Stop Flooding Open Source with AI Garbage for a Line on Your Résumé

Developer Neil Alexander has published a note on how the nature of third-party contributions to his open source projects has changed over the past year. A successful contribution to open code has long been a kind of currency: GitHub displays contributors' avatars on repository pages, surfaces activity in followers' feeds, and paints “green squares” on the profile graph. Recruiters and hiring managers pay attention to these signals — which means they can be tuned in one's own favor.

The illusion of participation

By the author's observation, instead of issues he now far more often receives ready-made pull requests, and not infrequently with an AI analysis attached. The flow of vulnerability reports is growing too — also with automatically generated fixes proposed. The logic, in Neil's view, is simple: you can ask, say, Claude to compile a list of interesting projects, find problems in them, and open PRs with fixes. Actually using the project or understanding it isn't required — it's enough to give outside observers the impression that you care and put in effort. On the internet nobody knows you're a dog, but with the help of language models it's easy to exaggerate your human abilities too.

Three PRs fixing typos

The author cites a concrete case: a contributor who had had almost no activity on GitHub since late 2018, without any prior interest in the project, suddenly opened three separate PRs fixing spelling and grammar in comments. The edits were made by an AI, which also, by all appearances, wrote the descriptions, signed the commits in the user's name, and helpfully added itself as a co-author. The changes were harmless and correct, but that didn't make it any easier. Why this, and why now, when the codebase is full of unresolved TODOs and FIXMEs? The answer, according to the author, is obvious: these contributions had nothing to do with the project itself. He closed all three PRs without comment.

He has no intention of going along with this kind of “busywork”: he doesn't want to set a precedent of accepting edits that improve nothing of substance, and turn the contributor list into a reward for asking a robot to fix typos.

CVEs as currency

The same picture has taken shape with vulnerability reports. Traditionally CVEs name the reporter, but lately every incoming report is plainly AI-generated. Coordinating private fixes and disclosure takes considerable effort, so the team has begun assessing the seriousness of such reports more strictly and sometimes declines to issue a CVE for insignificant cases.

The author's conclusion is simple: open source rests on trust, and the meaningful metric is not the number of PRs you talked a model into producing, nor the count of CVEs you've racked up, but whether you genuinely make the project better. If you want to contribute — contribute because you care. And if all you need is one more green square, look for it somewhere else.

Source: Hacker News