Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We stopped AI bot spam in our GitHub repo using Git's –author flag

archestra.ai

Post reply on HN
Print view View original

211–220 of 254 posts

Re: We stopped AI bot spam in our GitHub repo using Git's –author flag

#211

Post by gabeio »

jbellis wrote: post #106
zer0tonin wrote: post #6

> Should we stop giving fun test tasks to our job candidates? Yes

Developers: stop doing whiteboard interviews, they don't measure anything relevant to the real job Also devs: stop giving us real world problems to solve

Those are the only two options to finding quality candidates?

Try talking more about the meta of coding itself. Get into the developers head by _talking_ to them and understanding how they would approach and attack different problems. You can show them code and ask them what they would do differently / how they would go about implementing X-Y-Z. Just because you can write foobar doesn't mean you understand how to apply algorithms or w/e specific problems [your] team has. It's _far_ better to understand how they would solve a problem over their syntax anyway.

Re: We stopped AI bot spam in our GitHub repo using Git's –author flag

#212

Post by avs733 »

silverwind wrote: post #5

PR spam is a major problems for repo that run bounties. Maybe GitHub should temporarily block accounts from raising PRs if like 95%+ of them are getting rejected.

It seems like some better basic metrics should be made front and center with PRs in this day and age. Yes AI is the driving force behind the current crop of problems but there are other issues. Yes it’s accessible if you go look but the point is people don’t have time.

the rate of comits/PRs total

The rate of PRs to repos they don’t own

The reject rate of PRs

The number of ban

An estimated “AI” or bot score or status flag

There are a few better attempts at GitHub metrics calculators but I have not seen any that move beyond the paradigm of more vomits is default assumed good. It’s time to foreground quality not just quantity. The GitHub “4 kpis” are entirely action oriented.

Re: We stopped AI bot spam in our GitHub repo using Git's –author flag

#213

Post by carschno »

> It's especially sensitive for a VC-backed startup that is measured thoroughly by GitHub activity, but we have to pull the trigger:

This sentence also illustrates the absurdity of this investment model. It imposes a trade-off between building good software, and complying with the investor's metrics. They probably call such metrics evidence-based, but this example shows that they arbitrarily capture some numbers to obscure the lack of meaningful measurements.

Re: We stopped AI bot spam in our GitHub repo using Git's –author flag

#214

Post by antran22 »

At this point we should be convinced that it's in Github and Macro$lop's narrative to encourage fully automated, LLM-assisted PR bombing, because "muh future of development" and what not. If they do care about combatting spam, they would have already:

- Protect the PR submitting feature behind some CAPTCHA

- Give repo owners some way to manage external contributors, instead of forcing them to do hack like this article

Just move to Codeberg, src.hut, or Gitlab even. Serious contributors will go there with you, the lazy people with LLM farming Github karma probably won't.

Re: We stopped AI bot spam in our GitHub repo using Git's –author flag

#218

Post by icelancer »

riponcm wrote: post #216
pierotofy wrote: post #215

I stopped most spam with a simple AGENTS.md. It actually seems to work (for now). https://github.com/LibreTranslate/LibreTranslate/blob/main/A...

could you explain please?

repo is cloned, AGENTS.md is auto-read into context, the doc says to not allow PR spam. think of it like a soft prompt hook.

Re: We stopped AI bot spam in our GitHub repo using Git's –author flag

#219

Post by andrelaszlo »

carschno wrote: post #213

> It's especially sensitive for a VC-backed startup that is measured thoroughly by GitHub activity, but we have to pull the trigger: This sentence also illustrates the absurdity of this investment model. It imposes a trade-off between building good software, and complying with the investor's metrics. They probably call such metrics evidence-based, but this example shows that they arbitrarily capture some numbers to o…

I also found it a bit ironic that it comes from an "AI company" (whatever that means) with a GitHub agent as part of their product.

Re: We stopped AI bot spam in our GitHub repo using Git's –author flag

#220

Post by pabs3 »

jart wrote: post #210
pabs3 wrote: post #207

Earlier quoted context omitted.

> someone (or something) who's concealing their identity has nothing to gain from recognition The xz supply chain attacker hid their real identity, created fakes one and gained recognition over time in order to gain more access and add the backdoor. So TLAs and other bad actors at least are interested in gaining recognition.

I know, right? It's like, finally—a threat actor who's intelligent enough to understand what capital means in the open source community and is willing to devote resources to engage with it authentically (even if it's for evil nefarious ends). The xz incident showed that the open source community has many other good defense mechanisms for verifying and spotting malicious work and then solving it. But we won't even get…

The xz incident was only discovered by accident, not by someone actually verifying the tarball and test cases were not malicious. We still don't have verification of tarball build reproducibility anywhere. The closest you can get to verified builds is what the bootstrappable builds community built in hex0/stage0, and what stagex built on top of that. I'm guessing even they haven't read through all that source code though. There aren't even good tools for distributing reviews, there is crev, but the stagex folks think it has some deficiencies.

https://news.ycombinator.com/item?id=47701394

Post reply on HN