The primary spam problem isn't that a single account opens many pull requests on a single repo, but that spammer accounts open many pull requests spread across many repositories. So limiting accounts to a couple of open PRs on my repository won't help much.<p>I'd rather enforce a limit based on the number of PRs that account opened across all public repositories it doesn't have write access to within the last week. And PRs that were closed without getting merged should be held against the account somehow (perhaps via a "close as unwelcome" option for the maintainer).
I think this is a really solid move. This gives OSS contributors a lot of flexibility. You could set the limit to 0, and manually add contributors. You could set it to 1-3 to allow people to get their foot in the door. But the de facto limit today is infinite, which is spammed. Imagine if GMail did this! If I don't whitelist or reply within `n` emails, youre done. I would KILL for that.
I get a lot of emails that I want to get but never reply to. I would not want to have to remember to whitelist all of those.
HEY email service does something like that:<p><a href="https://www.hey.com/features/the-screener/" rel="nofollow">https://www.hey.com/features/the-screener/</a>
If you didn't take the time to write it, why should I take the time to read it?<p>This is a band-aid. Maybe even a good band-aid, because it'll keep individual contributors from flooring the zone. But the core problem is Github's model that assumes code is worth reading.<p>I'm much rather see the agent logs stapled to PRs. Make it easy to understand if there's a brain behind the suggested changes before engaging.
> If you didn't take the time to write it, why should I take the time to read it?<p>This is the fundamental problem. You have to look at the equilibrium. When you submit a PR, you're asking for some of my time. I have to figure out if it's likely to be worth it for me. If you have a track record of producing useful software that I have merged before, you're putting your reputation at risk when you submit a new PR, so it's probably good. If you start sending AI slop, I'm going to downgrade your reputation.<p>If you have no track record though, I'll probably at least take a glance since even if I'm not sure, at least you had to spend some time to write the code and put together the PR. Now that's not true.<p>My guess is we're going to have to create some new systems for reputation, maybe bond posting, maybe "sponsored" PRs, where someone trusted vouches for it, etc.<p>Incidentally, this doesn't just apply to PRs. It's emails, all kinds of other messages, reports, etc.
I don't often give GitHub credit, because I work with it every day and I encounter something frustrating or broken nearly every day ending in "day", but kudos to them for working on addressing the some of the big problems.<p>I also like the other features mentioned in the blog post. It won't make a difference to me and my daily work, but I'm glad that they are taking the criticisms seriously.<p>Though I have to admit that I'm a bit conflicted about this. Part of me also wants more people to move off of GitHub to help break their monopoly on code on the web, but I also don't want the people making and maintaining open source to give up their projects due to burnout and slop spam.
We should have agents to triage PRs. Their "smarter bypass signals" is already implemented by Mitchell Hashimoto's Vouch system: <a href="https://github.com/mitchellh/vouch" rel="nofollow">https://github.com/mitchellh/vouch</a>
also, close all issues and open them as you plan to work on them.
[dead]
Oh stop, the noise is apart of your business model to stay relevant.
I think, amusingly, the right thing to do for most open-source projects is to have each pull request summary and code read by an agent that just reimplements itself from a description of what the code is intended to be. Other people's code is not particularly valuable anymore.<p>There are some projects where you can provide a PR and they'll just reimplement and I think that's probably adaptive to the world where PR's are cheap and reviews are expensive.
There is also the solution of: No merge requests, just feature wishes and bug reports. All code is written solely by the maintainers (with the help of LLMs).
Being able to submit an issue, description, test criteria along with a token budget would be pretty cool.
Thats just a coding agent the "peopple" use via you, with extra steps.