Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We stopped AI bot spam in our GitHub repo using Git's –author flag

archestra.ai

Post reply on HN
Print view View original

221–230 of 254 posts

Re: We stopped AI bot spam in our GitHub repo using Git's –author flag

#221

Post by pabs3 »

jart wrote: post #210
pabs3 wrote: post #207

Earlier quoted context omitted.

> someone (or something) who's concealing their identity has nothing to gain from recognition The xz supply chain attacker hid their real identity, created fakes one and gained recognition over time in order to gain more access and add the backdoor. So TLAs and other bad actors at least are interested in gaining recognition.

I know, right? It's like, finally—a threat actor who's intelligent enough to understand what capital means in the open source community and is willing to devote resources to engage with it authentically (even if it's for evil nefarious ends). The xz incident showed that the open source community has many other good defense mechanisms for verifying and spotting malicious work and then solving it. But we won't even get…

I don't know what the solution to slop is. Maybe the bubble will implode at some point. Until then, just close down issues/pulls or remove projects from GitHub I guess.

Re: We stopped AI bot spam in our GitHub repo using Git's –author flag

#222

Post by hpjev »

moraesc wrote: post #173
halapro wrote: post #126

[flagged]

We’re currently working on a feature that lets admins archive PRs. The goal is to give maintainers more control over how they manage contributions in their repositories. Archived PRs would be visible to admins only, so maintainers still have access to contributor history for auditing purposes and to meet any organizational or compliance requirements. Would this be helpful for you?

I can only speak for myself, being a maintainer of a project in the crypto space. We are getting spammed with AI slop and also scam comments (though this lessened for some reason).

My usual experience is this:

1. We open an issue that needs to be fixed 2. slop bots create multiple slop PRs 3. slop bots spam comments on the issues, pointing to their slop PRs

The only general methods for preventing this are are restricting PR's (not comments, I believe) to contributors - which is a hassle to maintain, and restricting to older accounts - which doesn't work because the bot accounts are not newly created.

Then we need to perform _way too many_ just to get rid of the slop: - navigate multiple pages and confirmations to ban the account from our org - open each PR manually - close it manually

This takes at least 15 clicks and is made _so much worse_ by how slooooooooow the UI is. Every click takes 2 seconds!!! How can "ban this account and delete everything it ever did" be more than a max of 2 clicks?

What we really need is a "locked down mode" where every interaction (PR, issue, comment) with the repo that isn't from maintainers or specifically whitelisted people goes into a moderation queue. Maintainers can confirm or deny the action using a single click (which does not take 2 fucking seconds to load).

Re: We stopped AI bot spam in our GitHub repo using Git's –author flag

#223

Post by Dwedit »

gabeio wrote: post #208
Dwedit wrote: post #113

Earlier quoted context omitted.

Anubis is actually not a cat. The original Egyptian deity is a god of death, and has a canine head. Anime catgirls and dog girls can look similar at first glance.

I believe they are referencing the person who wrote the program, not the name itself.

More likely to be referencing the mascot character who appears on your screen when you visit a protected page.

Re: We stopped AI bot spam in our GitHub repo using Git's –author flag

#224

Post by watwut »

marcus_holmes wrote: post #198
krupan wrote: post #78

This is what we get for telling everyone how amazing AI is at writing code. It started with the people selling AI and for some reason tons of independent developers, some quite well respected in our field, piled on. Facebook now laying people off and saying it's because AI is just so good adds more fuel to the fire. Now you have a bunch of people fully confident that their AI friend is pumping out amazing code and su…

No, this is a result of unintended consequences. We made "Github contributions" a metric for people applying for dev jobs. So, of course, because devs are the kind of people we are, they started working out how to game that metric. Some folks decided to start paying bounties on bug fixes, features, etc. Those bounties are fairly trivial by western standards, but are significant for developing countries. This creates…

This feels like an alternative history. OS contributions were never all that important metric and overwhelming majority of developers have literally none.

And it is not like AI spam would be limited or even primary targetted at bounties.

Re: We stopped AI bot spam in our GitHub repo using Git's –author flag

#225

Post by rglullis »

godelski wrote: post #203
rglullis wrote: post #199

Earlier quoted context omitted.

> You can't just hand wave them away as if this isn't an important factor.. There are plenty of ways to indicate in the project that the Pfand is meant as one way to filter out bad actors, but it doesn't mean that it should be the only way to accept external contributions. You can find somewhere else on the thread where I listed some alternatives that can be used as well. > If you don't care about them at all I got a…

If I have to trust you to give me back my $10, I'm never contributing to your code. Ever. If I have to trust GitHub to give me back my $10, frankly, I have more trust for a random person on the internet at this point. Also, you glossed over my banana joke, but it did hold meaning[0] > Yes, and what is the problem with [closing down PRs and Issues] solution? Are you serious? I mean it is an acceptable solution but it'…

> f I have to trust you to give me back my $10, I'm never contributing to your code. Ever.

That's the whole point! Either you are willing to trust the money to someone you don't know, or you will have to find another way to establish social proof.

> you glossed over my banana joke,

Sorry, not the biggest AD fan. Anyway, I am saying people will have to "pay up or establish social proof". Charging from a family member is not the same.

Re: We stopped AI bot spam in our GitHub repo using Git's –author flag

#226

Post by darccio »

karussell wrote: post #190
moraesc wrote: post #173

Earlier quoted context omitted.

We’re currently working on a feature that lets admins archive PRs. The goal is to give maintainers more control over how they manage contributions in their repositories. Archived PRs would be visible to admins only, so maintainers still have access to contributor history for auditing purposes and to meet any organizational or compliance requirements. Would this be helpful for you?

Not OP but requested this feature since years. Your suggestion would help a bit but I would prefer the opposite: before someone can 'pollute' my pull request space and draw attention from subscribers I would prefer an acceptance step (just like a moderator on a forum) instead of having to archive the PRs. This is especially important as (AI) spam increases and just because I am away for a few days or weeks I don't wa…

A PR staging area. This would be a good step forward.

Re: We stopped AI bot spam in our GitHub repo using Git's –author flag

#229

Post by pydry »

jmuguy wrote: post #143
halapro wrote: post #126

[flagged]

This is the correct assessment. This is not up to the open source community or individual projects to "figure out", any more than its up to me to figure out how not to get spam email.

Github team are seemingly too busy fighting downtime with ever more slop.

Re: We stopped AI bot spam in our GitHub repo using Git's –author flag

#230

Post by rglullis »

nijave wrote: post #201
rglullis wrote: post #162

Earlier quoted context omitted.

I have 3 PRs on https://github.com/django-oauth/django-oauth-toolkit/pulls that haven't been merged for OVER AN YEAR due to the maintaners being overloaded and who are expected to work on this for free. The fact that these PRs are not being promptly reviewed have cost me at least 3000€ in potential grant work. If I was told that I could make a deposit of $10 to get less stressed maintainers and a faster PR review cyc…

How did it cost you money in grant work? Can't you just fork and use that?

Not exactly. NLNet was funding this to get all these different OAuth RFCs nicely integrated with DOT. A lot of my work was already done on separate packages, putting up just another fork without the blessing of the DOT core team would not be of much use to the overall community.
Post reply on HN