10 ms·

I've been helping a bit with OWASP documentation lately and there's been a surge of Indian students eagerly opening nonsensical issues and PRs and all of the co

• mikkupikku 9mo ago
  Heh, reminds me of that free T-shirt contest thing... Submit crap PRs to random FOSS projects for a chance of winning a shirt, what could go wrong? https://ongchinhwee.me/shitoberfest-ruin-hacktoberfest/ https://ongchinhwee.me/shitoberfest-ruin-hacktoberfest/
  • yawboakye 9mo ago
    worked well for a bit. but then the program became popular and that’s when it hit the curb. terrible loss, imo. it was a brilliant idea to encourage open source work with a token reward. it relied heavily on good intentions, which quickly disappeared with the popularity.
    • wink 9mo ago
      I have one of these and it was really nice in the first 1-n years. People gamified it and then it sucked, but the idea wasn't so bad. One would expect people would not stoop this low for a free T-Shirt.
      • ryandrake 9mo ago
        There is no limit to how low someone will stoop to get even a tiny token for free. I remember a local community fun event from a couple of years ago, which was set up by the library to encourage kids to read. They would count up these reading tokens at the end of it and give some tiny $2 teddy bear to the winners, and of course a bunch of adults swooped in, gamed the system, and all the toys went to them. People are totally shameless assholes when even an insignificant free prize is on the line.
    • blitzar 9mo ago
      this is why we cant have nice things
    • latexr 9mo ago
      It’s still ongoing. The difference is they now no longer offer t-shirts (at one point they planted trees instead, unsure if that still happens), and projects must opt-in.
      • david_allison 9mo ago
        They offered T-Shirts in 2025
        • latexr 9mo ago
          Thank you for the correction. I thought they had stopped that but I see you’re right. Seems to be more restrictive, though. https://hacktoberfest.com/participation/ https://hacktoberfest.com/participation/ > Swag - Get an exclusive Hacktoberfest T-Shirt, but its only for ‘Super Contributors’ who contribute 6 accepted PR/MRs to a worthy repository. (T&Cs Apply | Valid only for the first 10,000 contributors completing 6 PR/MR)
  • jcims 9mo ago
    Classic perverse incentive. From https://en.wikipedia.org/wiki/Perverse_incentive https://en.wikipedia.org/wiki/Perverse_incentive "According to the story, the British government, concerned about the number of venomous cobras in Delhi, offered a bounty for every dead cobra. Initially, this was a successful strategy; large numbers of snakes were killed for the reward. Eventually, however, people began to breed cobras for the income. When the government became aware of this, the reward program was scrapped, and the cobra breeders set their snakes free, leading to an overall increase in the wild cobra population."
  • sensanaty 9mo ago
    The funniest/saddest part is that you could just game it on your own repos, you never had to go out and spam any real projects. If you just made 5 PRs in a repo you owned with the appropriate hacktoberfest tags, that was enough to pass the mark and to get the free shirt and stickers.
• lukan 9mo ago
  I mean, if people adopt, I guess they can also flood the discussions with LLM nonsense. But for now it seems like the better solution.
• skeptic_ai 9mo ago
  Why you don’t just put an AI guardian to close or to ask them to change the story. Or shadow ban
  • mikkupikku 9mo ago
    Subjecting every real contributor to the "AI guardian" would be unfair, and shadow banning is ineffective when you're dealing with a large number of drive-by nuisances rather than a small number of dedicated trolls. Public humiliation is actually a great solution here.
    • johnisgood 9mo ago
      How effective is it against people who just simply does not care?
      • mikkupikku 9mo ago
        Most people do, and those who don't still get banned so...
      • metalman 9mo ago
        what you say, is of course the only relavent issue. I can attest to my own experiences on both sides of this situation, one running a small business that is bieng inundated by job seekers who are sending AI written letters and resumes, and dealing with larger companys that have excess capacity to throw at work orders, but an inability to understand detail, AND, AND!, my own fucking need to survive in this mess, that is forceing me to dismiss certain niceties and adhearance to "proffesional" (ha!), norms. so while the inundation from people from India(not just), is sometimes irritating, I have also wrangled with some of them personaly, and under all that is generaly just another human, trying to make by best they can, so....
      • notahacker 9mo ago
        I suspect people are doing it to pad their resume with "projects contributed to" rather than to troll the maintainers, so if they're paying any attention they probably do care...
• moralestapia 9mo ago
  >Indian students How do you know this?
  • nchmy 9mo ago
    Because their usernames are Indian and profiles have links to Indian universities, and sometimes descriptions of the 101 classes they're currently taking. That doesn't stop them from saying things like "I see this sort of vulnerability all the time"
    • normie3000 9mo ago
      Apologies - looks like you have clear evidence for the "student" part.
    • brikym 9mo ago
      Don't worry they'll change that too. Sadly I think we're going to need some kind of internet licence like a drivers license that they'd at least have to bribe their way into.
  • normie3000 9mo ago
    "Students" sounds very speculative. "Indian" likely based on usernames, which are often a South Asian first name followed by a random integer.
  • nasmorn 9mo ago
    Sir, I agree with moralestapia. Not a singular one of the 20 lakh lines in the PR were written by ChaiGPT.
    • moralestapia 9mo ago
      Lol. I found it of interest since it's quite hard to make an LLM write like a stereotypical Indian. If I was an Indian student, I would prompt it to avoid that style instead of keeping it. Also, generally, people can just make stuff up on the internet so ...
  • 9mo ago
• normie3000 9mo ago
  I've seen this - it's tiring even at low volume. Goes something like: Someone creates a garbage issue. Someone else asks to be assigned. Someone from the project may say "we don't assign issues" (this step has zero effect over later steps). Someone else submits a PR. Maybe someone else will submit another PR. Maintainers then agonise how they can close issues and PR(s) without being rude or discouraging to genuine efforts.
  • nchmy 9mo ago
    This is precisely what we've seen
  • thephyber 9mo ago
    Those maintainers should be using LLMs to crate their breakup letter with the Issue/PR submitters!
  • halapro 9mo ago
    You've been getting PRs? All I've ever seen is "can you assign this issue you me" spam and then disappear. I was nice to them for years but now I just delete the comment and block the users.
    • nchmy 9mo ago
      Yeah, the "can you assign the issue to me" is the most common. I don't even understand where it came from - does anyone ever actually formally assign issues to anyone? But they absolutely also create PRs even if you say "don't create a PR. You don't know what you're talking about"
      • halapro 9mo ago
        I'm pretty sure there's some guru/teacher that gives assignments to their students. The assignment is most likely "find a repo and ask if you can work on it." The student then either finds something easier to work on or gets points just for trying.
  • emmaviolet 9mo ago
• compounding_it 9mo ago
  >Indian students Resume glorification and LinkedIn / GitHub profile attention do that. I am seeing a lot of people coming up with perceived knowledge that's just LLM echo chambers. Code they contribute comes straight out of LLMs. This is generally fine as long as they know what it does. But when you ask them to make some changes, some are as lost as ever. Torvalds was right, code maintenance is going to be a headache thanks to LLMs.
  • thephyber 9mo ago
    Regard to code maintenance: I’m actually of the mind it will be easier IF you follow a few rules. Code maintenance is already a hassle. The solution is to maintain the intent or the original requirements in the code or documentation. With LLMs, that means carrying through any prompts and to ensure there are tests generated which prove that the generated code matches the intent of the tests. Yes, I get that a million monkeys on typewriters won’t write maintainable code. But the tool they are using makes it remarkably easy to do, if only they learn to use it.
    • johnnylambada 9mo ago
      I’m not sure why the downvotes. I think the poster is basically saying the same thing as this YouTube-er. I read “Million monkeys” as referring to LLMs. https://youtu.be/DNN8cHqRIB8?si=s2VBjZXrP21yziXa https://youtu.be/DNN8cHqRIB8?si=s2VBjZXrP21yziXa
  • blitzar 9mo ago
    > Resume glorification and LinkedIn / GitHub profile attention do that. I wondered why people would video themselves going around slapping strangers in public then shouting "its just a prank bro" - turns out it works.
  • coldtea 9mo ago
    >This is generally fine as long as they know what it does. Thanks to their LLM reliance they'd soon not know what it does, and forget even the little they know about coding
  • 9mo ago
• Havoc 9mo ago
  Noticed it in corporate context too. About 40% of the performance feedbacks I saw this year were AI written. India and USA crowd. Everything from Europe looked pretty organic but imagine that’ll change too next cycle
• causalscience 9mo ago
  > Indian students Is this cultural? I ran a small business some years ago (later failed) and was paying for contract work to various people. At the I perceived the pattern that Indian contractors would never ever ask for clarifications, would never say they didn't know something, would never say they didn't understand something, etc. Instead they just ran with whatever they happened to have in their mind, until I called them out. And if they did something poorly and I didn't call them out they'd never do back as far as I can tell and wonder "did I get it right? Could I have done better?". I don't get this attitude - at my day job I sometimes "run with it" but I periodically check with my manager to make sure "hey this is what you wanted right?". There's little downside to this. Your comment reminded me of my experience, in the sense that they're both a sort of "fake it till you make it".
  • nelox 9mo ago
    This sounds like a real cross-cultural mismatch, but it’s doing too much work with nationality alone. In a lot of Indian (and broader South Asian) work contexts, questioning instructions can be read as challenging authority or admitting incompetence, so people default to executing without asking. That’s often reinforced by education systems and contractor dynamics where producing something quickly feels safer than pausing to clarify. Add in time zones, language friction, and fear of losing work, and "just run with it" becomes a rational strategy. Meanwhile, many Western workplaces treat clarification and check-ins as professionalism, so the behavior reads as strange or careless. The key point is that this usually isn’t lack of curiosity or reflection, but risk management under different norms. The pattern often disappears once expectations are explicit: ask questions, check back, iteration is expected.
    • 4gotunameagain 9mo ago
      To add to that, it is culturally acceptable and even lauded in India to achieve something by "gaming the system", something usually considered unethical in the west (okay maybe less so in the US). I would be ashamed to submit an AI slop PR or vulnerability report. An indian might just say "I have 25 merged PRs in open source projects"
• password54321 9mo ago
  [flagged]
  • svantana 9mo ago
    Taught by whom? Without evidence, this just comes of as a racist trope. FWIW, the Indians I've worked with have all been very honest and dedicated to their work.
    • coldtea 9mo ago
      Taught by a general culture where this is even conceivable not just as a covert cheat but as a public outlook: https://www.cbsnews.com/news/indian-parents-scale-school-wall-to-help-students-cheat-on-exams/ https://www.cbsnews.com/news/indian-parents-scale-school-wal...
    • maccard 9mo ago
      Parent commenter is, as you’ve said just parroting racist tropes. Anecdotally, I’ve worked with quite a lot of South Asian people, and there is an art to communicating with them - they’re remarkably indirect but thrrr are certain signs that they disagree. If you apply the same amount of skepticism to an Americans “super awesome mega amazing” bluster, you’d be pretty close to the mark IME.
  • maccard 9mo ago
    > I have yet to meet one that hasn't openly admitted to grift or caught grifting. This is just lazy casual racism.
    • password54321 9mo ago
      [flagged]
• duckydude20 9mo ago
  i f8cking hate being born here. volume of low quality content, dsa/leetcode, etc. is so high, good people/content gets left out. networking, connections, nepotism so much high. getting job based on actual talent very rare. MNCs which are good outside are so much sh8t here; well capitalism doesn't give a f8ck anyways.
  • jddj 9mo ago
    > capitalism doesn't give a f8ck anyways It doesn't until suddenly it does. A glut of junk can eventually trigger a flight to quality. Sadly, possibly not on a timeline which works for a given individual.
  • dbtablesorrows 9mo ago
    I think you'll get downvoted to oblivion because outsiders often don't realize the ridiculousness of the whole thing. I will try to give some context. To give an example, the CSE undergrad from an average Indian college would've done 500 - 1000 leetcode "problems" for practice. But have little to no idea on how to survive in a UNIX shell, or to troubleshoot an actual problem. Hell, half of them haven't written more than 1000 lines of code for single purpose. People early in their career (which is most SWEs including yours truly) follow whatever "influencers" on youtube (the local term being bhaiyya-didis), who give them rough "roadmaps" to "crack DSA" or "get high paying remote job". The result is that average CS guy spends most of his time navigating this rat race than studying computer science stuff that matters for the job. I see similar kind of competition getting created at senior levels too, in the terms of people grinding theory and blog posts on "system design" interviews. I am not old^H^H^H senior enough to comment on it, though. But it was not all bleak. IIRC, We were producing quite few good OSS contributions through GSoC, LFX etc... until few years ago (not considering my own among good ones). There were talented 1% or so (I known a few very talented people in personally). Nowadays these "hustler" variety people have started "How to crack GSoC" roadmaps [sic] too, and the spamming quoted above see may be related to this. This sort of insane rat race is not good for talented people. It's not good for companies either. Recruitment is basically lottery at higher levels too; I have seen people use AI to shamelessly lie on their resumes and get hired etc... Some of these problems may be present in west but India's scale makes some of these problems difficult.
• tjpnz 9mo ago
  It's Hacktoberfest all year long, baby! https://joel.net/how-one-guy-ruined-hacktoberfest2020-drama https://joel.net/how-one-guy-ruined-hacktoberfest2020-drama
• throwaway85825 9mo ago
  Usually the protection against such spam is social shame but the internet is now full of people who have no shame because shame was never part of their culture. It would be more effective to use GeoIP in this case.
  • direwolf20 9mo ago
    Internet reputation became easy to launder, thus meaningless.
  • com 9mo ago
    It’s not just the Internet. It’s politicians and businesspeople and more generally, shameless citizens. There’s a lot to dislike about shame as an enforcement mechanism but I’m starting to miss some of the upside it delivered.
  • brikym 9mo ago
    I wonder how much of it could be stopped just by charging $5 a month to contribute to public open source repos. Even if github gave the $5 back in LLM credits or something it would at least put up a barrier. The reason there is so much traffic from third world countries is because the cost of accessing the internet is effectively zero.
    • OGEnthusiast 9mo ago
      GitHub has zero incentive to do this because it would hurt their analytics/metrics.
• bjourne 9mo ago
  The other side of the coin is that many real bug reports are dismissed out of hand. That is frustrating if you have spent hours or days triaging an issue and have submitted a well-written bug report. It would be useful if projects advertised what their de facto bug report policy is. If it involves snide remarks and pointless bureaucracy ("you did not check this box") then that should be stated to help others avoid wasting time. Perhaps an LLM could help with that: "The likelihood of an external bug report being acted upon is X%, given analysis of past interactions on bug tracker."
• MadameMinty 9mo ago
  I've noticed this also. But I didn't ascribe it to LLMs, rather figured there is some sort of rogue educator in India who's instructing students to do this on public repos and they just don't know better. But the prof should.
• ohyoutravel 9mo ago
  I contribute regularly to some major open source projects and it’s happening here too. So many issues that aren’t issues. Constant “fixing” of documentation that doesn’t need to be fixed. Bug reports that aren’t bugs, followed by a bad PR “fixing” the “bug.” Or YOLOing an LLM PR to change major behavior that users are relying on. And I click and the authors are always brand new, with only vibe coded or examples projects in their history, and have some truly awful LLM generated GitHub “about me” page complete with emojis and links to their GitHub “projects.” My suspicion is somehow the perception became that if you’re brand new and land a PR in a major open source repo (even as simple as rewording a phrase in a doc that doesn’t need to be reworded), that would help them get a job (they’re always Open to Work on their GitHub about me page). It’s so much noise that it’s hard to find the real issues.
  • nchmy 9mo ago
    Everything about this is exactly what is happening in OWASP repos.
    • Symbiote 9mo ago
      I pick the "block" option on the junk issue, and tick the "Send a user notification and show activity in timeline". The text says "A public timeline entry will show that this user was blocked" which I hope discourages them from wasting our time.
  • emmaviolet 9mo ago
    GitHub PM here. From what we've seen, you're right about the motivation; I've also seen plenty of job ads where "significant contribution to open source" is something that's called out explicitly as a valid substitute for professional experience in the area. While that's always well-intentioned and creates many benefits for the OSS community, the flip side is that it can also lead to the kind of problems you're seeing. Many new users are also motivated by learning and community, and not familiar enough with the community expectations to know how to seek that differently. We have tried a lot here in the past (good first issues, more community support for new users), but haven't found a perfect solution yet. Internally, we're looking at options for admins to disable PRs on repos, or limit PRs to collaborators only, for example. From your comment, it seems like part of the challenge you're experiencing as a user is around Issues specifically. We've also been looking at options to delete PRs and Issues individually and in bulk, which could help after the event. Would welcome any feedback on other paths we could take here.
• y-curious 9mo ago
  Reminds me of this Indian GitHub tutorial on how to open a PR on GitHub. The video got millions of views and has flooded a specific repo with countless README update PRs of people (mostly Indian) trying to append their name to the README. Article about it here: https://socket.dev/blog/express-js-spam-prs-commoditization-of-open-source https://socket.dev/blog/express-js-spam-prs-commoditization-...
  • efilife 9mo ago
    they flooded THE major server side js framework and it's happening to this day, every day. Express is something to backend what jQuery was to frontend 15 years ago
  • jcims 9mo ago
    Holy cow, what a mess - https://github.com/expressjs/express/pull/6956 https://github.com/expressjs/express/pull/6956
• vacillator 9mo ago
  It's likely because of Google Summer of Code. OWASP has participated as an org several times and it's highly likely that they'll participate this time too. Students often start making PRs around this time to get more familiar with projects before they can put in a proposal when the time comes. As someone who's been a programmer for a while now, I feel it's pretty easy to identify slop code and when someone is using an LLM to communicate on issues. I'm not against using LLMs for writing code or even for using it to improve your communication, but it cannot be a substitute for critical thinking. If I was a maintainer of an OSS project, I'd be more likely to _not_ select students who put out slop PRs, proposals, or messages without thought. And also make this clear in the contributing guidelines so contributors know what they're getting into.
• yokoprime 9mo ago
  I seem to remember there was a large (indian?) educational YouTuber who did a tutorial on how to use Git where they forked a FOSS repo, made a change to the README.md and then made a PR. This caused a huge influx of garbage PRs for that particular repo and other FOSS repos.
  • pelagicAustral 9mo ago
    The typo PR's are top-cringe.
    • phyzome 9mo ago
      I submit typo PRs sometimes. I just really like cleaning up docs, and some typos are important because they affect doc searchability. (But I do bundle them up so there's just one PR, and I generally won't do it for a single typo.)
    • discomrobertul8 9mo ago
      January 01 race to open hundreds of "update year in readme" PRs
• cactusplant7374 9mo ago
  What issue added GPU acceleration to Ghostty? It seems silly to add that to a terminal.
• zo1 9mo ago
  Yet again poor communal behavior ruining it for the rest of society, and why we can't have nice things and colonize the stars.
• raffael_de 9mo ago
  I'd argue that the or at least one major reason for the downfall of Stackoverflow (and not just a catalyst) has been a surge of Indian IT people triggering an avalanche of extremely low quality questions and answers. I've been a big fan of SO since about 2010. Not just didn't mind the harsh moderation but actually attribute to it learning how to properly ask a question. But at some point round about 2019/2020 it stopped being fun due to it going from knowledge base to garbage dump.
  • eudamoniac 9mo ago
    Related, every time you see on SO "please mark this answer as correct" it's usually not correct
• vablings 9mo ago
  Stuff like this video is a huge source https://www.youtube.com/watch?v=Ez8F0nW6S https://www.youtube.com/watch?v=Ez8F0nW6S Check the closed PR's on express https://github.com/expressjs/express https://github.com/expressjs/express Yikes!
• ZeroGravitas 9mo ago
  I was going to comment something similar. I was reading some GitHub comments earlier and the AI tone and structure in the comments posted by some users made me feel really uneasy for some reason. I know a Brazilian who puts lots of emails through ChatGPT because they aren't confident in their English, but this seemed to be AI generating the majority of the content of the message too.
  • coryrc 9mo ago
    That person should stop. I give a lot of leeway to anyway who ends with "(English is not my first language, sorry for mistakes)" or if they also post it in their original language (if I'm confused I can machine translate parts of it if the confusion isn't obvious, which it actually always has been for any continental language IME).
• zzzeek 9mo ago
  > everything starts as discussions - only maintainers create issues, and PRs can only come from issues. would be so awesome if github supported all that. probably kills their business model though
• anonzzzies 9mo ago
  Little bit offtopic; is anyone getting more reports of site vulnerabilities I wonder? There are how many AI tools claiming to find those automatically and we get a lot of reports, some even have the tool name on. Thing is, most, well, all so far in the past months, are not true. They seem hallucinations or false positives. We have closed source SaaS products, so these are external scans making these reports.
• deleted 9mo ago
  [deleted]