Hynek SchlawackMar 8

I’ve found myself feeling unmoored by the current crop of FOSS contributions. I genuinely don’t know how to proceed.

Of course there’s the slop where the PR checklist gets deleted & almost all items violated. The truly annoying part about this is that I always try to be kind & not a stickler about policies. I guess I don’t owe kindness to a bot, but it’s a bad look to be assertive in public. (1/5)

Show threadHynek SchlawackMar 8

I do not enjoy being a jerk—I want to keep my projects a friendly place that people enjoy to be in because FOSS is about people! Some people appreciate the opportunity of having the license to be assholes but that's not me. The idea of lashing out at someone by mistake horrifies me.

An even more complicated situation is well-intentioned-but-bad-ideas implemented well. There’s no time to think ideas through anymore. (2/5)

Show threadHynek SchlawackMar 8

Anyone can tell some LLM to implement their first best idea, but the first thing that comes to mind is rarely the best solution to anything.

LLMs are great to prototype real fast, but dropping a diff hundreds of lines long—no matter how clean the code—on someone’s porch puts them in an uncomfortable position. (3/5)

Show threadHynek SchlawackMar 8
I can only reiterate: FOSS is about people. As LLM code improves the first problem will go into the background but the social problems are only gonna get worse. And we've just seen how it works if we try to fix this asymmetry by using LLMs ourselves (spoiler: it's 4k compromised dev machines thru GitHub issue title injection). (4/5)
Show threadHynek SchlawackMar 8

I'm not asking for sympathy here because this is not “poor me”; I’m trying to think constructively about it. And I do realize that popular projects had this problem before LLMs took over. It only affects more projects now because huge companies are handing out figurative guns to everyone and acting surprised by the carnage.

I just want to get my pull requests under control without feeling like shit while doing so, man. (5/5)

Show threadkonsti
@hynek a good chuck of the AI PRs we get is indistinguishable from spam (fully automated, nonsense claims, etc.). i hope that the wave of AI PRs dies down as the hype settles, and we develop a sense of AI-use courtesy rules instead
Mar 8 at 4:35pmElk
Show threadHynek SchlawackMar 8
@konstin Yeah but they’re the easy part, right? The hard part for me is guessing whether one should invest energy and what amount of courtesy is appropriate. (I do not think making ppl disclose their Clankers helps at all, since those who need these rules are gonna lie anyways.)
Show threadPaul GanssleMar 8

@hynek @konstin I'm not sure the people who need these rules *are* going to lie. My mental model for someone who vibe spams OSS projects is someone who thinks they are being helpful (or someone trying to get bug bounties) but are clueless. They probably won't bother even tweaking their prompt to tell it to sound like a human because they don't see it as something to conceal.

Maybe there are people who are trying to just pump their contribution numbers for some dubious reason but I suspect those people would follow the same rules as phishing scams: don't get too sophisticated with it because it is a numbers game and you want to be rejected early by less gullible types.

Show threadHynek SchlawackMar 8

@pganssle @konstin I mean look at the open attrs PRs

You’re right it’s not lying if you just nuke the template

Show threadJeff TriplettMar 8
@hynek @pganssle @konstin We have been discussing this a lot in Django circles. Regardless of LLM/AI, if someone ignores or deletes my pull request template, I have zero guilt closing their pull request or explaining why.
Show threadHynek SchlawackMar 9
@webology @pganssle @konstin I will have to treat the check list as a brown M&M but it's causing me pain because I have to 180º my whole approach to maintenance
Show threadMirek SvobodaMar 9
@hynek @webology @pganssle @konstin Would it help to create a workflow running upon a PR creation, which would check the PR checklist, then run some tools like SonarCube, or even use AI to assess the PR and if it did not satisfy rules, then autoreject the contribution?
I mean fight with their own arms. (Semi-)Automated attacks need an automated defense.
Rules mentioned in this thread like a properly filled PR checklist, small diffs for bugfixes etc. seem easy to follow for genuine contributors.
Show threadHynek SchlawackMar 8

@konstin Hilariously, despite it manifesting as a social problems, the fact that everyone with a token can DoS an open source project is a technical problem that will require a technical solution. :/

People who give a shit already have AI-use courtesy rules I reckon