9 ms·

LLM policy?

185 points by dropbox_miner 11mo ago

dropbox_miner 11mo ago
There seems to be a bot that routinely creates huge LLM generated Issues on runc github: https://github.com/containerd/containerd/issues/12496 https://github.com/containerd/containerd/issues/12496 And honestly, its becoming annoying
- QuiDortDine 11mo ago
  Is there a way to ban specific users in your GitHub project? (I prefer GitLab, I'm sure if it had projects that are as popular it would be similarly inundated.)
  - hobofan 11mo ago
    IIRC if one of the maintainers of a project blocks a user that prevents them from participating in issues and PRs. For bigger projects with many maintainers that can also lead to problems if people use the block function as liberally as on Twitter.
dropbox_miner 11mo ago
Curious to know if others are seeing a similar uptick in AI slop in issues or PRs for projects they are maintaining. If yes, how are you dealing with this? Some of the software that I maintain is critical to container ecosystem and I'm an extremely paranoid developer who starts investigating any github issue within a few minutes of it opening. Now, some of these AI slop github issues have a way to "gaslight" me into thinking that some code paths are problematic when they actually are not. And lately AI slop in issues and PRs have been taking up a lot of my time.
- jmathai 11mo ago
  At first, I thought "wow, this project has been inactive for some time and this PR is quite large". The use of emojis should have tipped me off :) https://github.com/photo/frontend/pull/1609 https://github.com/photo/frontend/pull/1609
- Aurornis 11mo ago
  I haven’t seen anything obvious, even including the other repos where I look through issues a lot. Maybe it’s only the really popular and buzzword-y repos that are targets? In my experience, the people trying to leverage LLMs for career advancement are drawn to the most high profile projects and buzzwords, where they think making PRs and getting commits will give them maximum career boost value. I don’t think they spend time playing in the boring repos that aren’t hot projects.
- bohrbohra 11mo ago
  AI slop attacks on the cURL project : https://www.youtube.com/watch?v=6n2eDcRjSsk https://www.youtube.com/watch?v=6n2eDcRjSsk
SoftTalker 11mo ago
I think everything has a growing problem with LLM/AI generated content. Emails, blog posts, news articles, research papers, grant applications, business proposals, music, art, pretty much everything you can think of. There’s already more human produced content in the world than anyone could ever hope to consume, we don’t need more from AI.
- somenameforme 11mo ago
  In some ways I'm starting to enjoy this. Do you remember the 419 scams? 'Hi, I'm a Nigerian prince named Michael Jordan. Give me $50 so I can buy some chemicals to clean a bunch of money I secretly stowed away and I'll send you $5000.' People actually used to fall for that. Of course some people probably still would (and a lot more certainly gets blocked by spam blockers) but I think overall society grew less substantially less gullible over time. But in general I think most people still remain excessively gullible and naive. Social media image crafting is one of the best examples of this. People create completely fake and idealized lives that naive individuals think are real. Now with AI enabling one to create compelling 'proof' of whatever lie you want, I think more people are becoming more suspicious of things that were, in fact, fake all along. --- Going back to ancient times many don't know that Socrates literally wrote nothing down. Basically everything we know of him is thanks to other people, his student Plato in particular, instead writing down what he said. The reason for this was not a lack of literacy - rather he felt that writing was harmful because words cannot defend themselves, and can be spun into misrepresentations or falsehoods. Basically - the argumentative fallacies that indeed make up most 'internet debates', for instance. Yet now few people are not aware of this issue, and quotes themselves are rarely taken at face value, unless they confirm ones biases. People became less naive as writing became ubiquitous, and I think this is probably a recurring theme in technologies that transform our abilities to transfer information in some format or another.
  - PeaceTed 11mo ago
    The old quote of, 'You can fool some of the people all of the time, all of the people some of the time'. There is the hope that in dumping so much slop so rapidly that it will break the bottom of the bucket. But there is the alternative that the bottom of the bucket will never break, it will just get bigger.
lofties 11mo ago
Sidenote, but I love that in a GitHub issue discussing banning the use of LLMs, the GitHub interface asks if there's anything I'd like to fix with CoPilot.
- b00ty4breakfast 11mo ago
  That might be a contributing factor to this problem. the means to produce these bogus reports are integrated directly into so many dev tools nowadays.
vineyardmike 11mo ago
I've seen an uptick in LLM generated bug reports from coworkers. A employee of my company (but not someone I work with regularly) used one of the CLI LLMs to search through logs for errors, and then automatically cut (hundreds!) of bugs to (sometimes) the correct teams. Turns out it was the result of some manager's mandate to "try integrating AI into our workflow". The resulting email was probably the least professional communication I've ever sent, but the message was received. The only solution I can see is a hard-no policy. If I think this bug is AI, either by content or by reputation, I close without any investigation. If you want it re-opened, you'll need to IRL prove its genuine in an educated, good-faith approach that involves independent efforts to debug. > "If you put your name on AI slop once, I'll assume anything with your name on it is (ignorable) slop, so consider if that is professionally advantageous".
- PeaceTed 11mo ago
  Alas this is an issue of LLM generated code. Increased productivity but lessened understanding. If you can increase productivity while also increasing understanding then that will be a decent middle ground. All comes down to accountability.
- theshrike79 11mo ago
  That's just stupid. IF you want LLM code reviews, there are bots for codex, copilot, claude etc that plug straight into Github PRs and review the code automatically. Some of them are actually useful, some just plain wrong and some are subtly wrong and you need to spend some time figuring out whether it's right or wrong :) IMO it's still a net positive because LLMs tend to pick up really weird subtle errors that humans easily gloss over.
CGamesPlay 11mo ago
I make a lot of drive-by contributions, and I use AI coding tools. I submitted my first PR that is a cross between those two recently. It's somewhere between "vibe-coded" and "vibe-engineered", where I definitely read the resulting code, had the agent make multiple revisions, and deployed the result on my own infrastructure before submitting a PR. In the PR I clearly stated that it was done by a coding agent. I can't imagine that any policy against LLM code would allow this sort of thing, but I also imagine that if I don't say "this was made by a coding agent", that no one would ever know. So, should I just stop contributing, or start lying? [append] Getting a lot of hate for this, which I guess is a pretty clear answer. I guess the reason I'm not receiving the "fuck off" clearly is because when I see these threads of people complaining about AI content, it's really clearly low-quality crap that (for example) doesn't even compile, and wastes everyone's time. I feel different from those cases because I did spend my time to resolve the issue for myself, did review the code, did test it, and do stand by what I'm putting under my name. Hmm.
- TingPing 11mo ago
  I think it’s disrespectful of others to throw generated code their way. They become responsible for it and often donate their time.
  - CGamesPlay 11mo ago
    I think it's disrespectful to throw bad code on somebody else, regardless of its provenance. And (as a professional who uses AI coding agents) I understand that LLM code is often bad code. But the OP isn't complaining about the deluge of bad code being submitted as PRs, they're complaining about LLM code being submitted as PRs. I've also been on the other side of this, receiving some spammy LLM-generated irrelevant "security vulnerabilities", so I also get the desire for some filtering. I hope projects don't adopt blanket hard-line "no AI" policies, which will only be selectively enforced against new contributors where the code "smells like" LLM code, but that's what I'm afraid will happen.
    - cyphar 11mo ago
jmyeet 11mo ago
Some years ago I read the Neal Stephenson book Anathem. SPOILERS: it has a version of the Internet called the Reticulum and one thing I remember is that it was filled with garbage. True information subtly changed multiple times until it was garbage. And there were agents to see through the garbage. I imagined this to be a neverending arms race. Honestly, this is kind of where I see LLM generated content going where you'll have to pay for ChatGPT 9 to get information because all the other bots have vandalized all the primary sources. What's really fascinating is you need GPUs for LLMs. And most LLM output is, well, garbage. What did you previously need GPUs for? Mining crypto and that is, at least in the case of Bitcoin, pointless work for the sake of pointless work ie garbage. I can see a future in our lifetimes where a significant amount of our capital expenditure and energy consumption is used, quite simply, to produce garbage.
- PeaceTed 11mo ago
  Considering how energy intensive generative content is, there is a good chance that it is already becoming a sizable share of energy use for the internet.
- Gigablah 11mo ago
  Humans are far more effective at producing garbage than LLMs will ever be :)
  - andrewflnr 11mo ago
    They're really not, though. Creating garbage is the one ability at which LLMs are unarguably superhuman.
    - denmark1 11mo ago
      I think the opposite. LLMs do good work if you know what you’re doing across the board. Having 20 years experience writing code, it’s made things even better for me and even more fun. To those hating, they probably never wrote a system in their life.
zzo38computer 11mo ago
In stuff I maintain I hardly get anything at all, whether using LLMs or not, so it does not affect me much. Furthermore, I exclusively use the API, so the UI will not try to make you use Copilot and those things either (that is not the reason I use the API, although it is a side effect). I do not use Copilot, Claude, etc, although I partially agree with one of the comments there, that using LLM for minor auto-completion is probably OK, as long as you can actually see that the completion is not incorrect (although that should apply to other uses of auto-completion too, even if LLM is not used; but it is even more important to check more carefully if LLM is used). I think it would be better to not accept any LLM generated stuff otherwise (although the author might use LLM to assist before submitting it if desired (I don't, but it might help some programmers), e.g. in case the LLM finds problems with it, that they will then have to review themself to check if it is correct, before correcting and submitting it; i.e. don't trust the results of the LLM). It links to https://github.com/lxc/incus/commit/54c3f05ee438b962e8ac459262d509cfb8bcdf30 https://github.com/lxc/incus/commit/54c3f05ee438b962e8ac4592... (add .patch on the end of the URL if it is not displayed), and I think the policy described there is good. (However, for my own projects, nobody else can directly modify it anyways; they will have to make their own copy and modify that instead, and then I will review it by myself and can include the changes (possibly with differences from how they did it) or not.)
ninetyninenine 11mo ago
This is a minor issue. The big issue comes when we start complaining about code that's not generated by AI. When hand coded stuff becomes buggier than AI stuff.
- tombert 11mo ago
  You're being downvoted but I think I get what you're getting at. When I was doing my masters a few months ago, I would get my assignments rejected whenever I didn't run them through Grammarly first. I have nothing against Grammarly, it's a useful too, but I find that it has the tendency to reject things that (as far as I can tell) are still technically correct but don't have the "AI vibe" to it. I suspect that the graders are running things through Grammarly themselves and rejecting anything that it rejects. This is probably going to become increasingly more common as time goes on. It's hardly the worst thing in the world, but I do think it will lead to the only "accepted" writing being extremely plain and formulaic.
  - hitarpetar 11mo ago
    what do you mean your assignments were rejected? like rejected for being AI generated?
    - tombert 11mo ago
      No, they weren’t AI generated. They have people judging grammar, and I think they will run it through grammarly to automate it. I wrote the stuff myself.
      - hitarpetar 11mo ago
        yeah yeah I got that I'm just confused what justification your graders gave for rejection. I've never heard of a paper rejected on account of grammar
bsder 11mo ago
A much bigger problem is that when an AI/LLM coughs up code, you have absolutely no idea what the copyright or license is.
- PeaceTed 11mo ago
  Copyright in the context of LLM's is kind of weird. It doesn't explicitly copy others code but it does lean heavily on the structure of it. Is it evidence of copying prior work or is it fair use? Alas, we don't really have any legal bearing that can handle this yet. If it is copying prior work, then you are right that there would be a lot of cross licensing bleed through. The opposite is also true in that it could take proprietary code structure and liberate it into GPL 3 for instance. Again what is the legal standing on this? Years back there was a source code leak of Microsoft Office. Immediately the Libre office team put up restrictions to ensure that contributors didn't even look at it for fear that it would end up into their project and become a leverage point against the whole project. Now with LLM's it can be difficult to know where anything comes from.
  - bee_rider 11mo ago
    We don’t know if it is weird yet, right? It is just a big question mark. I guess as some point there will be a massive lawsuit. But, so much of the economy is wrapped up in this stuff nowadays, the folks paying for Justice System Premium Edition probably prefer not to have anything solid yet.
- Aloisius 11mo ago
  I assume any LLM contributions are uncopyrightable at best or copyright infringement at worst. Either way, I don't own the copyright. In order to avoid a potential future where I lose the copyright due to being unable to show a substantial portion is human authored, I try to keep track of what is AI authored and what is human authored. From a copyright perspective, right now accepting LLM contributions feels like playing with fire, at least for closed source projects.
- cyphar 11mo ago
  I completely agree, but it seems that our industry has decided to turn a blind eye to it. They might even get away with it -- the recent rulings around fair use with regard to Facebook and Anthropic's unrepentant copyright violations[1] was particularly galling to me. Almost all of the projects I work on require you to sign the Developer Certificate of Origin[2] (which attempts to protect projects from people submitting code that they know cannot be licensed under the project's license), and in my view LLM code you submit does not fulfill the requirements of the DCO. Unfortunately, it seems nobody actually cares about this either. [1]: https://www.debevoise.com/insights/publications/2025/06/anthropic-and-meta-decisions-on-fair-use https://www.debevoise.com/insights/publications/2025/06/anth... [2]: https://developercertificate.org/ https://developercertificate.org/
ddxv 11mo ago
I've seen an interesting politically motivated one. It didn't appear to be a bot, just a user from China: https://github.com/umami-software/umami/pull/3678 https://github.com/umami-software/umami/pull/3678 The goal is "Taiwan" -> "Taiwan, Province of China" but via the premise of updating to UN ISO standards, which of course does not allow Taiwan. The comment after was interesting with how reasonable it sounds: "This is the technical specification of the ISO 3166-1 international standard, just like we follow other ISO standards. As an open-source project, it follows international technical standards to ensure data interoperability and professionalism." The politics of the intent of the PR was masked. Luckily, it was still a bit hamfisted. The PR incorrectly changed many things and the user stated their political intention in the original PR (the above is from a later comment).
- nl 11mo ago
  Doubly interesting (and relevant to this discussion) is that it was an AI code review tool that detected the issues with the PR
- komali2 11mo ago
  One of these days I need to make a bot that scans FOSS repos for this kind of little pink nonsense behavior. The insecurity of wanting to call a place "country name, province of different country name" should alone be mocked. Imagine, "Ukraine, province of Russia," or "India, colony of The United Kingdom." Absurd on its face.
  - theshrike79 11mo ago
    It's just information warfare, sign of the times. Every little thing counts, even if it's just changing names in an open source app like that.
  - maxbiggaveli 11mo ago
    The problem with this is that, for some folks, its not absurd or nonsense because that is not considered a "country name" to them. It is considered a province name. So the inverse (calling a province a country) is considered absurd/nonsense.
benatkin 11mo ago
The issue expresses doubt about a policy specific to LLMs being accepted. I think the way to go might be to accept that the bar for outside contributions should unfortunately be higher. It doesn't take an LLM to have a glut of low quality contributions, it just takes an incentive and some attention, as we've seen with Hacktoberfest: https://news.ycombinator.com/item?id=31628342 https://news.ycombinator.com/item?id=31628342
xeeeeeeeeeeenu 11mo ago
Unfortunately, LLMs empower "contributors" who can't be bothered to put in any effort and who don't care about the negative impact of their actions on the maintainers. The open-source community, generally speaking, is a high-trust society and I'm afraid that LLM abuse may turn it into a low-trust society. The end result will be worse than the status quo for everyone involved.
- wombatpm 11mo ago
  AI seems like a rerun of the Eternal September problem that eventually killed internet news groups and a lot of email discussion lists.
- wilya7 11mo ago
  Everything is collapsing toward a low-trust default. At the end of this trajectory, we rediscover that the analog world becomes valuable precisely because it can't be infinitely replicated. Authenticity becomes the foundational currency. But everyone must master AI tools to stay relevant. The brilliant engineer who refuses AI-generated PR by principle will get replaced. Every 18-24 months, as capabilities double, required skills shift. Specialization diminishes. Learning velocity becomes the only durable advantage. These people cannot learn new tricks. Those who cannot question their assumptions cannot self-correct and will be replaced. The future belongs to the humble, the fluid, and the resilient. 60% of HN users is going toward a very tough time, and I am being very charitable with this assumption.
  - cindyllm 11mo ago
    [dead]
  - grayhatter 11mo ago
    [flagged]
shashankg09 11mo ago
This is a poor take. We need to stop slop and low effort issues/PRs. Stopping AI generated code is a lost battle because detecting that in high quality work is impossible.
- o11c 11mo ago
  If people can't make a good (PR, story, or whatever) without AI, they certainly can't do it with AI, because using the AI is strictly more difficult - it requires all the original skill, plus the skill to work around the AI's quirks. This is arguably isomorphic to Kernighan's Law: > Everyone knows that debugging is twice as hard as writing a program in the first place. So if you’re as clever as you can be when you write it, how will you ever debug it?
  - wilya7 11mo ago
    Are you sure about that? Can you make the opposite case and steel-man it? Until you can, a stupid LLM will be smarter than you are. I can write a PR now. I can code now. Probably not as good as you can, but before LLMs I couldn't. I tried for decades learning to code. My brain is a Top-down network, I can see the big picture very quickly, but I cannot maintain focus to build bottom-up. Now I don't have to. I use LLMs to set the goal, to examine all corner cases, to define the milestones, to predict the wrong turns, to write a human-readable spec, to break it down to units of test code, to write the blue-prints of units of code. I can test them, and debug them with LLMs. The end result can be sub-optimal, but it runs, it does what I want, is well documented, and is maintainable. Before LLMs I couldn't do any of that. In doing all this, I get better at the bottom-up thing, just by trying. We are a spectrum of people. Do not assume the world is like you.
    - SkiFire13 11mo ago
      It seems either your LLM is 10x better than anything I've ever used or your standards are 10x lower.
kijin 11mo ago
I have a simple rule: whenever I receive an issue or PR from an unfamiliar account, I skim the text and/or code and post 1-2 quick questions. If the submitter responds intelligently, then the issue warrants a more in-depth investigation. If not, the submitter clearly doesn't think that the issue is worth following up on, so it's not worth my time, either. The more code a PR contains, the more thorough knowledge of it the submitter must demonstrate in order to be accepted as a serious contributor. It doesn't matter if it was written by a human or an LLM. What matters is whether we can have a productive discussion about some potential problem. If an LLM passes the test, well it's a good doggy, no need to kick it out. I'd rather talk with an intelligent LLM than a clueless human who is trying to use github as a support forum.
- theshrike79 11mo ago
  > I have a simple rule: whenever I receive an issue or PR from an unfamiliar account, I skim the text and/or code and post 1-2 quick questions. If the submitter responds intelligently, then the issue warrants a more in-depth investigation. If not, the submitter clearly doesn't think that the issue is worth following up on, so it's not worth my time, either. And if the submitter responds with "Great question! ...", what then? :D
  - Blackthorn 11mo ago
    Ban them.
- imiric 11mo ago
  That's a reasonable first step, but a human can just as well feed your questions to the LLM, and post the responses. So you really have to be vigilant throughout your interactions with the author, or, if the PR is unsalvagable, save yourself some time and effort and reject it from the start. > I'd rather talk with an intelligent LLM There's no such thing.
  - kijin 11mo ago
    The goal is not to filter out LLMs. The goal is to find and fix legitimate issues with my open-source software. I don't care if a human is feeding my questions to an LLM or an undead dog as long as they produce a decent signal. If the noise increases to an uncomfortable level, of course, I may have to change my strategies. The point is that humans produce noise, too, sometimes even more than LLMs do.
dSebastien 11mo ago
Prompt injection must be a really lucrative activity. I wonder how many hidden prompts will be detected on GitHub in the coming years and how many devs dare point LLMs at GitHub issues
blutoot 11mo ago
Since the cat is out of the bag (i.e. there's no stopping of LLM-generated code / PR / issues now that vibe-coding is fairly universally accessible), the only thing in our (especially those who are custodians of software systems and products) control is to invest a lot more in testing and evals. Just plain opposing LLM-generated content as a policy is a losing battle at this point..
- catlifeonmars 11mo ago
  I disagree. I think there’s a near future where this is true, but we’re still at the point where you can cut down on a lot of spam/slop by rejecting the class of LLM-generated content as a policy.
- rester324 11mo ago
  > to invest a lot more in testing and evals I don't think this will work. The same arguments could have been said to mitigate junior devs' work or short timeline/high stakes project technical debt and rarely ever anyone listened
  - AlecSchueler 11mo ago
    Because there were other solutions at that time, but now the situation is materially different. I think we're already seeing a lot more test driven development as well as documentation of style norms that were necessitated by things like agents.md but whicj would have been useful ten years ago too, and it's still very early days
alexchantavy 11mo ago
As an open source maintainer, I don't have an issue with AI; I have an issue with low quality slop whether it comes from a machine or from a human. The responsibility then is for an open source project to not be shy on calling out low quality/low effort work, have good integ tests and linters, and have guidance like AGENTS.md files that tell coding robots how to be successful in the repo.
- nightpool 11mo ago
  What good does having integration tests and linters do when triaging issues? When trying to figure out if a bug report is hallucinated or not?
- cyphar 11mo ago
  > I have an issue with low quality slop whether it comes from a machine or from a human. It's very hard for a human to mask a low-quality PR as thought it were reasonable quality. It is incredibly easy for an LLM to do it (in fact that is precisely what they are trained to do). In addition, when I see a low-quality PR, I try to mentor the submitter. That doesn't make sense to do for LLMs (the submitter might not even bother reading my comments). > and have guidance like AGENTS.md files that tell coding robots how to be successful in the repo. If none of the maintainers use such tools, why is it our responsibility to maintain documentation to appease them (in the hopes of reducing spam)? A policy limiting their use is much simpler to write and requires less maintenance.
denmark1 11mo ago
[dead]
denmark1 11mo ago
[dead]
a2128 11mo ago
I think AI generated issues and pull requests may lead to the death of GitHub as the place for open-source projects. As Microsoft is hell-bent on shoving easy AI buttons in every interface including GitHub, and as more people try to pad their GitHub profile for their resume, the burden for open-source projects to filter the low-quality spam may grow immense and it may become worth to just switch to Codeberg or other platforms. Some LLM use will inevitably leak into these other platforms but the relatively high barrier (no built-in AI buttons), effective moderation banning obvious violators, and reduced usefulness for resume padding would make it negligible I think.
noduerme 11mo ago
>>> the entire issue description contains so much unneeded (and probably incorrect) information that it'd be better if they just provided their LLM prompt as an issue instead When it's put this way, it seems a lot like the problem of people walking into doctors' offices with certainty that they know their own diagnosis after reading stuff on Reddit and WebMD. What this post actually amounts to, indirectly, is a plea to trust human expertise in a particular domain instead of assuming that a layperson armed with random web pickings has the same chance as an expert at accurately diagnosing the problem. This wastes the expert's time and just increases mistrust. The exceptions where Reddit solves something that a doctor failed to solve are what infuse the idea of lay online folk wisdom with merit, for people desperately looking for answers and cures. Makes it impossible to impose a blanket rule that we should trust experts, who are fallible as well. The problem is societal. It's that if you erode trust in learned expertise long enough, you end up with a chaos of misinformation that makes it impossible to find a real answer. A friend of mine who died of lung cancer recently, in his last days became convinced that he'd gotten it because of the covid vaccine (despite being a lifelong smoker, whose father had died of it at 41). And in every individual case you say, well, I don't want to disabuse someone of the fantasy they've landed on. This is a devastatingly bad way to raise a generation, though. Short-circuiting one's own logic and handing it over to non-deterministic machines, or randos online... how do we expect this to end?
- actionfromafar 11mo ago
  With great profit for the oligarchs.
NamlchakKhandro 11mo ago
Wouldn't you provide LLM friendly guidance material in your repo instead of spending effort on a pointless endeavor to ban them ?
- rester324 11mo ago
  I think OP wanted to have a proof that the submitter can demonstrate understanding of both the system and the code in the PR. So how would a guidance solve that? Also OP didn't want to ban them I believe
  - brabel 11mo ago
    > I think OP wanted to have a proof that the submitter can demonstrate understanding of both the system and the code in the PR. LLMs are really good at writing these. IF they think this will prove the author is human, they're mistaken.
    - cyphar 11mo ago
      > LLMs are really good at writing these. IF they think this will prove the author is human, they're mistaken. That is not my general experience. LLM explanations of code tend to add extra specifics that are incorrect, and the whole thing looks like LLM output (lots of short sentences, overly cheery, too many dumb lists, and being overly repetitive). Or course, a human could read the LLM output and then synthesise it in their own words, but they could also just read the code. I doubt someone will be able to convincingly act like they know what LLM code does just by consulting an LLM. If your patch took you no time or effort to write and you took no interest in what it does, why should I (as a maintainer) bother looking at it and maintain it for the next 10 years? In any other circumstances we would rightfully call this spam and see it as a socially hostile activity.
- SkiFire13 11mo ago
  If you plan to accept LLM contributions then a lot more effort will have to be spent on reviewing them.
brabel 11mo ago
It will be more interesting to see if and when AI becomes better than humans at coding, which seems to be coming close to reality, some projects may start accepting only AI contributions :D.
alyxya 11mo ago
Maybe the solution is to counteract LLM pull requests with LLM first pass reviews. Obviously not a perfect solution, but LLMs should be good enough at detecting spam. This only needs to apply to first time contributors who haven't yet proven themselves.
w10-1 11mo ago
Policy is a decent filter for consensual candidates, but mostly ineffective against incentives and automation. The issue is exported costs: whether submitters make reviewers work too hard for the contribution value. The policy/practice should focus first on making reviewer/developer's work easier and better, and second on refining submitter skills to become developers. The same is true for Senior/Junior relations internally. So the AI company that solves how to pare AI slop down to clean PR's would meet a real and growing need, and probably also help with senior/junior relations as well. Then you could meet automation with automation, and the incentives are aligned around improving quality of code and of work experience. People would feel they're using AI instead of competing with it.
mannicken 11mo ago
Oh man this is all really hurting my brain. I wish I had a good response to this. I wish I had a magical simple response and a way to resolve this problem. On one end, I stop by curl's H1 profile regularly and watch people just drown them in garbage. It's like LLMs have unlocked a portal to a new kind of stupidity that was dormant before. Netsec always had a problem with people running nmap -sV -sC -sX -Pn -p1-65535 --max-rate -T1 scanme.nmap.org -oS out.txt and then just sending that out.txt with a subject "I FOUND A VULENARBILATEAY" And like, a script kiddie isn't really a person... everyone has a script kiddie inside of us. But it feels like we took this wonderful technology of neural networks and we did capitalism with it and unleashed it into a business of making it easier for people to be stupid but feel smart while doing it. I really like the idea that we might learn something about our own consciousness by simulating neural networks with computers but the more I see how it's done in reality the more I want to puke my brains out. On the other hand, Matt Godbolt seems to use LLMs and I feel like I sure as hell wouldn't want to miss a PR from Matt fucking Godbolt. I mean even if I go full vanilla LLM-free I still am too addicted to using godbolt.org at this point and it was written partially with an LLM apparently. Argh, maaan I don't know this is too fucking complicated of a problem for me to solve. Fuck, maybe let's just destroy all this technology and live as neofarmers raising chickens? <Zero LLMs were used to write this post. In fact I went ahead and broke one GPU for every sentence I wrote just to make it harder for LLMs to compute.>
arpit15191 11mo ago
I think there is soon going to be such implementations globally, if not within organizations or smaller groups. The ease of using v/s actual quality content is really the question should be answered when deciding LLM policy.

185 points by dropbox_miner 11mo ago

There seems to be a bot that routinely creates huge LLM generated Issues on runc github: https://github.com/containerd/containerd/issues/12496 https://github.com/containerd/containerd/issues/12496 And honestly, its becoming annoying

QuiDortDine 11mo ago
Is there a way to ban specific users in your GitHub project? (I prefer GitLab, I'm sure if it had projects that are as popular it would be similarly inundated.)
- hobofan 11mo ago
  IIRC if one of the maintainers of a project blocks a user that prevents them from participating in issues and PRs. For bigger projects with many maintainers that can also lead to problems if people use the block function as liberally as on Twitter.

dropbox_miner 11mo ago

Curious to know if others are seeing a similar uptick in AI slop in issues or PRs for projects they are maintaining. If yes, how are you dealing with this? Some of the software that I maintain is critical to container ecosystem and I'm an extremely paranoid developer who starts investigating any github issue within a few minutes of it opening. Now, some of these AI slop github issues have a way to "gaslight" me into thinking that some code paths are problematic when they actually are not. And lately AI slop in issues and PRs have been taking up a lot of my time.

jmathai 11mo ago
At first, I thought "wow, this project has been inactive for some time and this PR is quite large". The use of emojis should have tipped me off :) https://github.com/photo/frontend/pull/1609 https://github.com/photo/frontend/pull/1609
Aurornis 11mo ago
I haven’t seen anything obvious, even including the other repos where I look through issues a lot. Maybe it’s only the really popular and buzzword-y repos that are targets? In my experience, the people trying to leverage LLMs for career advancement are drawn to the most high profile projects and buzzwords, where they think making PRs and getting commits will give them maximum career boost value. I don’t think they spend time playing in the boring repos that aren’t hot projects.
bohrbohra 11mo ago
AI slop attacks on the cURL project : https://www.youtube.com/watch?v=6n2eDcRjSsk https://www.youtube.com/watch?v=6n2eDcRjSsk

SoftTalker 11mo ago

I think everything has a growing problem with LLM/AI generated content. Emails, blog posts, news articles, research papers, grant applications, business proposals, music, art, pretty much everything you can think of. There’s already more human produced content in the world than anyone could ever hope to consume, we don’t need more from AI.

somenameforme 11mo ago
In some ways I'm starting to enjoy this. Do you remember the 419 scams? 'Hi, I'm a Nigerian prince named Michael Jordan. Give me $50 so I can buy some chemicals to clean a bunch of money I secretly stowed away and I'll send you $5000.' People actually used to fall for that. Of course some people probably still would (and a lot more certainly gets blocked by spam blockers) but I think overall society grew less substantially less gullible over time. But in general I think most people still remain excessively gullible and naive. Social media image crafting is one of the best examples of this. People create completely fake and idealized lives that naive individuals think are real. Now with AI enabling one to create compelling 'proof' of whatever lie you want, I think more people are becoming more suspicious of things that were, in fact, fake all along. --- Going back to ancient times many don't know that Socrates literally wrote nothing down. Basically everything we know of him is thanks to other people, his student Plato in particular, instead writing down what he said. The reason for this was not a lack of literacy - rather he felt that writing was harmful because words cannot defend themselves, and can be spun into misrepresentations or falsehoods. Basically - the argumentative fallacies that indeed make up most 'internet debates', for instance. Yet now few people are not aware of this issue, and quotes themselves are rarely taken at face value, unless they confirm ones biases. People became less naive as writing became ubiquitous, and I think this is probably a recurring theme in technologies that transform our abilities to transfer information in some format or another.
- PeaceTed 11mo ago
  The old quote of, 'You can fool some of the people all of the time, all of the people some of the time'. There is the hope that in dumping so much slop so rapidly that it will break the bottom of the bucket. But there is the alternative that the bottom of the bucket will never break, it will just get bigger.

lofties 11mo ago

Sidenote, but I love that in a GitHub issue discussing banning the use of LLMs, the GitHub interface asks if there's anything I'd like to fix with CoPilot.

b00ty4breakfast 11mo ago
That might be a contributing factor to this problem. the means to produce these bogus reports are integrated directly into so many dev tools nowadays.

vineyardmike 11mo ago

I've seen an uptick in LLM generated bug reports from coworkers. A employee of my company (but not someone I work with regularly) used one of the CLI LLMs to search through logs for errors, and then automatically cut (hundreds!) of bugs to (sometimes) the correct teams. Turns out it was the result of some manager's mandate to "try integrating AI into our workflow". The resulting email was probably the least professional communication I've ever sent, but the message was received. The only solution I can see is a hard-no policy. If I think this bug is AI, either by content or by reputation, I close without any investigation. If you want it re-opened, you'll need to IRL prove its genuine in an educated, good-faith approach that involves independent efforts to debug. > "If you put your name on AI slop once, I'll assume anything with your name on it is (ignorable) slop, so consider if that is professionally advantageous".

PeaceTed 11mo ago
Alas this is an issue of LLM generated code. Increased productivity but lessened understanding. If you can increase productivity while also increasing understanding then that will be a decent middle ground. All comes down to accountability.
theshrike79 11mo ago
That's just stupid. IF you want LLM code reviews, there are bots for codex, copilot, claude etc that plug straight into Github PRs and review the code automatically. Some of them are actually useful, some just plain wrong and some are subtly wrong and you need to spend some time figuring out whether it's right or wrong :) IMO it's still a net positive because LLMs tend to pick up really weird subtle errors that humans easily gloss over.

CGamesPlay 11mo ago

I make a lot of drive-by contributions, and I use AI coding tools. I submitted my first PR that is a cross between those two recently. It's somewhere between "vibe-coded" and "vibe-engineered", where I definitely read the resulting code, had the agent make multiple revisions, and deployed the result on my own infrastructure before submitting a PR. In the PR I clearly stated that it was done by a coding agent. I can't imagine that any policy against LLM code would allow this sort of thing, but I also imagine that if I don't say "this was made by a coding agent", that no one would ever know. So, should I just stop contributing, or start lying? [append] Getting a lot of hate for this, which I guess is a pretty clear answer. I guess the reason I'm not receiving the "fuck off" clearly is because when I see these threads of people complaining about AI content, it's really clearly low-quality crap that (for example) doesn't even compile, and wastes everyone's time. I feel different from those cases because I did spend my time to resolve the issue for myself, did review the code, did test it, and do stand by what I'm putting under my name. Hmm.

TingPing 11mo ago
I think it’s disrespectful of others to throw generated code their way. They become responsible for it and often donate their time.
- CGamesPlay 11mo ago
  I think it's disrespectful to throw bad code on somebody else, regardless of its provenance. And (as a professional who uses AI coding agents) I understand that LLM code is often bad code. But the OP isn't complaining about the deluge of bad code being submitted as PRs, they're complaining about LLM code being submitted as PRs. I've also been on the other side of this, receiving some spammy LLM-generated irrelevant "security vulnerabilities", so I also get the desire for some filtering. I hope projects don't adopt blanket hard-line "no AI" policies, which will only be selectively enforced against new contributors where the code "smells like" LLM code, but that's what I'm afraid will happen.
  - cyphar 11mo ago

jmyeet 11mo ago

Some years ago I read the Neal Stephenson book Anathem. SPOILERS: it has a version of the Internet called the Reticulum and one thing I remember is that it was filled with garbage. True information subtly changed multiple times until it was garbage. And there were agents to see through the garbage. I imagined this to be a neverending arms race. Honestly, this is kind of where I see LLM generated content going where you'll have to pay for ChatGPT 9 to get information because all the other bots have vandalized all the primary sources. What's really fascinating is you need GPUs for LLMs. And most LLM output is, well, garbage. What did you previously need GPUs for? Mining crypto and that is, at least in the case of Bitcoin, pointless work for the sake of pointless work ie garbage. I can see a future in our lifetimes where a significant amount of our capital expenditure and energy consumption is used, quite simply, to produce garbage.

PeaceTed 11mo ago
Considering how energy intensive generative content is, there is a good chance that it is already becoming a sizable share of energy use for the internet.
Gigablah 11mo ago
Humans are far more effective at producing garbage than LLMs will ever be :)
- andrewflnr 11mo ago
  They're really not, though. Creating garbage is the one ability at which LLMs are unarguably superhuman.
  - denmark1 11mo ago
    I think the opposite. LLMs do good work if you know what you’re doing across the board. Having 20 years experience writing code, it’s made things even better for me and even more fun. To those hating, they probably never wrote a system in their life.

zzo38computer 11mo ago

In stuff I maintain I hardly get anything at all, whether using LLMs or not, so it does not affect me much. Furthermore, I exclusively use the API, so the UI will not try to make you use Copilot and those things either (that is not the reason I use the API, although it is a side effect). I do not use Copilot, Claude, etc, although I partially agree with one of the comments there, that using LLM for minor auto-completion is probably OK, as long as you can actually see that the completion is not incorrect (although that should apply to other uses of auto-completion too, even if LLM is not used; but it is even more important to check more carefully if LLM is used). I think it would be better to not accept any LLM generated stuff otherwise (although the author might use LLM to assist before submitting it if desired (I don't, but it might help some programmers), e.g. in case the LLM finds problems with it, that they will then have to review themself to check if it is correct, before correcting and submitting it; i.e. don't trust the results of the LLM). It links to https://github.com/lxc/incus/commit/54c3f05ee438b962e8ac459262d509cfb8bcdf30 https://github.com/lxc/incus/commit/54c3f05ee438b962e8ac4592... (add .patch on the end of the URL if it is not displayed), and I think the policy described there is good. (However, for my own projects, nobody else can directly modify it anyways; they will have to make their own copy and modify that instead, and then I will review it by myself and can include the changes (possibly with differences from how they did it) or not.)

ninetyninenine 11mo ago

This is a minor issue. The big issue comes when we start complaining about code that's not generated by AI. When hand coded stuff becomes buggier than AI stuff.

tombert 11mo ago
You're being downvoted but I think I get what you're getting at. When I was doing my masters a few months ago, I would get my assignments rejected whenever I didn't run them through Grammarly first. I have nothing against Grammarly, it's a useful too, but I find that it has the tendency to reject things that (as far as I can tell) are still technically correct but don't have the "AI vibe" to it. I suspect that the graders are running things through Grammarly themselves and rejecting anything that it rejects. This is probably going to become increasingly more common as time goes on. It's hardly the worst thing in the world, but I do think it will lead to the only "accepted" writing being extremely plain and formulaic.
- hitarpetar 11mo ago
  what do you mean your assignments were rejected? like rejected for being AI generated?
  - tombert 11mo ago
    No, they weren’t AI generated. They have people judging grammar, and I think they will run it through grammarly to automate it. I wrote the stuff myself.
    - hitarpetar 11mo ago
      yeah yeah I got that I'm just confused what justification your graders gave for rejection. I've never heard of a paper rejected on account of grammar

bsder 11mo ago

A much bigger problem is that when an AI/LLM coughs up code, you have absolutely no idea what the copyright or license is.

PeaceTed 11mo ago
Copyright in the context of LLM's is kind of weird. It doesn't explicitly copy others code but it does lean heavily on the structure of it. Is it evidence of copying prior work or is it fair use? Alas, we don't really have any legal bearing that can handle this yet. If it is copying prior work, then you are right that there would be a lot of cross licensing bleed through. The opposite is also true in that it could take proprietary code structure and liberate it into GPL 3 for instance. Again what is the legal standing on this? Years back there was a source code leak of Microsoft Office. Immediately the Libre office team put up restrictions to ensure that contributors didn't even look at it for fear that it would end up into their project and become a leverage point against the whole project. Now with LLM's it can be difficult to know where anything comes from.
- bee_rider 11mo ago
  We don’t know if it is weird yet, right? It is just a big question mark. I guess as some point there will be a massive lawsuit. But, so much of the economy is wrapped up in this stuff nowadays, the folks paying for Justice System Premium Edition probably prefer not to have anything solid yet.
Aloisius 11mo ago
I assume any LLM contributions are uncopyrightable at best or copyright infringement at worst. Either way, I don't own the copyright. In order to avoid a potential future where I lose the copyright due to being unable to show a substantial portion is human authored, I try to keep track of what is AI authored and what is human authored. From a copyright perspective, right now accepting LLM contributions feels like playing with fire, at least for closed source projects.
cyphar 11mo ago
I completely agree, but it seems that our industry has decided to turn a blind eye to it. They might even get away with it -- the recent rulings around fair use with regard to Facebook and Anthropic's unrepentant copyright violations[1] was particularly galling to me. Almost all of the projects I work on require you to sign the Developer Certificate of Origin[2] (which attempts to protect projects from people submitting code that they know cannot be licensed under the project's license), and in my view LLM code you submit does not fulfill the requirements of the DCO. Unfortunately, it seems nobody actually cares about this either. [1]: https://www.debevoise.com/insights/publications/2025/06/anthropic-and-meta-decisions-on-fair-use https://www.debevoise.com/insights/publications/2025/06/anth... [2]: https://developercertificate.org/ https://developercertificate.org/

ddxv 11mo ago

I've seen an interesting politically motivated one. It didn't appear to be a bot, just a user from China: https://github.com/umami-software/umami/pull/3678 https://github.com/umami-software/umami/pull/3678 The goal is "Taiwan" -> "Taiwan, Province of China" but via the premise of updating to UN ISO standards, which of course does not allow Taiwan. The comment after was interesting with how reasonable it sounds: "This is the technical specification of the ISO 3166-1 international standard, just like we follow other ISO standards. As an open-source project, it follows international technical standards to ensure data interoperability and professionalism." The politics of the intent of the PR was masked. Luckily, it was still a bit hamfisted. The PR incorrectly changed many things and the user stated their political intention in the original PR (the above is from a later comment).

nl 11mo ago
Doubly interesting (and relevant to this discussion) is that it was an AI code review tool that detected the issues with the PR
komali2 11mo ago
One of these days I need to make a bot that scans FOSS repos for this kind of little pink nonsense behavior. The insecurity of wanting to call a place "country name, province of different country name" should alone be mocked. Imagine, "Ukraine, province of Russia," or "India, colony of The United Kingdom." Absurd on its face.
- theshrike79 11mo ago
  It's just information warfare, sign of the times. Every little thing counts, even if it's just changing names in an open source app like that.
- maxbiggaveli 11mo ago
  The problem with this is that, for some folks, its not absurd or nonsense because that is not considered a "country name" to them. It is considered a province name. So the inverse (calling a province a country) is considered absurd/nonsense.

benatkin 11mo ago

The issue expresses doubt about a policy specific to LLMs being accepted. I think the way to go might be to accept that the bar for outside contributions should unfortunately be higher. It doesn't take an LLM to have a glut of low quality contributions, it just takes an incentive and some attention, as we've seen with Hacktoberfest: https://news.ycombinator.com/item?id=31628342 https://news.ycombinator.com/item?id=31628342

xeeeeeeeeeeenu 11mo ago

Unfortunately, LLMs empower "contributors" who can't be bothered to put in any effort and who don't care about the negative impact of their actions on the maintainers. The open-source community, generally speaking, is a high-trust society and I'm afraid that LLM abuse may turn it into a low-trust society. The end result will be worse than the status quo for everyone involved.

wombatpm 11mo ago
AI seems like a rerun of the Eternal September problem that eventually killed internet news groups and a lot of email discussion lists.
wilya7 11mo ago
Everything is collapsing toward a low-trust default. At the end of this trajectory, we rediscover that the analog world becomes valuable precisely because it can't be infinitely replicated. Authenticity becomes the foundational currency. But everyone must master AI tools to stay relevant. The brilliant engineer who refuses AI-generated PR by principle will get replaced. Every 18-24 months, as capabilities double, required skills shift. Specialization diminishes. Learning velocity becomes the only durable advantage. These people cannot learn new tricks. Those who cannot question their assumptions cannot self-correct and will be replaced. The future belongs to the humble, the fluid, and the resilient. 60% of HN users is going toward a very tough time, and I am being very charitable with this assumption.
- cindyllm 11mo ago
  [dead]
- grayhatter 11mo ago
  [flagged]

shashankg09 11mo ago

This is a poor take. We need to stop slop and low effort issues/PRs. Stopping AI generated code is a lost battle because detecting that in high quality work is impossible.

o11c 11mo ago
If people can't make a good (PR, story, or whatever) without AI, they certainly can't do it with AI, because using the AI is strictly more difficult - it requires all the original skill, plus the skill to work around the AI's quirks. This is arguably isomorphic to Kernighan's Law: > Everyone knows that debugging is twice as hard as writing a program in the first place. So if you’re as clever as you can be when you write it, how will you ever debug it?
- wilya7 11mo ago
  Are you sure about that? Can you make the opposite case and steel-man it? Until you can, a stupid LLM will be smarter than you are. I can write a PR now. I can code now. Probably not as good as you can, but before LLMs I couldn't. I tried for decades learning to code. My brain is a Top-down network, I can see the big picture very quickly, but I cannot maintain focus to build bottom-up. Now I don't have to. I use LLMs to set the goal, to examine all corner cases, to define the milestones, to predict the wrong turns, to write a human-readable spec, to break it down to units of test code, to write the blue-prints of units of code. I can test them, and debug them with LLMs. The end result can be sub-optimal, but it runs, it does what I want, is well documented, and is maintainable. Before LLMs I couldn't do any of that. In doing all this, I get better at the bottom-up thing, just by trying. We are a spectrum of people. Do not assume the world is like you.
  - SkiFire13 11mo ago
    It seems either your LLM is 10x better than anything I've ever used or your standards are 10x lower.

kijin 11mo ago

I have a simple rule: whenever I receive an issue or PR from an unfamiliar account, I skim the text and/or code and post 1-2 quick questions. If the submitter responds intelligently, then the issue warrants a more in-depth investigation. If not, the submitter clearly doesn't think that the issue is worth following up on, so it's not worth my time, either. The more code a PR contains, the more thorough knowledge of it the submitter must demonstrate in order to be accepted as a serious contributor. It doesn't matter if it was written by a human or an LLM. What matters is whether we can have a productive discussion about some potential problem. If an LLM passes the test, well it's a good doggy, no need to kick it out. I'd rather talk with an intelligent LLM than a clueless human who is trying to use github as a support forum.

theshrike79 11mo ago
> I have a simple rule: whenever I receive an issue or PR from an unfamiliar account, I skim the text and/or code and post 1-2 quick questions. If the submitter responds intelligently, then the issue warrants a more in-depth investigation. If not, the submitter clearly doesn't think that the issue is worth following up on, so it's not worth my time, either. And if the submitter responds with "Great question! ...", what then? :D
- Blackthorn 11mo ago
  Ban them.
imiric 11mo ago
That's a reasonable first step, but a human can just as well feed your questions to the LLM, and post the responses. So you really have to be vigilant throughout your interactions with the author, or, if the PR is unsalvagable, save yourself some time and effort and reject it from the start. > I'd rather talk with an intelligent LLM There's no such thing.
- kijin 11mo ago
  The goal is not to filter out LLMs. The goal is to find and fix legitimate issues with my open-source software. I don't care if a human is feeding my questions to an LLM or an undead dog as long as they produce a decent signal. If the noise increases to an uncomfortable level, of course, I may have to change my strategies. The point is that humans produce noise, too, sometimes even more than LLMs do.

dSebastien 11mo ago

Prompt injection must be a really lucrative activity. I wonder how many hidden prompts will be detected on GitHub in the coming years and how many devs dare point LLMs at GitHub issues

blutoot 11mo ago

Since the cat is out of the bag (i.e. there's no stopping of LLM-generated code / PR / issues now that vibe-coding is fairly universally accessible), the only thing in our (especially those who are custodians of software systems and products) control is to invest a lot more in testing and evals. Just plain opposing LLM-generated content as a policy is a losing battle at this point..

catlifeonmars 11mo ago
I disagree. I think there’s a near future where this is true, but we’re still at the point where you can cut down on a lot of spam/slop by rejecting the class of LLM-generated content as a policy.
rester324 11mo ago
> to invest a lot more in testing and evals I don't think this will work. The same arguments could have been said to mitigate junior devs' work or short timeline/high stakes project technical debt and rarely ever anyone listened
- AlecSchueler 11mo ago
  Because there were other solutions at that time, but now the situation is materially different. I think we're already seeing a lot more test driven development as well as documentation of style norms that were necessitated by things like agents.md but whicj would have been useful ten years ago too, and it's still very early days

alexchantavy 11mo ago

As an open source maintainer, I don't have an issue with AI; I have an issue with low quality slop whether it comes from a machine or from a human. The responsibility then is for an open source project to not be shy on calling out low quality/low effort work, have good integ tests and linters, and have guidance like AGENTS.md files that tell coding robots how to be successful in the repo.

nightpool 11mo ago
What good does having integration tests and linters do when triaging issues? When trying to figure out if a bug report is hallucinated or not?
cyphar 11mo ago
> I have an issue with low quality slop whether it comes from a machine or from a human. It's very hard for a human to mask a low-quality PR as thought it were reasonable quality. It is incredibly easy for an LLM to do it (in fact that is precisely what they are trained to do). In addition, when I see a low-quality PR, I try to mentor the submitter. That doesn't make sense to do for LLMs (the submitter might not even bother reading my comments). > and have guidance like AGENTS.md files that tell coding robots how to be successful in the repo. If none of the maintainers use such tools, why is it our responsibility to maintain documentation to appease them (in the hopes of reducing spam)? A policy limiting their use is much simpler to write and requires less maintenance.

denmark1 11mo ago

[dead]

denmark1 11mo ago

[dead]

a2128 11mo ago

I think AI generated issues and pull requests may lead to the death of GitHub as the place for open-source projects. As Microsoft is hell-bent on shoving easy AI buttons in every interface including GitHub, and as more people try to pad their GitHub profile for their resume, the burden for open-source projects to filter the low-quality spam may grow immense and it may become worth to just switch to Codeberg or other platforms. Some LLM use will inevitably leak into these other platforms but the relatively high barrier (no built-in AI buttons), effective moderation banning obvious violators, and reduced usefulness for resume padding would make it negligible I think.

noduerme 11mo ago

>>> the entire issue description contains so much unneeded (and probably incorrect) information that it'd be better if they just provided their LLM prompt as an issue instead When it's put this way, it seems a lot like the problem of people walking into doctors' offices with certainty that they know their own diagnosis after reading stuff on Reddit and WebMD. What this post actually amounts to, indirectly, is a plea to trust human expertise in a particular domain instead of assuming that a layperson armed with random web pickings has the same chance as an expert at accurately diagnosing the problem. This wastes the expert's time and just increases mistrust. The exceptions where Reddit solves something that a doctor failed to solve are what infuse the idea of lay online folk wisdom with merit, for people desperately looking for answers and cures. Makes it impossible to impose a blanket rule that we should trust experts, who are fallible as well. The problem is societal. It's that if you erode trust in learned expertise long enough, you end up with a chaos of misinformation that makes it impossible to find a real answer. A friend of mine who died of lung cancer recently, in his last days became convinced that he'd gotten it because of the covid vaccine (despite being a lifelong smoker, whose father had died of it at 41). And in every individual case you say, well, I don't want to disabuse someone of the fantasy they've landed on. This is a devastatingly bad way to raise a generation, though. Short-circuiting one's own logic and handing it over to non-deterministic machines, or randos online... how do we expect this to end?

actionfromafar 11mo ago
With great profit for the oligarchs.

NamlchakKhandro 11mo ago

Wouldn't you provide LLM friendly guidance material in your repo instead of spending effort on a pointless endeavor to ban them ?

rester324 11mo ago
I think OP wanted to have a proof that the submitter can demonstrate understanding of both the system and the code in the PR. So how would a guidance solve that? Also OP didn't want to ban them I believe
- brabel 11mo ago
  > I think OP wanted to have a proof that the submitter can demonstrate understanding of both the system and the code in the PR. LLMs are really good at writing these. IF they think this will prove the author is human, they're mistaken.
  - cyphar 11mo ago
    > LLMs are really good at writing these. IF they think this will prove the author is human, they're mistaken. That is not my general experience. LLM explanations of code tend to add extra specifics that are incorrect, and the whole thing looks like LLM output (lots of short sentences, overly cheery, too many dumb lists, and being overly repetitive). Or course, a human could read the LLM output and then synthesise it in their own words, but they could also just read the code. I doubt someone will be able to convincingly act like they know what LLM code does just by consulting an LLM. If your patch took you no time or effort to write and you took no interest in what it does, why should I (as a maintainer) bother looking at it and maintain it for the next 10 years? In any other circumstances we would rightfully call this spam and see it as a socially hostile activity.
SkiFire13 11mo ago
If you plan to accept LLM contributions then a lot more effort will have to be spent on reviewing them.

brabel 11mo ago

It will be more interesting to see if and when AI becomes better than humans at coding, which seems to be coming close to reality, some projects may start accepting only AI contributions :D.

alyxya 11mo ago

Maybe the solution is to counteract LLM pull requests with LLM first pass reviews. Obviously not a perfect solution, but LLMs should be good enough at detecting spam. This only needs to apply to first time contributors who haven't yet proven themselves.

w10-1 11mo ago

Policy is a decent filter for consensual candidates, but mostly ineffective against incentives and automation. The issue is exported costs: whether submitters make reviewers work too hard for the contribution value. The policy/practice should focus first on making reviewer/developer's work easier and better, and second on refining submitter skills to become developers. The same is true for Senior/Junior relations internally. So the AI company that solves how to pare AI slop down to clean PR's would meet a real and growing need, and probably also help with senior/junior relations as well. Then you could meet automation with automation, and the incentives are aligned around improving quality of code and of work experience. People would feel they're using AI instead of competing with it.

mannicken 11mo ago

Oh man this is all really hurting my brain. I wish I had a good response to this. I wish I had a magical simple response and a way to resolve this problem. On one end, I stop by curl's H1 profile regularly and watch people just drown them in garbage. It's like LLMs have unlocked a portal to a new kind of stupidity that was dormant before. Netsec always had a problem with people running nmap -sV -sC -sX -Pn -p1-65535 --max-rate -T1 scanme.nmap.org -oS out.txt and then just sending that out.txt with a subject "I FOUND A VULENARBILATEAY" And like, a script kiddie isn't really a person... everyone has a script kiddie inside of us. But it feels like we took this wonderful technology of neural networks and we did capitalism with it and unleashed it into a business of making it easier for people to be stupid but feel smart while doing it. I really like the idea that we might learn something about our own consciousness by simulating neural networks with computers but the more I see how it's done in reality the more I want to puke my brains out. On the other hand, Matt Godbolt seems to use LLMs and I feel like I sure as hell wouldn't want to miss a PR from Matt fucking Godbolt. I mean even if I go full vanilla LLM-free I still am too addicted to using godbolt.org at this point and it was written partially with an LLM apparently. Argh, maaan I don't know this is too fucking complicated of a problem for me to solve. Fuck, maybe let's just destroy all this technology and live as neofarmers raising chickens? <Zero LLMs were used to write this post. In fact I went ahead and broke one GPU for every sentence I wrote just to make it harder for LLMs to compute.>

arpit15191 11mo ago

I think there is soon going to be such implementations globally, if not within organizations or smaller groups. The ease of using v/s actual quality content is really the question should be answered when deciding LLM policy.