Nothing. And that's the problem -- the issue isn't "should a contributor be able to use AI" it's quickly becoming "is this entire contributor an AI agent". Every actual-human who gets a bad first experience hurts the project. The contributors having to be suspicious of new people hurts the project. The whole thing just sucks, and I don't know how to fix it.
I use claude-code, but the AI ecosystem and some of the autonomous tooling coming out of it -- which some people "helpfully" use irresponsibly and point at OSS projects they aren't personally invested in -- enables a LARGE amount of abusive behavior towards open source projects. This is even before we get into how many infrastructural resources crawlers eat up.
Me, and most other OSS contributors, signed up to be a mentor, to create software, to work together ... not to be the equivalent of a reddit moderator banning AI agents left and right.
I work on OpenStack, which is a project folks work on primarily due to sponsorship -- not many people who want to do security/stability work for a cloud "for the fun of it" :D.
So mentees I've worked with have usually come as part of a program, such as MLH[1] or Outreachy[2]. Other projects I've helped with mentoring have come from college programs or professors[3].
I have no idea how hard it is to get through the filters to get these opportunities; I know generally we ask them to only send us the best and that's worked out really well.
[1] https://www.youtube.com/watch?v=fbsI8l-MaFA is an interview done on my podcast (by the other host, Tabatha) with CID, who works with me on OpenStack Ironic. A little over 2 years ago, he was an MLH fellow (https://fellowship.mlh.com/) working with me -- now he's a maintainer on OpenStack and working on my team. This is an exceptional outcome, but he's not the only person who has found success via MLH that I know.
This is the second time I've seen this project mentioned on HN. Their white paper is very interesting and aligns closely with my interests but I don't see much on the main site about how to get involved.
Are they using their Matrix server to filter out drive-by/low-effort contributions?
I am the founder of the project. We accept every contribution that solves a problem, even drive-bys. Though they may often sit for a bit as we often merge in batches. If there is something missing, make a PR by all means.
Good. I want open source projects which serve infrastructure to be gate kept so that only responsible people are involved. Responsible people can use AI too. Get all of those people on board, and keep out irresponsible people!
Most people who wrote software before AI didn’t contribute to projects like Debian because it takes a certain passion and commitment. Just being able to write code is not the bar for entrance here.
This isn't talking about bespoke software, though. This is talking about upstreaming contributions to others. This puts a low barrier to create work and a lot more work for unpaid volunteers.
I don't care if a project uses AI or not, but I absolutely do care that they are firmly gatekept in alignment with their vision and team dynamics. Then I can choose projects whose gatekeeping policies I agree with.
There is never not an alternative to something, and I can always have my AI botch together my own version if I think this is going to get me better results.
As a beneficiary of Debian, this is good, you are praising Debian with feint damnation. I wish Debian had done more gatekeeping in the past on specific components.
I'd be impressed by an AI that can go against tons of training data by reversing the polarity of a common turn-of-phrase.
I was proud of that, and am slightly bummed to hear someone thinks it sounds AI-like. Also, I had a typo, its supposed to be "faint" (light) not "feint" (fake-out), though the latter worked out in context, and works by adding a homonym layer to the turn of phrase already turned on its head. 2 layers of smug, conceited cleverness - or 1 layer and a typo if you're not feeling charitable - that gets in the way of clear communication seems very human to me, YMMV.
Gatekeeping serves a useful purpose in any functioning organization of all scales, from a community center to a country, from an open source project to a Fortune 500.
I can't speak for all, but many mature open source communities have explicit or ad-hoc reputation schemes that are used to triage contributions. A fresh account means starting over with zero reputation, which in turn means your contributions wait at the back of the line.
Well. This is Debian, known for how strict they are about vetting developers. I just remembered Sladen refusing to key sign because my passport circa 2005 didn't have a machine readable slug in it.
In anonymous systems, where we don't use real names, your "handle" has an "age".
That becomes your most prized possession.
I have a reddit account thats over 12 years old. I have left the posts/comments open. That means, my "post history" becomes a way to advertise my skills.
I can reference comments from a year ago or 6 months ago about a certain topic to show how I handled something. That does have an effect on people.
As opposed to a random 1 day old account. No one takes them seriously, I guess the same is here as well
No one takes a 12 year old Reddit account seriously either. It's not a platform you can take anyone seriously. The biggest trolls have 12 year old accounts.
the age is not the measure of quality. the GP said they left the posts/comments open. anybody can read that and check if they are or not a serious contributor
Be extremely careful with that account then, because they ban accounts for the most minor things now. Stuff like posting evidence disproving something the moderator agrees with. And they ban your account from the whole site, not just from that subreddit any more. Automated algorithms also ban accounts for reasons that don't make any sense.
So if you're using your account to advertise yourself and look for jobs, I'd use it only for that. All off-topic discussion should be on a different account with a different physical device and IP address (reddit checks these things and cross-bans) that have never interacted with your main account.
this article is about the flood of junior developers who are producing enormous prs they’ve never seen full of untrustworthy code that a human hasn’t evaluated
arguing that it’s possible to make them by hand isn’t just missing the point; it’s missing the entire discussion
How would you generate enough large PRs to count as "spam"? You could add gibberish or delete random lines of code but it was obviously not plausible looking.
