HN

Comments (106)

• Menu

  alkonaut
  Ironically this seems like a perfect use for AI from the maintaner side. "Find low-effort/AI-like PR's without associated issues from new contributors. Discuss with the contributors in the PR about how contributions should be made, then reject their PR's. If any bad behavior is detected in this interaction, block the accounts for 24 hours and add them to a list of accounts to review for permanent banning from the project".Automated PR's can have automated responses. You make a human effort, you get a human response.
• Menu

  smooc
  So the fixes are still fixes, but we (I am also a OSS maintainer) are unwilling to accept them as they boost the contributor’s status where we think the merit is very or extremely limited.Why not have these PRs counted differently (by the platform), and/or colored differently in the timeline(s) thus made less visible or more clear?
• Menu

  neilv
  IMHO, the days when open source contributions are often positive signal for hiring are long gone.Actually, if I see someone doing open source like it's a performative career checkbox, that will not be positive signal, and could easily be negative. I understand that people will do what they need to do to get a job, but that pragmatic career checkboxing itself isn't positive. I will have to look for positive signal elsewhere for that person.The problem is that our industry has gotten very bad at hiring, and now we have everyone playing all sorts of games with it -- rehearsing Leetcode interviews, bad faith open source contributions, feigning enthusiasm, spamming AI-tweaked resumes, outright cheating on interviews -- rather than focusing on doing good work, and being part of a team.If you're involved in hiring, and you care about effectiveness and culture, consider pushing back against the prevailing dysfunctional big-corporate-cattle-herding practices. Especially if your company has no excuse to be big-corporate dysfunctional, and can't afford to be.
• Menu

  timokoesters
  Hi Neil, fun to see you on HN. I agree with your points and I you summarized it very well as "Ultimately, open source is built on trust".AI is destroying trust in open source and many other areas and I think this will discourage teams from publishing their source code in the future.On the other hand, personal connections are becoming even more important, which is unfair to the younger generation and people who don't live near tech hubs.
• Menu

  krisgenre
  While exploring an open-source project recently, I noticed a bug in the initial setup. I asked Claude to verify it, and the AI confirmed the issue. When Claude asked if I wanted to file a bug report, I agreed, assuming it would simply generate a formatted text block for me to copy and paste. However, I soon realized it had actually submitted the issue directly to GitHub. It turned out I had the GitHub CLI installed and was logged in with my work account.Out of curiosity, I then asked Claude to draft an enhancement request for a new feature. It created a highly detailed issue and went on to generate the corresponding code for the enhancement.I haven't submitted a pull request because the code is written in a language I don't know. Part of me considered submitting it anyway since it works and could be useful, but after reading this post, I think I'll just keep it under wraps.
• Menu

  J253
  I also maintain a popular open source repo and have seen similar. If I receive a low effort single-pass obviously-Clauded PR (many people (agents) don’t even bother using the AGENTS.md file I provide right in the repo?!) with no associated issue I also have no qualms closing. I do generally leave a short note about why I closed (volume of these is around 5/week) showing how far off they (Claude) was and encourage opening an issue where we can start a discussion which rarely happens for the drive-by folks. So I totally feel this but I find myself more disheartened by the practice than angry. It feels like slowly watching open-source go the way of email. Open and free until no-cost spam ruined the inbox for everyone...
• kodoman
  I think opensource has decided to become big corporate cheerleader for a while and not actually done things strictly in the interest of users or developers, but providing the ideological justification as to why big companies can use their code and not give a dime back. I think aside from free software there could have been a movement where contributing to a free-software project would have allowed contributors to get payed and this would have to preclude companies simply using code as they can in say the MIT license and not give back.Instead opensource is full of cynical projects and real important projects that do amazing work with maintainers who shoulder a great burden having to listen to people bitch about them for features and fixes while giving nothing and dealing with bad PR's (or even just having to evaluate good and mediocre PR's). Often the only pay is that you can go to HR and shit corp with your CV and say "Here is what I have done, can I now be treated like a bitch for more money".I think opensource has allowed a lot businesses to treat developers with contempt and this is fully manifest with the way they conceive of AI agent's and Open source has probably become a vector for demoralization and devaluation more then anything.
• Menu

  ChuckMcM
  I think the author meant 'burnish' there, which is a clever way of showing they didn't use AI :-)
• DarmokTanagra
  Open source contributions as a signal of developer quality is a thing of the past.Open source contribution on github specifically is no longer about building and maintaining something, its a parasocial signal that has more in common with linkedin hustle bloggers.
• Menu

  olalonde
  I've submitted PRs for typos in the (pre-LLM) past, not to boost my GH profile, but because I thought I was being helpful. Guess I was wrong...
• 21asdffdsa12
  “The spirits that I summoned, I cannot now dismiss.”https://en.wikipedia.org/wiki/The_Sorcerer%27s_Apprentice
• paweladamczuk
  When technically correct PRs (actual fixes, harmless) get rejected, maybe it's a signal that the codebases are too big?My big hope for LLM coding is that it will finally force us to focus on minimizing the amount of code that is out there instead of ever producing more.
• Menu

  arjie
  This makes sense. Apart from the original thing, I no longer upstream anything. It just takes comparatively more effort than maintaining a private fork with my own idiosyncratic fix. This must mean that even small fixes that non-contributors would make in the past are just happening off the books, so to speak. e.g. I upstreamed a tiny fix to Thrift codegen because some function could be much faster. These days I wouldn't bother. I'd just fork and leave upstream to be upstream.I suspect many people are like me since it feels like a very normie position to take. That means that contributors are even more likely to be useful because both the drive-by genuine contributors have chosen otherwise and these contributors have increased.It must be quite painful to be an open source maintainer right now. One wonders what to make of such projects in a future where a feature-list is a sufficient prompt.
• Menu

  yeputons
  I’ve heard about similar issues with Hacktoberfest’s T-shirts back in 2020, but it was not as automated back then: https://news.ycombinator.com/item?id=24643894
• Menu

  oleg_antonyan
  Do recruiters actually care about your open source contributions? Especially now when only LLMs read CVs and match them against strict criteria, I doubt there are many companies that actually care about your work outside of work, in fact they might care in opposite direction - thinking that you'll be distracted from work
• Eueudhsbsj32
  Seems like a contributor reputation score (shared across all projects) that one can build up over time would be a clean solution to the low quality pull requests.
• Menu

  hsn915
  This is weird though.Obviously the best way to use AI to furnish your CV is to build your own project using AI.
• hypfer
  GitHub flavored FOSS I believe works best for "corporate FOSS" projects and terrible for "FOSS as how it was conceived decades ago". Or rather I believe that it is engineered exactly for the former.What it does well is coordination between corps, working in public (while on a corp payroll) and extracting some drive-by-PR value out of random third-parties.The closer your project is to that shape, the better it works for you. The further it is away, the more pain you will feel.This has nothing to do with AI slop. AI slop just turned up a few knobs that were already there.
• gunnarmorling
  I very much can relate, as I've also been receiving many of these drive-by PRs lately.One big problem I have with them is that they take away time from project maintainers for reviewing and helping to get the PRs into shape, which then can't be spent on other, more important things. I feel like the "good first issue" GitHub label is specifically attracting these kinds of contributions.It's not a black-or-white thing though, and you need to tell apart folks who produce slop PRs against any arbitrary repo, from folks using AI to contribute in a sensible way. We've tried to codify some rules in our contribution guide [1]:- PRs from apparent bot accounts are closed - PRs from users who file large numbers against random repos are closed - You're welcome to use AI, but you need to stand behind your PR and be able to explain itI'm sure we'll adjust those rules over time, but since we have instantiated them, it definitely has become easier to deal with AI PRs and handle them in an a relatively objective way. It absolutely means that sometimes a PR will be closed which could have been an improvement, but I think this is the right thing to do given the circumstances.[1] https://github.com/hardwood-hq/hardwood/blob/main/CONTRIBUTI...
• Menu

  fguerraz
  These maintainer who’ve held the sacred fire for years…
• Menu

  nubinetwork
  This is nothing new, people have been making spellcheck commits all over github for years... and that was before ai slop even existed.
• Menu

  jarym
  > raised three separate PRs to correct spelling and grammar mistakes in comments.> The changes were harmless and correct,> I closed all three PRs without comment.What is this article? I get real ‘AI slop PRs’ are nightmares - but I take that to mean the wave of AI generated PRs that read convincingly but are in the end bullshit.But your example is NOT that. The unreasonable counter to your point: don’t make spelling mistakes in the first place? Or switch off PRs if you don’t want things corrected?
• Menu

  ReptileMan
  Create AI to review the pull requests and auto ban people for low SNR.
• thoopring
  [flagged]
• mrasong
  [dead]
• 6stringmerc
  [dead]
• fnfjfjf
  [flagged]
• yuiegi
  [flagged]
• Menu

  dumpsterdiver
  > The changes were harmless and correct, but that did not make me feel better about accepting or merging them.So do you have the project’s best interest at heart or not? If you’re more concerned about the intent of a valid contribution than the content, why don’t you ask yourself where your intent is? You rejected a valid contribution based on unverified vibes about the person’s intent, instead of assuming they were just being helpful.