I have sympathy for the OSS maintainers, and I don’t see it purely as a “Luddite” behaviour.

I expect the problem isn’t necessarily the AI generation itself, but the difficulty to distinguish between someone that’s really understood the problem domain versus someone with LLM-induced “Dutch courage”.

That in combination with a large uptick in volume of community interactions (issues, PRs, …) risks burning out OSS maintainers.

Perhaps giving it a few months/years for the flurry to die down, and for people to establish better best-practices for using these tools is the motive.

I agree 100%. If you open a PR, you need to add value somehow - having thought about the problem, understanding the code base deeply or just your time by thinking about a solution you can't otherwise get easily.

The problem is that the last part changed drastically with LLMs. You can get a lot of solutions easily by prompting an LLM. But that also means you don't need outside PRs for that anymore, and just prompt the LLM yourself.

That means two things in my opinion:

1) People haven't internalized that yet. For a lot of people, a functioning solution to a problem with often quite a bit of source code is equivalent to "adding value" - because in the past it was. It meant you thought about the problem, understood it and found a solution. But it was that thinking that added the value.

2) The minimum threshold for adding this "quality" rises quite a bit. A lot of problems can now be solved very fast with an LLM by someone who understands the code base well enough. You don't need a PR for that.

I suspect, that means in the future you could both get and need less contributions to OSS projects in general.

We'll see

I noticed some of them don't allow *external* AI contributions. Which makes sense -- you can trust the AI code more if it's signed off by someone who knows the project. The main problem is with AI contributions generated by people who are not familiar with the project, who don't understand their goals, architecture and design decisions.

The problem is why do I accept ai generated PR if I can generate myself?

> I expect the problem isn’t necessarily the AI generation itself, but the difficulty to distinguish between someone that’s really understood the problem domain versus someone with LLM-induced “Dutch courage”.

Some of that. Also sometimes there isn't even a person, just a bot opening a pull request that doesn't hear feedback.

There's also the problem that many projects put disproportionate effort into mentoring new contributors and helping them get things right, and that's valuable when there's a human learning something, but not when you're just correcting someone's LLM slop.

And that's leaving aside all the other problems, like "these things took all our FOSS code, ignoring its licenses, and then used it to compete with us and drown us out", or "these things are going to turn us all into paperclips".

Personally, I'd say the right way to use an LLM is to let it review your code, or be your rubber duck helping you design the architecture or evaluate the security model or similar, but not let it write the code for you. (Unless it's truly throw-away code, like "write me some code to benchmark X vs Y to evaluate which is better for my use case". In which case, the point wasn't the code, it was the numbers.)

[flagged]

[dead]

> Perhaps giving it a few months/years for the flurry to die down, and for people to establish better best-practices for using these tools is the motive.

This is naive, these projects do not have years or even months to wait, nor will it die down.

Due to attackers using swarms of abliterated models at even 1,000 TPS, these projects can be easily targeted to find vulnerabilities that these AI models can also build exploits for them.

These open source projects have no choice but to defend themselves with AI to quickly patch these bugs before the attackers find them.