Please stop flooding our projects with AI slop to furnish your CV
Please stop flooding our projects with AI slop to furnish your CV
请停止为了美化简历而用 AI 垃圾内容淹没我们的项目
Successful contributions to open source projects are a kind of currency. GitHub in particular encourages this in a number of ways: by showing avatars of contributors on repository pages, by showing your contributions to your followers via the activity feed and by signalling contributions per day on the activity graph of your profile. Potential hiring managers often take note of this. Recruiters often find and screen candidates this way. If you are a software developer (either existing or aspiring) looking for work, tuning these signals can often work to your advantage. 对开源项目的成功贡献是一种“货币”。GitHub 特别通过多种方式鼓励这种行为：在仓库页面展示贡献者头像、通过动态流向关注者展示你的贡献，以及在个人资料的活动图表中标记每日贡献。潜在的招聘经理经常会关注这些信息，招聘人员也常以此来寻找和筛选候选人。如果你是一名正在寻找工作的软件开发人员（无论是资深还是新人），优化这些信号往往能为你带来优势。
As an open source maintainer, it’s quite noticeable how the pattern of external contributions has changed in the last year. We’re far more likely to receive pull requests instead of issues. If we do receive issues, they often come with an AI-generated analysis attached. We’re receiving far more security vulnerability reports than ever before and often they even come with AI-generated fix proposals attached too. I don’t doubt that some of these contributions are from people who are genuinely interested in what we do, but the cynical part of me believes that a substantial amount of this is that people are realising that AI can be used to game GitHub to their own benefit. 作为一名开源维护者，我明显感觉到过去一年外部贡献的模式发生了变化。我们收到 Pull Request (PR) 的频率远高于 Issue。即便收到 Issue，通常也附带着 AI 生成的分析报告。我们收到的安全漏洞报告比以往任何时候都多，而且往往还附带了 AI 生成的修复建议。我不怀疑其中一些贡献者是真心对我们的项目感兴趣，但我悲观地认为，很大一部分原因是人们意识到可以利用 AI 来“刷”GitHub 以谋取私利。
It’s now easy to ask Claude to generate a list of interesting open source projects, then ask Claude to find some problems in them, and then ask Claude to raise some PRs to fix them. You don’t even have to use the projects or care about them, but you can easily create the illusion to outsiders that you care, or that you found a problem, or that you put the time into fixing it. On the internet, nobody knows you’re a dog, but with the help of LLMs, you can effortlessly overstate your human abilities on your GitHub profile. 现在，让 Claude 生成一份有趣的开源项目列表，找出其中的问题，并提交 PR 进行修复，变得非常容易。你甚至不需要使用这些项目，也不必关心它们，但你可以轻易地向外界制造一种假象：你很关心项目、你发现了问题，或者你投入了时间去修复它。在互联网上，没人知道你是一条狗，但在大语言模型（LLM）的帮助下，你可以毫不费力地在 GitHub 个人资料中夸大自己的能力。
Recently, a contributor with virtually no GitHub-wide contributions from late 2018 up until a couple weeks ago, with no prior engagement with our project that we know of, raised three separate PRs to correct spelling and grammar mistakes in comments. Claude made the fixes, presumably wrote the PR descriptions, even signed off the commits on behalf of the user and then helpfully inserted its co-authorship into the commit message trailers. Maybe it even opened the PRs itself, who knows. I’d be fascinated to know whether the prompt was to “go and find issues” or whether to focus on spelling and grammar issues in particular for whatever reason. 最近，一位从 2018 年底到几周前几乎没有任何 GitHub 全局贡献、且据我们所知此前从未参与过我们项目的贡献者，提交了三个独立的 PR，用于修正注释中的拼写和语法错误。这些修复是 Claude 完成的，PR 描述大概也是它写的，甚至还代表用户签署了提交记录，并贴心地将自己的“共同作者”身份插入到提交信息的末尾。谁知道呢，也许 PR 本身就是它自动提交的。我很好奇，当时的提示词（Prompt）到底是“去寻找问题”，还是出于某种原因专门针对拼写和语法问题。
The changes were harmless and correct, but that did not make me feel better about accepting or merging them. Instead I couldn’t help but ask myself: why this, why now? Why, out of all of the issues and TODOs and FIXMEs in our codebase are they submitting this? And then it dawned on me that these contributions weren’t about our project at all. I closed all three PRs without comment. Maybe this was unreasonable, but truthfully, I’m just not interested in encouraging people to take up our time with this kind of busywork. I do not want to set a precedent of accepting PRs that materially improve nothing, nor do I want our contributor list to become a reward for asking a robot to fix typos. 这些修改虽然无害且正确，但这并不能让我更乐意去接受或合并它们。相反，我不禁问自己：为什么是这些？为什么是现在？在我们的代码库中，有那么多真正的 Issue、TODO 和 FIXME，为什么他们偏偏提交这些？我突然意识到，这些贡献根本不是为了我们的项目。我没有发表任何评论就关闭了这三个 PR。也许这有些不近人情，但说实话，我并不想鼓励人们用这种琐事来浪费我们的时间。我不想开创一个接受“毫无实质性改进”的 PR 的先例，也不希望我们的贡献者名单变成“让机器人修改错别字”的奖励清单。
The same pattern has emerged with security vulnerability reports. CVEs traditionally are credited to their reporters, but all of the reports that we have received recently have been obviously AI-generated. Security fixes are always important of course, but again I find myself wondering if this is happening because people care about the fixes or because they are looking for an easy credit. We have been far more selective lately when evaluating the severity of such reports and, in some cases, declining to issue CVE notices for low-severity items. I have some feelings about the fact that private disclosure is dying anyway, which I may write about another time, but the effort involved in coordinating private fixes and disclosure notices and releases is substantial enough to require us to be selective. 安全漏洞报告也出现了同样的模式。传统上，CVE（通用漏洞披露）会归功于报告者，但我们最近收到的所有报告显然都是 AI 生成的。当然，安全修复固然重要，但我再次怀疑，这究竟是因为人们关心修复本身，还是因为他们在寻求轻松的“功绩”。最近，我们在评估此类报告的严重性时变得更加挑剔，在某些情况下，我们拒绝为低严重性的问题发布 CVE 通知。对于“私下披露机制正在消亡”这一事实，我有一些想法，或许以后会专门写文章讨论，但协调私下修复、披露通知和发布版本所涉及的工作量巨大，这要求我们必须有所选择。
Ultimately, open source is built on trust. The metric that matters is not how many pull requests you can persuade an LLM to produce, nor how many CVEs you can accumulate, but whether you can make a project meaningfully better. If you want to contribute to open source projects, contribute because you care. If all you want is another green square or another contributor badge, please go elsewhere. 归根结底，开源是建立在信任之上的。真正重要的指标不是你能说服 LLM 生成多少个 Pull Request，也不是你能积累多少个 CVE，而是你是否能让一个项目变得更有意义。如果你想为开源项目做贡献，请因为你在乎而贡献。如果你想要的仅仅是多一个绿色方块或多一个贡献者徽章，请去别处吧。