Top
Best
New

Posted by keybits 10/28/2025

We need a clearer framework for AI-assisted contributions to open source(samsaffron.com)
300 points | 154 comments
andy99 10/28/2025|
This is a problem everywhere now, and not just in code. It now takes zero effort to produce something, whether code or a work plan or “deep research” and then lob it over the fence, expecting people to review and act upon it.

It’s an extension of the asymmetric bullshit principle IMO, and I think now all workplaces / projects need norms about this.

solotronics 10/29/2025||
This problem statement was actually where the idea for Proof of Work (aka mining) in bitcoin came from. It evolved out of the idea of requiring a computational proof of work for sending an email via cypherpunk remailers as a way of fighting spam. The idea being only a legitimate or determined sender would put in the "proof of work" to use the remailer.

I wonder how it would look if open source projects required $5 to submit a PR or ticket and then paid out a bounty to the successful or at least reasonable PRs. Essentially a "paid proof of legitimacy".

strogonoff 10/29/2025|||
The parallel between PoW and barriers to entry many communities (be it Wikipedia editors or open-source contributors) use to sustain themselves seems apt.

Unfortunately, there is no community equivalent of PoS—the only alternative is introducing different barriers, like ID verification, payment, in-person interviews, private invite system, etc., which often conflict with the nature of anonymous volunteer communities.

Such communities are perhaps one of the greatest things the Web has given us, and it is sad to see them struggle.

(I can imagine LLM operators jumping on the opportunity to sell some of these new barriers, to profit from selling both the problematic product and a product to work around those problems.)

Frieren 10/29/2025|||
> (I can imagine LLM operators jumping on the opportunity to sell some of these new barriers, to profit from selling both the problematic product and a product to work around those problems.)

That is their business model. Use AI to create posts in LinkedIn, mails in a corporate environment, etc. And then use AI to summarize all that text.

AI creates a problem and then offers a solution.

My current approach is to look at new sources lie The Guardian, Le Monde, AP news, etc. I know that they put the work, sadly places like Reddit and such are just becoming forums that discuss garbage news with bot comments. (I could use AI to identify non-bot comments and news sources, but it does not really work even if it says that it does, and I should not have to do that in the first place either).

saulpw 10/29/2025|||
The community equivalent of Proof of Stake is reputation. You can't do anything until you've shown up for awhile and contributed in small ways, you gradually gain the ability to contribute in bigger ways, and if you are discovered to be malicious or corrupt or toxic, then your rights are revoked. The people who've gained this trust are presumably motivated to maintain it (although there's always the risk they sell their account/identity/soul for healthcare and do some damage before they're found out).
strogonoff 10/29/2025||
Reputation is always there in a community, regardless, in members’ minds. It’s just that not every community wants explicit quantified reputation, and I’m with them on that…
troupo 10/29/2025||||
> I wonder how it would look if open source projects required $5 to submit a PR or ticket and then paid out a bounty to the successful or at least reasonable PRs. Essentially a "paid proof of legitimacy".

Badly. You will alienate most legitimate contributors, and only leave spam bots subsidized by revenue from other sources

sails 10/29/2025|||
$5 could go towards a strict AI reject/review funnel as a prefilter
jsty 10/28/2025|||
It feels like reputation / identity are about to become far more critical in determining whether your contribution, of whatever form, even gets considered.
theshrike79 10/28/2025|||
Web of Trust will make a comeback. Both personal and on actual websites.

If I can say I trust you, the websites you trust will be prioritised for me and marked as reliable (no AI slop, actual humans writing content).

stevenhubertron 10/28/2025|||
Perhaps it's time for Klout to rise from the ashes?
pdonis 10/29/2025|||
> expecting people to review and act upon it.

But why should this expectation be honored? If someone spends close to zero effort generating a piece of code and lobs it over the fence to me, why would I even look at it? Particularly if it doesn't even meet the requirements for a pull request (which is what it seems like the article is talking about)?

hippo22 10/29/2025||
Because that's the definition of collaboration? Prior to the invention of LLMs, one could generally assume requests for collaboration were somewhat sincere due to the time investment involved. Now we need a new paradigm for collaboration.
pdonis 10/29/2025||
> Because that's the definition of collaboration?

I don't think the definition of collaboration includes making close to zero effort and expecting someone else to expend considerable effort in return.

sothatsit 10/29/2025||
The problem is that the sheer volume of low-quality AI PRs is overwhelming. Just the time it takes determining whether you should pay attention to a PR or not can add up when there are a lot of plausible-looking, but actually low-quality and untested, pull requests to your project.

But if you stop looking at PRs entirely, you eliminate the ability for new contributors to join a project or make changes that improve the project. This is where the conflict comes from.

saghm 10/29/2025|||
Since the bar to opening a PR has gotten lower, there's an argument that the bar for closing it might need to be lowered as well. I think right now, we consider the review effort to be asymmetric in part because it's natural to want to give the benefit of the doubt to PR authors rather than making a snap judgement from only a looking briefly at something; the current system seems to place a higher value on not accidentally closing a potentially useful but poorly presented PR than not accidentally wasting time on one that superficially appears like it might be good but isn't. I have to wonder if the best we can do is to just be more willing to close PRs when reviewers aren't sufficiently convinced of the quality after a shorter inspection regardless of whether we're 100% certain about whether that judgment is perfect. If "false positive" PRs that seem reasonable but turn out not to be are better at appearing superficially good, the best option seems like it might just be to be willing to throw out more "false negatives" that would be useful but aren't sufficiently able to distinguish themselves from the ones that aren't.

After a minute (or whatever length of time makes sense for the project), decide whether you're not fully confident that the PR is worth your time to continue reviewing, with the default answer being "no" if you're on the fence. Unless it's a yes, you got a bad vibe; close it and move on. Getting a PR merged will require more effort in making the case that there's value in keeping it open, which restores some of the balance that's been lost in the effort having been pushed to the review side.

nkrisc 10/29/2025|||
PR authors blow now need to spend energy and effort to make their PR appear worthwhile for consideration. AI PRs will have the effect of shifting the burden of effort to the PR authors (the real ones).

No more drive-by PRs.

_DeadFred_ 10/28/2025|||
My music/Youtube algos are ruined because when I flag I don't like the 100 AI songs/videos that it presents me each day the algos take it as my no longer liking those genres. Between me down rating AI music/AI history videos, Youtube now give me like half a page of recommendations then gives up. I'm now punished by Youtube/my experience is worse because Youtube's cool with hosting so much AI slop content and I chose to downrate it/try to curate if out of my feed. The way Youtube works today it punishes you (or trys to train you not to) for flagging 'don't recommend channel' when recommended a channel of AI slop. Flag AI and Youtube will degrade you algo recommendations.
aleph_minus_one 10/29/2025|||
> This is a problem everywhere now, and not just in code. It now takes zero effort to produce something, whether code or a work plan or “deep research” and then lob it over the fence, expecting people to review and act upon it.

Where is the problem? If I don't have the time to review a PR, I simply reject it. Or if I am flooded in PRs, I only take those from people from which I know that their PRs are of high quality. In other words: your assumption "expecting people to review and act upon it" is wrong.

Even though I would bet that for the kind of code that I voluntarily write in my free time, using an LLM to generate lots of code is much less helpful because I use such private projects to try out novel things that are typically not "digested stuff from the internet".

So, the central problem that I rather see is the license uncertainties for AI-generated code.

crote 10/29/2025||
You're still getting DDoSed. If you only accept PRs from pre-vetted people you'll inevitably be left with zero contributors: people naturally leave over time, so in order to maintain a healthy ecosystem you need to accept some newcomers.

Don't throw the baby out with the bathwater.

mnau 10/29/2025||
There is no healthy ecosystem. Most packages are one or two contributors. And have been for forever. Granted, it's Nuget, where MS is the giant that overshadows everything, but I have read a lot of about this and it's same everywhere.

https://opensourcesecurity.io/2025/08-oss-one-person/

AndrewKemendo 10/29/2025||
I think people are starting to realize what the “end of work” is going to look like and they don’t like it
softwaredoug 10/28/2025||
Anyone else feel like we're cresting the LLM coding hype curve?

Like a recognition that there's value there, but we're passing the frothing-at-the-mouth stage of replacing all software engineers?

mavamaarten 10/28/2025||
My opinion swings between hype to hate every day. Yesterday all suggestions / edits / answers were hallucinated garbage, and I was ready to remove the copilot plugin altogether. Today I was stuck at a really annoying problem for hours and hours. For shits and giggles I just gave Claude a stacktrace and a description and let it go ham. It produced an amazingly accurate thought train and found my issue, which was not what I was expecting at all.

I still don't see how it's useful for generating features and codebases, but as a rubber ducky it ain't half bad.

aydyn 10/29/2025|||
Well part of your problem is you are still using copilot. Its fully outdated compared to claude/codex. This tech moves fast.
mavamaarten 10/29/2025|||
Well, I gotta use whatever my organization whitelists and provides me a license for. I do use Claude models inside copilot (for Ask/Edit/Agent mode).
aydyn 10/30/2025||
Totally understand. My org only allows copilot by default. I convinced my manager to pay for claude, but it was a serious battle to point out how much better it is.
keyle 10/29/2025|||
This is a hundred percent true. I felt the same.

What has helped has been to turn off ALL automatic AI, e.g. auto complete, and bind it to a shortcut key to show up on request... And forget it exists.

Until I feel I need it, and then it's throw shit at the wall type moment but we've all been there.

It does save a lot of time as a google on steroid, and wtf-solver. But it's a tool best kept in its box, with a safety lock.

jermaustin1 10/28/2025|||
I've been skeptical about LLMs being able to replace humans in their current state (which has gotten marginally better in the last 18 months), but let us not forget that GPT-3.5 (the first truly useful LLM) was only 3 years ago. We aren't even 10 years out from the initial papers about GPTs.
dragontamer 10/28/2025|||
> was only 3 years ago

That's one way of looking at it.

Another way to look at it is GPT3.5 was $600,000,000,000 ago.

Today's AIs are better, but are they $600B better? Does it feel like that investment was sound? And if not, how much slower will future investments be?

jermaustin1 10/28/2025||
Another way to look at $600B of improvement was whether or not they used the $600B to improve it.

This just smells like classic VC churn and burn. You are given it and have to spend it. And most of that money wasn't actually money, it was free infrastructure. Who knows the actual "cost" of the investments, but my uneducated brain (while trying to make a point) would say it is 20% of the stated value of the investments. And maybe GPT-5 + the other features OpenAI has enabled are $100B better.

dragontamer 10/28/2025||
> And most of that money wasn't actually money, it was free infrastructure.

But everyone who chipped in $$$ is counting against these top line figures, as stock prices are based on $$$ specifically.

> but my uneducated brain (while trying to make a point) would say it is 20% of the stated value of the investments

An 80% drop in valuations as people snap back to reality would be devastating to the market. But that's the implication of your line here.

danaris 10/28/2025||||
And yet, we're clearly way into the period of diminishing returns.

I'm sure there's still some improvements that can be made to the current LLMs, but most of those improvements are not in making the models actually better at getting the things they generate right.

If we want more significant improvements in what generative AI can do, we're going to need new breakthroughs in theory or technique, and that's not going to come by simply iterating on the transformers paper or throwing more compute at it. Breakthroughs, almost by definition, aren't predictable, either in when or whether they will come.

troupo 10/29/2025|||
Why are you assuming exponential or even linear growth/improvement?

E.g. OpenAI went from "AGI has been achieved internally" to lying with graphs (where they cut off graphs at 50% or 70% to present minor improvements as breakthroughs).

The growth can easily be logarithmic

dekoidal 10/28/2025|||
Well, when MS give OpenAI free use of their servers and OpenAI call it a $10 billion investment, then they use up their tokens and MS calls in $10 billion in revenue, I think so, yes.
gwbas1c 10/28/2025|||
I feel like we need a different programming paradigm that's more suited to LLM's strengths; that enables a new kind of application. IE, think of an application that's more analog with higher tolerances of different kinds of user inputs.

A different way to say it. Imagine if programming a computer was more like training a child or a teenager to perform a task that requires a lot of human interaction; and that interaction requires presenting data / making drawings.

pona-a 10/30/2025|||
Oracle guided program synthesis. The user creates counterfactuals to the program output and the system tries to change its process to correctly process them.
nkrisc 10/29/2025|||
But how is that better?

As a parent, this sounds miserable.

jandrese 10/28/2025|||
When people talk about the “AI bubble popping” this is what they mean. It is clear that AI will remain useful, but the “singularity is nigh” hype is faltering and the company valuations based on perpetual exponential improvement are just not realistic. Worse, the marginal improvements are coming at ever higher resource requirements with each generation, which puts a soft cap on how good an AI can be and still be economical to run.
mwigdahl 10/28/2025|||
What are you basing that on? Haiku 4.5 just came out and beats Sonnet 4 at a third the cost.

GPT-5 and GPT-5-codex are significantly cheaper than the o-series full models from OpenAI, but outperform them.

I won't get into whether the improvements we're seeing are marginal or not, but whether or not that's the case, these examples clearly show you can get improved performance with decreasing resource cost as techniques advance.

crote 10/29/2025||
> I won't get into whether the improvements we're seeing are marginal or not

But that's exactly the problem!

Right now, AI performs poorly enough that only a small fraction of users is willing to pay money for it, and (despite tech companies constantly shoving it in everyone's face) a large portion of the user base doesn't even want to adopt it for free.

You can't spend hundreds of billions of dollars on marginal improvements in the hope that it'll hopefully eventually become good enough for widespread adoption. Nobody is going to give OpenAI a trillion dollars to grow their user base 50x over the next 15 years. They are going to need to show significant improvements - and soon, or the bubble will pop.

NewsaHackO 10/28/2025|||
>When people talk about the “AI bubble popping” this is what they mean.

You mean what they have conceded so far to be what they mean. Every new model they start to see that they have to give up a little more.

corytheboyd 10/28/2025|||
Maybe, maybe not, it’s hard to tell from articles like this from OSS projects what is generally going on, especially with corporate work. There is no such rhetoric at $job, but also, the massive AI investment seemingly has yet to shift the needle. If it doesn’t they’ll likely fire a bunch of people again and continue.
catigula 10/28/2025|||
It's been less than a year and agents have gone from patently useless to very useful if used well.
Larrikin 10/28/2025||
Useful if used well as a thought has gone from meaning a replace all developers machine to a fresh out of college junior with perfect memory bot to a will save a little typing if you type out all of your thoughts and baby sit it text box.

I get value from it everyday like a lawyer gets value from LexisNexis. I look forward to the vibe coded slop era like a real lawyer looks forward to a defendant with no actual legal training that obviously did it using LexisNexis.

catigula 10/28/2025||
The trajectory is a replace all developers trajectory, you're just in the middle of the curve wondering why you're not at the end of it.

The funny thing is you're clearly within the hyperbolic pattern that I've described. It could plateau, but denying that you're there is incorrect.

troupo 10/29/2025|||
> you're just in the middle of the curve wondering why you're not at the end of it.

You assume the curve is exponential.

We assume the curve is logarithmic.

We are not the same

Larrikin 10/28/2025|||
Where are you employed?
catigula 10/28/2025||
Why you ask a stranger on the internet for PII?

I'm genuinely curious as to what's going through your mind and if people readily give you this.

I suspect you're asking dishonestly but I can't simply assume that.

Larrikin 10/28/2025||
Every single one of your posts from the past two weeks is hyping up AI or down voted for being highly uninformed about every topic that isn't LLM hype related. You talk like a marketer of AI, someone that works adjacent to the industry with a dependency on these tools being bought.
catigula 10/28/2025||
> Please don't post insinuations about astroturfing, shilling, brigading, foreign agents, and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email hn@ycombinator.com and we'll look at the data.

You should delete this comment.

javier123454321 10/28/2025|||
I was extremely skeptical at the beginning, and therefore critical of what was possible as my default stance. Despite all that, the latest iterations of cli agents which attach to LSPs and scan codebase context have been surprising me in a positive direction. I've given them tasks that require understanding the project structure and they've been able to do so. Therefore, for me my trajectory has been from skeptic to big proponent of the use, of course with all the caveats that at the end of the day, it is my code which will be pushed to prod. So I never went through the trough of disillusionment, but am arriving at productivity and find it great.
visarga 10/29/2025||
There are 3 parts of the process the AI agent can't do - the start, the middle and the end :) No, really, they need humans to identify tasks worth working on, then guide the model during development and providing iterative feedback, and in the end we incur the outcomes, good or bad. We are the consequence sinks, we take the costs and risks on ourselves. LLMs have no accountability.
deepsquirrelnet 10/28/2025|||
I think that happened when gpt5 was released and pierced OpenAIs veil. While not a bad model, we found out exactly what Mr. Altman’s words are worth.
alwa 10/28/2025||
It feels that way to me, too—starting to feel closer to maturity. Like Mr. Saffron here, saying “go ham with the AI for prototyping, just communicate that as a demo/branch/video instead of a PR.”

It feels like people and projects are moving from a pure “get that slop out of here” attitude toward more nuance, more confidence articulating how to integrate the valuable stuff while excluding the lazy stuff.

user-the-name 10/28/2025||
[dead]
jamesbelchamber 10/28/2025||
> “I am closing this but this is interesting, head over to our forum/issues to discuss”

I really like the way Discourse uses "levels" to slowly open up features as new people interact with the community, and I wonder if GitHub could build in a way of allowing people to only be able to open PRs after a certain amount of interaction, too (for example, you can only raise a large PR if you have spent enough time raising small PRs).

This could of course be abused and/or lead to unintended restrictions (e.g. a small change in lots of places), but that's also true of Discourse and it seems to work pretty well regardless.

warmwaffles 10/28/2025|
Mailing lists are used as a filter to raise the barrier to entry to prevent people from contributing code that they have no intention of maintaining and leaving that to the project owners. Github for better or worse has made the barrier to entry much much lower and significantly easier for people to propose changes and then disappear.
r4victor 10/29/2025||
So far I prefer the Hashimoto's solution to this that "AI tooling must be disclosed for contributions": https://news.ycombinator.com/item?id=44976568

I use it like this: If a PR is LLM-generated, you as a maintainer either merge it if it's good or close if it's not. If it's human-written, you may spend some time reviewing the code and iterating on the PR as you used to.

Saves your time without discarding LLM PRs completely.

mexicocitinluez 10/29/2025|
But what does LLM-generated mean? What if I use CoPilot for completions? Is that considered "AI generated"? What if I grab the code from Claude, and update greater than 50%. Am I now taking ownership of it as my code?

It's like the ship of theseus

jrochkind1 10/28/2025||
Essay is way more interesting than the title, which doesn't actually capture it.
jamesbelchamber 10/28/2025||
The title seems perfectly engineered to get upvotes from people who don't read the article, which puts the article in front of more people who would actually read it (which is good because the article is, as you say, very interesting and worth sharing).

I don't like it but I can hardly blame them.

jrochkind1 10/28/2025||
Agreed. Sometimes such rage/engagement-bait titles get changed on HN, but it's risky to do as a submitter cause it's unclear when you are "allowed" to change the title. And I suppose if you want upvotes, why would you change the ragebait title?

Usually engagement-bait titles are cover for uninteresting articles, but yeah in this case it's way more interesting than the title to me anyway.

i guess it makes it even more obvious when people are discussing the title instead of the actual piece, which is routine on HN but not always obvious! Although to be fair, the title describes one part of the piece, sure. the part with the least original insight.

dang 10/29/2025||
Thanks for pointing this out—it made me take the time to find a sentence in the article body that could serve as a less baity title.

From https://news.ycombinator.com/newsguidelines.html: "Please use the original title, unless it is misleading or linkbait" (note that word unless)

jcgrillo 10/28/2025||
I guess the main question I'm left with after reading this is "what good is a prototype, then?" In a few of the companies I've worked at there was a quarterly or biannual ritual called "hack week" or "innovation week" or "hackathon" where engineers form small teams and try to bang out a pet project super fast. Sometimes these projects get management's attention, and get "promoted" to a product or feature. Having worked on a few of these "promoted" projects, to the last they were unmitigated disasters. See, "innovation" doesn't come from a single junior engineer's 2AM beer and pizza fueled fever dream. And when you make the mistake of believing otherwise, what seemed like some bright spark's clever little dream turns into a nightmare right quick. The best thing you can do with a prototype is delete it.
corytheboyd 10/28/2025|
Completely agree, I hate the “hackathon” for so many reasons, guess I’ll vent here too. All of this from the perspective of one frustrated software engineer in web tech.

First of all, if you want innovation, why are you forcing it into a single week? You very likely have smart people with very good ideas, but they’re held back by your number-driven bullshit. These orgs actively kill innovation by reducing talent to quantifiable rows of data.

A product hobbled together from shit prototype code very obviously stands out. It has various pages that don’t quite look/work the same, Cross-functional things that “work everywhere else” don’t in some parts.

It rewards only the people who make good presentations, or pick the “current hype thing” to work on. Occasionally something good that addresses real problems is at least mentioned but the hype thing will always win (if judged by your SLT)

Shame on you if the slop prototype is handed off to some other team than the hackathon presenters. Presenters take all the promotion points, then implementers have to sort out a bunch of bullshit code, very likely being told to just ship the prototype “it works you idiots, I saw it in the demo, just ship it.” Which is so incredibly short sighted.

I think the depressing truth is your executives know it’s all hobbled together bullshit, but that it will sell anyway, so why invest time making it actually good? They all have their golden parachutes, what do they care about the suckers stuck on-call for the house-of-cards they were forced to build, despite possessing the talent to make it stable? All this stupidity happens over and over again, not because it is wise, or even the best way to do this, the truth is just a flaccid “eh, it’ll work though, fuck it, let’s get paid.”

jcgrillo 10/28/2025||
You touched on this but to expand on "numbers driven bullshit" a bit, it seems to me the biggest drag on true innovation is not quantifiability per se but instead how organizations react to e.g. having some quantifiable target. It leaves things like refactoring for maintainability or questioning whether a money-making product could be improved out of reach. I've seen it happen multiple times where these two forces conspire to arrive at the "eh, fuck it" place--like the code is a huge mess and difficult to work on, and the product is "fine" in that it's making revenue although customers constantly complain about it. So instead of building the thing customers actually want in a sustainable way we just... do nothing.

We have to do better than that before congratulating ourselves about all the wonderful "innovation".

quxbar 10/28/2025||
If one claims to be able to write good code with LLMs, it should just as easy to write comprehensive e2e tests. If you don't hold your code to a high testing standard than you were always going off 'vibes' whether they were from a silicon neural network or your human meatware biases.
hoherd 10/28/2025|
Reviewing test code is arguably harder than reviewing implementation code because tests are enumerated success and failure scenarios. Some times the LOC of the tests is an order of magnitude larger than the implementation code.

The biggest place I've seen AI created code with tests produce a false positive is when a specific feature is being tested, but the test case overwrites a global data structure. Fixing the test reveals the implementation to be flawed.

Now imagine you get rewarded for shipping new features a test code, but are derided for refactoring old code. The person who goes to fix the AI slop is frowned upon while the AI slop driver gets recognition for being a great coder. This dynamic caused by AI coding tools is creating perverse workplace incentives.

Bengalilol 10/28/2025||
Shouldn't there be guidelines for open source projects where it is clearly stipulated that code submitted for review must follow the project's code format and conventions?
c0wb0yc0d3r 10/28/2025||
This is the thought that I always have whenever I see the mention of coding standards. Not only should there be standards they should be enforced by tooling.

Now that being said a person should feel free to do what they want with their code. It’s somewhat tough to justify the work of setting up infrastructure to do that on small projects, but AI PRs aren’t likely a big issue fit small projects.

isaacremuant 10/28/2025|||
Code format and conventions are not the problem. It's the complexity of the change without testing, thinking, or otherwise having ownership of your PR.

Some people will absolutely just run something, let the AI work like a wizard and push it in hopes of getting an "open source contribution".

They need to understand due diligence and reduce the overhead of maintainers so that maintainers don't review things before it's really needed.

It's a hard balance to strike, because you do want to make it easy on new contributors, but this is a great conversation to have.

portaouflop 10/28/2025|||
In a perfect world people would read and understand contribution guidelines before opening a PR or issue.

Alas…

flohofwoe 10/28/2025|||
> that code submitted for review must follow the project's code format and conventions

...that's just scratching the surface.

The problem is that LLMs make mistakes that no single human would make, and coding conventions should anyway never be the focus of a code review and should usually be enforced by tooling.

E.g. when reading/reviewing other people's code you tune into their brain and thought process - after reading a few lines of (non-trivial) code you know subconsciously what 'programming character' this person is and what type of problems to expect and look for.

With LLM generated code it's like trying to tune into a thousand brains at the same time, since the code is a mishmash of what a thousand people have written and published on the internet. Reading a person's thought process via reading their code doesn't work anymore, because there is no coherent thought process.

Personally I'm very hesitant to merge PRs into my open source projects that are more than small changes of a couple dozen lines at most, unless I know and trust the contributor to not fuck things up. E.g. for the PRs I'm accepting I don't really care if they are vibe-coded or not, because the complexity for accepted PRs is so low that the difference shouldn't matter much.

skydhash 10/28/2025||
Also there’s two main methods of reviewing. If you’re in an org, everyone is responsible for their own code, so review is mostly for being aware of stuff and helping catch mistakes. In an OSS project, everything’s is under your responsibility, and there’s a need to vet code closely. LGTM is not an option.
deadbunny 10/28/2025|||
As if people read guidelines. Sure they're good to have so you can point to them when people violate them but people (in general) will not by default read them before contributing.
kasey_junk 10/28/2025||
I’ve found LLM coding agents to be quite good at writing linters…
gwbas1c 10/28/2025||
> You can usually tell a prototype that is pretending to be a human PR, but a real PR a human makes with AI assistance can be indistinguishable.

A couple of weeks ago I needed to stuff some binary data into a string, in a way where it wouldn't be corrupted by whitespace changes.

I wrote some Rust code to generate the string. After I typed "}" to end the method: 1: Copilot suggested a 100% correct method to parse the string back to binary data, and then 2: Suggested a 100% correct unit test.

I read both methods, and they were identical to what I would write. It was as if Copilot could read my brain.

BUT: If I relied on Copilot to come up with the serialization form, or even know that it needed to pick something that wouldn't be corrupted by whitespace, it might have picked something completely wrong, that didn't meet what the project needed.

jongjong 10/28/2025|
2 months ago, after I started using Claude Code on my side project, within the space of days, I went from not allowing a single line of AI code into my codebase to almost 100% AI-written code. It basically codes in my exact style and I know ahead of time what code I expect to see so reviewing is really easy.

I cannot justify to myself writing code by hand when there is literally no difference in the output from how I would have done it myself. It might as well be reading my mind, that's what it feels like.

For me, vibe coding is essentially a 5x speed increase with no downside. I cannot believe how fast I can churn out features. All the stuff I used to type out by hand now seems impossibly boring. I just don't have the patience to hand-code anymore.

I've stuck to vanilla JavaScript because I don't have the patience to wait for the TypeScript transpiler. TS iteration speed is too slow. By the time it finishes transpiling, I can't even remember what I was trying to do. So you bet I don't have the patience to write by hand now. I really need momentum (fast iteration speed) when I code and LLMs provide that.

listenallyall 10/28/2025|
I dont mean to question you personally, after all this is the internet, but comments like yours do make the reader think, if he has 5x'ed his coding, was he any good to begin with? I guess what I'm saying is, without knowing your baseline skill level, I dont know whether to be impressed by your story. Have you become a super-programmer, or is it just cleaning up stupid stuff that you shouldn't have been doing in the first place? If someone is already a clear-headed, efficient, experienced programmer, would that person be seeing anywhere near the benefits you have? Again, this isn't a slight on you personally, it's just, a reader doesnt really know how to place your experience into context.
jongjong 10/28/2025||
I have a computer science degree and quite experienced. In the last 10 years, I've created a few side projects and also worked as a senior engineer professionally. I was engineer #3 at what later became the #1 biggest Maths e-learning platform in my country. I later built a popular distributed open source WebSocket pub/sub system which auto-scales on Kubernetes (with load balancing and sharding). I lead the development of the P2P layer of a $300 million+ market cap crypto project in Germany. I wrote a multi-chain Decentralized Exchange from scratch along with a minimalist PoS blockchain with support for instant finality. Then I wrote a multi-tenant no-code serverless platform to build/host any kind of app. Then (in part to demonstrate the search and indexing capabilities of the serverless no-code platform), I used this platform to build a multi-tenant people/company search platform which allows users to crawl the web and tag data using vector embeddings using a BFS algorithm (current side project). I'm still running all these projects in parallel because they require very little maintenance. My blockchain nodes have been running for 4 years straight. I restarted a node twice in 4 years due to infrastructure issue so very reliable.

Obviously, I suck at business and marketing. I only had one relatively financially successful product (my open source project, ironically) but I'm definitely able to build features quickly and in a stable way according to spec.

More comments...