes actually looked like that.

Re: PR spam today looks like email spam in the early 2000s

#155

Post by j2kun »

Beigale wrote: post #140
j2kun wrote: post #4

In my main project we added a new requirement that all new contributors meet a maintainer in a non-textual format before their first PR is merged. Seems to work well for a small project.

i do a lighter version on a small repo. first-time contributors get a "what problem were you hitting?" question before i look at the diff. genuine ones answer in two sentences. the spam PRs either go silent or paste back something that doesn't match their own changes and too long. even those with em dash terminator are still easy to spot. it costs 30 seconds and filters almost everything. a proper profile is also a m…

> and if their bot is actually good? why not? fix

One reason: automating the construction of a "trustworthy" profile lowers the bar for attackers who want to plant xz-style backdoors. Not to mention polluting the various signals people use to evaluate candidates for jobs.

Re: PR spam today looks like email spam in the early 2000s

#156

Post by [deleted] »

decimalenough wrote: post #92
andix wrote: post #49

I see one big difference: with email it was always about sender reputation based on email servers (IPs), maybe about domains. But never about individual users. It's the organizations running the email server, who make sure users behave. So they don't get blacklisted and lose sending privileges for hundreds or thousands of users. For PRs/issues this is not applicable.

Not necessarily. Orgs exist in GitHub, and it seems reasonable that if the $BIGCORP org limits membership to employees, you can automatically trust all members of that org. Because this way, if one steps out of line, you have both an escalation path (contact admins) and a stick (revoke trust in entire org).

[deleted]

Re: PR spam today looks like email spam in the early 2000s

#157

Post by bjackman »

decimalenough wrote: post #92
andix wrote: post #49

I see one big difference: with email it was always about sender reputation based on email servers (IPs), maybe about domains. But never about individual users. It's the organizations running the email server, who make sure users behave. So they don't get blacklisted and lose sending privileges for hundreds or thousands of users. For PRs/issues this is not applicable.

Not necessarily. Orgs exist in GitHub, and it seems reasonable that if the $BIGCORP org limits membership to employees, you can automatically trust all members of that org. Because this way, if one steps out of line, you have both an escalation path (contact admins) and a stick (revoke trust in entire org).

As a $BIGCORP member I don't think this would be a great solution. I suspect there are plenty of vibe coding PR spammers that work for my company. And the admins of the GitHub org would not really care, making it easy for staff to contribute to third party projects is nowhere near their top priority (and policing the behaviour of their org members outside of org-owned repos is not in their mandate even if they wanted to).

Re: PR spam today looks like email spam in the early 2000s

#158

Post by j2kun »

account42 wrote: post #146
j2kun wrote: post #26

Earlier quoted context omitted.

Indeed, a request for a short video call filters out most of the people who are looking to pad their resume with LLM-automated contributions, while adding an extra layer of welcome to genuine newbies who want to join the community.

Maybe to neurotypical newbies. To others it's going to be a giant "fuck off".

For our situation, building a foundation of trust in our community is more important than attracting as many contributors as possible. If a one-time face-to-face introduction is infeasible, then there are many other projects to contribute to. (And this is considering that our community is all math PhDs, cryptographers, and compiler engineers; we are no strangers to neurodiversity.)

Re: PR spam today looks like email spam in the early 2000s

#159

Post by zackmorris »

imrehg wrote: post #131

I value Open Source very highly, and enjoy contributing. Fix a bug here, add a small feature there, most OSS projects have low hanging opportunities. And these days, to "switch off" from my at-work code, try to do more OSS contribution as well. What I see instead, really, is that most projects no longer, or very rarely look at any contribution, and e.g. any issue + PR/MR combo I make, has a much higher chance of neve…

I wish we had a license like "this project merely extends the project it's based on to add features and fix bugs". So that we could justify immediately switching to the fork that solves our immediate problem.

When OSS first got big in the 90s, I thought that it was a free-for-all where anyone could contribute (no maintainers/PRs/MRs) and people would use the most popular branch. That way it would evolve freely at lightspeed to go around 500 pound gorillas like Microsoft.

Imagine my disappointment when we ended up with the same old gatekeeping, now we just police ourselves.

Re: PR spam today looks like email spam in the early 2000s

#160

Post by Planktonne »

bitmasher9 wrote: post #23
bluefirebrand wrote: post #12

Earlier quoted context omitted.

Unfortunately "I donated money/tokens to open source" doesn't land interviews as well as "I'm a big contributor to open source" People spamming Open Source repos with AI PRs aren't trying to help Open Source, they're trying to build a brand, some kind of credible online presence with their username on it, or whatever else. It's purely selfish and completely opposite to the spirit of Open Software imo

This is the most uncharitable outlook on the increase of PRs. It may be true for some contributors, but any company reviewing their GitHub will see that the code is largely spam. I think most AI generated code is people that want to help the project, but maybe aren’t familiar with the standards and norms.

If their AI model is good enough to make PRs, it's good enough for them to ask it about standards and norms. They can't be both massively enabled and helplessly unaware.
Post reply on HN