Nestor G Pestelos Jr · Writing · Print

Debt With a Diff Attached

Published July 24, 2026. Revised August 28, 2026.

TL;DR

AI made contributing free, so volume no longer signals effort. Judge a contribution by whether it removes uncertainty for the next person or dumps cost on them, and filter with effort-based intake, not gatekeeping that also blocks newcomers.

The July 24, 2026 version is at debt-with-diff-attached-20260724.

In 2025 researchers gave the phenomenon a name: AI-DDoS. In "AI Slop is DDoSing Open Source", Sadia Afroz and colleagues describe "a denial-of-service effect in which plausible but low-quality AI-generated contributions overwhelm OSS community capacity." That is not just a paper's framing. The security engineer Seth Larson, working on curl and Python, spent the year asking people to stop pointing language models at bug bounties, because the reports looked real and wasted maintainer hours proving they were not.

For decades the cost of producing a pull request or filing an issue was itself the filter. Effort was expensive, so a high volume of contributions signaled real investment and capped what a maintainer had to handle. AI dropped the cost of production close to zero. Now volume no longer signals effort.

One question replaces the filter

Hiten Shah offers this replacement. Judge a contribution by whether it removes uncertainty for the next person or pushes the cost of resolving it onto whoever has to review, merge, or maintain it. An agent-written pull request that saves one person ten minutes and costs someone else an hour is "debt with a diff attached."

The real problem with AI slop is not that a machine wrote it but that it transfers a cost. A sloppy issue takes seconds to file and hands the maintainer its full ambiguity to sort out.

The bar is concrete

Production is the part that got commoditized. Bring context the maintainer lacks. Describe the behavior. Name the failure mode. Show an example someone can run. That is real work even when no code is written, because it changes the quality of a decision.

A lens, not a gate

The danger is turning the test into an automatic gate. As a rule for judging one contribution it is sound. As a volume reject it is the same kind of capacity defense the AI-DDoS study already measured. Projects that tightened review to protect capacity saw first-time contributors' merge ratio fall 18.18% below expected, the sharpest effect the authors found. They call it a rigidity trap: a project looks stable while its contributor pipeline erodes, and the cheapest defenses narrow pathways built over decades.

So the test stays a judgment you apply one contribution at a time. A filter tuned to reject transferred uncertainty also rejects the newcomer who would have learned to absorb it, and today's clumsy first pull request is often next year's maintainer. Hard gating carries a cost that lands later, in fewer of them.

Simon Tatham wrote the canonical version in 1999. A bug report exists to let the programmer see the failure, so the reporter's job is to spell out how to reproduce it. An issue template or a required reproducible example makes the contributor absorb the ambiguity in a standardized, learnable form. Anyone willing to do the work can meet a template, a first-timer included. Structured intake stops the transfer without closing the door.

A bot that bounces a bare report back for reproduction steps is structured intake at machine speed, because it sorts on effort. No bot supplies the judgment the contribution was meant to carry. Automation can route the ambiguity back to its author without doing that author's thinking.

Where the test does not fire

The test is about cost pushed onto someone who did not opt in. It is not an argument for polishing everything before you ship. The "Worse Is Better" tradition, from Richard Gabriel to Jamie Zawinski's Netscape years, is right that a working, imperfect thing in users' hands often beats a perfect thing still in development. You are not there to write code, Zawinski said, you are there to ship products. Ship rough when you are the one who pays for it. The test only fires when the bill goes to someone who did not.

I did not arrive at this as a spectator. It is the test I hold my own contributions to before they reach anyone else: remove the uncertainty, or do not send it.

Sources

Back to top