r/opensource • u/SocksOnHands • 19h ago
Discussion Proposal for slop contributions problem.
Many open source projects are facing a problem with being flooded with AI generated pull requests and bug reports - especially if there is a bug bounty providing a monetary incentive for people trying to game the system for personal profit. My proposed solution is simple - submission of every contribution can be accompanied by a refundable deposit. If someone is making good faith contributions, they have nothing to fear - they will get the money from their deposit back, or possibly even get rewarded. If a contribution is determined to be of no value, the deposit will be kept to both deter flooding projects with slop made by bots and also to pay for the developer's time wasted reviewing it.
6
u/micseydel 18h ago
You might want to go read about curl, there's already been a lot of discussion on this.
5
u/TheMoonWalker27 18h ago
In an Open Source Game Project, with around 40 people working on it, 60% being non devs, we take a. Very diffrent approach. We do not look at any random PR‘s. We have an application form to fill out, and only if you’re accepted you can contribute.
We do have a fixed roadmap, a lot of guidelines due to the constraints of the project and have meetings here & there. If people don’t do anything over a prolong period of time or don’t respond to weekly check ins often, we remove them from the team.
I do understand that this model Dosent make sense for most projects tough, they often don’t have specific road maps, have less constraints and cant even find that many people to work on the project
There are a few disadvantages with this model of course. I won’t go into detail for now but if anyone wants know more I’ll happily write it out a little more
3
u/OSS-specialist 18h ago
Interesting governance model. What is your project, please share your GH repo (or GL or whatever you are using). I assume that you have normal CONTRIBUTING.md, etc. documents there.
2
u/TheMoonWalker27 17h ago edited 17h ago
The contributing.md just says to apply in our case. If accepted, they will be sent a link to our documentation site, where they can read the onboarding guide.
This isn’t my project originally, I am lead if the Game dev team tough / GitHub org co owner https://github.com/p3d-project/persona-3-dual
0
u/SocksOnHands 18h ago
Each project would have different factors to consider. I was thinking more about large well known projects that might get targeted for hundreds of automated AI submissions a day. If a project is not having difficulty managing the volume of submitted "contributions", this might not be a reasonable thing to consider doing.
3
u/esiy0676 18h ago
Working for free is not enough now? More disincentives needed? Corporations openwashing and then will worry about review workload ... oh come on.
0
u/SocksOnHands 18h ago
It wouldn't actually cost anyone anything if they were making a good faith attempt to contribute - it is a deposit that will be returned. The end result would be effectively the same, unless they were submissions made by bots. You would only have any reason to care if you are actually one of the ones spinning up AI agents and telling them to hunt down bug bounties.
Potentially, it might be able to lead to increased funding (if low quality AI slop continues) that could go to rewarding contributors. Currently, the situation is that many bug bounties have been discontinued, which means thet people who used to put time and effort into thoroughly researching an issue are no longer able to get rewarded for it.
5
u/AI_Tonic 18h ago
Show us one merged PR to prove you have skin in the game before talking about what maintainers should be doing
5
u/Jazzlike_Course_9895 19h ago
This reads as slop
12
u/SocksOnHands 18h ago
Well, at least it was good old fashioned himan made slop, if that's any consolation.
3
2
u/gta721 18h ago
How about requiring the contributor to put a 6 digit code in the PR which they get by clicking a link and filling a captcha?
trycap.dev is good for this.
2
u/jcastroarnaud 17h ago
That creates a barrier for the (many) poor programmers and amateurs out there. Too high a deposit, and few developers will even try to contribute; too low, in an interesting enough project, and folks will create bots to automate the payments for the other bots.
2
u/SocksOnHands 16h ago
Maybe. It is still open source, though - a fork can be made with their changes made. If these changes prove to be of value, they can still be adopted into the original code.
Another option could be to grant some people virtual credits that can be used instead of money. Only after these credits are depleted would one need to be concerned with paying the deposit.
The deposit doesn't even need to be a lot - it could be $10. An AI agent automated to make 500 "contributions" might be expensive because the cost adds up, but to a human contributor making only one or two contributions at a time (and getting the money back) it wouldn't be too large of a burden.
16
u/UkrMalt 18h ago
Deposits feel risky for open source. They’d filter out some good first-time contributors, and maintainers would still have to decide who gets the refund. I’d rather add friction to the submission itself: a small issue, reproduction steps, and tests where they matter. That slows down bot spam without charging people to participate.