Discussion
Over the weekend, a person armed with a coding agent opened **479** pull requests against the Password Manager Resources project. As open source maintainers, what are we supposed to do about this?
All of the justification prose is written in clear AI dialect, with awkward phrasing. The normal benefit of the doubt I am able to give to contributors of the project, including that the changes they’re submitted are motivated by something that makes sense, are out the window.
@rmondello what are the odds this person is trying to sneak something malicious into your project and is hoping that buried under so many decoy PRs it will go unnoticed?
@rmondello labor is externalized onto maintainers asymmetrically. There should be a common set of explanation pages we can link people to for different variants of "here is why your well-meaning attempt is actually poison, and why you are banned now"
@rmondello Reply "please, try with your own words, if any"
@rmondello At that point, maybe the best option is to let them know that the team can't possibly keep up with their level of contributions and suggest that they instead fork the project and take on the maintenance themselves.
@rmondello
Wow, they’re in the top 16% on WhoBurnedMore.
Also, wow, today I learned there’s a slop leaderboard.
@rmondello I would judge this by reviewability rather than trying to prove which sentences were AI-written: one reproducible problem, one focused change, and a test or before/after example a maintainer can check. 479 open PRs fail that standard on volume alone. The burden of reducing them should stay with the submitter, not the project.
@rmondello An aspect of this might be to force the project to start using an AI-supported development cycle for every process.
"Wait, I thought you'd surely be doing that. Because why wouldn't you!? If you want to look something up manually, it's all documented in the PRs."
@rmondello the 🤨 in me thinks this is an attempt to get malicious code into the repo.
@rmondello I continue to completely not understand the motivation for doing this. This is the behavior of an ant infected with cordyceps or a mouse with toxoplasmosis, not an engineer with conscience taking pride in their work and contribution to the commons.
I just cannot understand the incentive here.
@rmondello Send a simple reply: Please can you physically check the requests yourself, and IF you find anything that is a problem, let us know by NON-AI means. This level of interaction is useless and unsustainable. Please reply, or we will presume you no longer want to take part.
@rmondello Looks like it’s still going, new one opened 2 minutes ago…..I really bet this person probably thinks they’re being helpful.
@rmondello not just a slop grenade but a slop cluster bomb
@rmondello cc @glyph who has a lot of words for dealing with this in the Twisted projects
@rmondello I agree with the crowd here: block/ban the user, for a start.
"You couldn't be bothered properly reviewing any of this, so neither can I."
You need to log in to see that page.
Install bonfire.cafe
Get the full app experience
@rmondello you should see what the cURL folks are doing to keep their maintainers sane from all the AI-powered inbound. 👀🫂💙