You wake up, brew the coffee, open GitHub, and there it is, another pull request on your open source project.
13,000 lines added, no issue filed first, no discussion, just here, please review this for me.
Over the past year, GitHub activity has spiked roughly 12 times in a few short months, and a huge chunk of that signal is landing on the same small group of maintainers who are already stretched very thin.
The curl bug bounty got buried under AI-generated noise, jazz band, the home of Django classics like pip-tools, and the Django debug toolbar hit what its maintainers called an apocalypse and started sunsetting.
Even CorePython just shipped fresh guidelines on AI-assisted contributions this week.
So what does all this actually look like from the receiving end of the pull requests?
On this episode, Paolo Machare joins us to tell the story from inside the maintainer's chair.
Paolo is the director of the Django Software Foundation, an organizer of PyCon Italy, a Django's girls coach, and has spent the past year carefully collecting examples of how AI is reshaping open source contributions, the good, the bad, and the extra fingers.
We dig into his PyCon US talk on AI-assisted contributions and maintainer load, why AI is best understood as an amplifier rather than a new kind of contributor, the widely different policies across 86 open source foundations and projects,
and we ponder whether projects banning AI today are reacting to last year's models.
This is Talk Python To Me, episode 551, recorded May 22nd, 2026.
Welcome to Talk Python To Me, the number one Python podcast for developers and data scientists.
This is your host, Michael Kennedy.
I'm a PSF fellow who's been coding for over 25 years.
Let's connect on social media.
You'll find me and Talk Python on Mastodon, Bluesky, and X.
The social links are all in your show notes.
You can find over 10 years of past episodes at talkpython.fm, and if you want to be part of the show, you can join our recording live streams.
That's right, we live stream the raw, uncut version of each episode on YouTube.
Just visit talkpython.fm/youtube to see the schedule of upcoming events.
Be sure to subscribe there and press the bell so you'll get notified anytime we're recording.
What if your AI agents worked like FastAPI microservices, typed, autonomous, and discovering each other at runtime?
That's the world Agent Field is building.
Join them at talkpython.fm/Agent Field.
Hey friends, before we dive in, I want to share something I just launched over at Talk Python, a new course.
If you ship Python to production, you've probably had that quiet thought about what might be lurking in your code.
My new course turns that worry into a concrete workflow and a reusable AI security agent that's yours forever.
It's Python Web Security, the OWASP top 10 with agentic AI.
Check it out at talkpython.fm/AI dash web dash security.
The link is in your podcast player and on the episode page, or just go to talkpython.fm and click on courses at the top.
It should be right there.
So if you're interested in making sure the apps and APIs that you ship are secure, this is the course for you.
Welcome to Talk Python To Me.
Great to have you here, man.
Hi, Michael.
Thanks for having me and meeting you again after PyCon US last week.
We had a great time at PyCon.
I mean, I don't know how you feel about it.
Given all the work that you do, I suspect you feel similarly.
But to me, PyCon is like my geek holiday.
It doesn't feel like work.
It's like the reward for all the work throughout the year.
Yeah.
So for me, it's very nice to meet in person all these people that you talk with during the year.
And then finally, for a world week, you can chat with them, drink a beer together, or meeting also new people.
Yeah, absolutely.
It was tons of fun.
So we're going to talk about, honestly, I think it's going to be a fad, but we're going to talk about this new fad called AI.
Probably not going to last.
But in the meantime, it's kind of a hot topic at the moment.
So we're going to talk about AI and specifically your talk from PyCon about the effect of AI on open source maintainers, which I think is a perspective that many people don't consider.
Right?
There was this graph from GitHub saying, look, we're really sorry that GitHub is down a lot lately.
But here is the usage graph of GitHub.
And it did something like 12 times increase in activity over a couple of months.
I don't know, which I'm not necessarily totally going to give GitHub a pass on that.
But it is a signal and an indicator of just how much more the contributions, issues, pull requests are to GitHub.
Some of those are going to private repos or public one person repos.
But some of that traffic is going towards Django, Flask, Postgres, Curl, whatever.
Right?
And there's still one person or a couple of people on the receiving ends of those projects.
Yeah, it's true.
As I would say during my talk, I think AI here is a tool that amplified all the contribution, positive and negative effects.
So also small project or one-man project now have tons and tons of pull requests and issues opened in a very few months of time.
This is not the best thing to have if you have a very few time as a maintainer or you have also a job in the family.
So this is what I try to analyze in my talk.
It's tricky.
It's very tricky.
Now, before we get into a bunch of different things, primarily your talk, who are you?
Quick introduction for everyone.
Yeah.
Very quick one.
I am a software engineer from Italy.
I studied in Bologna and just after my career in the university, I started working with Python, which I never used at university.
But I started using Zope, which is a very old web framework from the 2000s.
And also, I think, we do work in the Zope Corporation back in the time.
But I liked a lot the backend work with database, relational database in particular.
So I jumped from the Plone community into the community in the Django one in 2011.
And I've been more and more involved.
Until today, I'm a member of the Django Software Foundation.
I'm a Python Software Foundation fellow.
And I tried to involve in a buddy initiative like Python Italia organization.
I founded the local Python Pescal in my city, local meetup.
And I tried to talk about Python, different conferences in person and remotely.
Nice.
Well, that will keep you busy.
That's a lot going on.
Let's actually just let me switch over here.
Let's just jump right into that.
I think maybe talking about some of your work.
You mentioned some of these in your introduction here.
But people are probably familiar with the Python Software Foundation.
But when you switch from Plone and Zope over to Django, you move to a place that has an incredible community.
It's probably the biggest community, organized community in all of Python.
That's not Python itself.
Maybe something in data science, but I don't think so.
I think Django has got the most gravity of all of these different organizations.
So it has its own software foundation with people that work for the Django Software Foundation and so on.
So you're the director of Django Software Foundation, yes?
Yeah.
Tell us about it.
Django, last year we had the 20th birthday.
So it's 20 years around.
Now this year, 21.
One of the oldest community that now is organized.
They created the foundation from the beginning.
So now it's one of the few projects with a big foundation and also a big community.
And we organized Django Cone since a long time now in different countries, in the US, in Europe, in Africa, in Australia.
We are starting also some initiatives like that in India.
And the foundation here has the role to preserve the community and the software.
I think the Django Software Foundation is one of the most interesting because we experiment a lot of solutions.
Also before the Python Software Foundation, for example, we started having the Django Fellow a long time ago.
And now the Python Foundation is the developer in residence, which is the same things.
We try to be involved in the various initiatives.
We create, we sustain the conference, the event as a Django Software Foundation.
For example, we give money for the organization of Django Girls Workshop all around the world.
Now we created, we are sustaining the Django Naut Space program, which has been the subject of the topic of the last keynote in PyCon US last week.
And other small initiatives like events or Django on the Mads.
So the goal of the foundation is to sustain the community, the various aspects of the community, and also have higher.
Now we have three Django Fellows that can be full-time working in triaging, helping the community to having the best code.
We can have released the version on Python of Django, sorry.
And yeah, this is the work we try to do every month.
It's amazing, really.
You think about it.
There's a lot of other Python web frameworks.
They don't have this.
You know what I mean?
There's a lot of data science groups and they have it.
You know, there's PyData.
So in a sense, it's somewhat, but that's all the PyData.
It's not, you know, pandas or whatever, right?
So this is really impressive.
And I think it's honestly one of the bits of the secret to the success of Django.
Yeah, I agree.
The fact that we had people that can dedicate full-time or volunteers in the boards.
We all are volunteer and they spend time during the week.
And then for the meeting to sustain all the working group we are creating now.
We try to defend the trademark of Django and sustain all the working group that we are now for the security part and for other things.
So the goalie here is trying to be organized a little to let everyone join the community and stay inside the community of Django.
Right.
You're also a, not that one.
I don't think I have a link for it, but you're a Django Girls coach as well.
What does that mean?
I mean, we know what Django Girls is.
It's like an organization that specifically supports women in tech by helping them get good at Django and providing community there.
But what does it mean to be a coach for Django Girls?
Yeah.
Django Girls is an initiative that started in EuroPython more than 10 years ago, if I remember correctly, or longer than that.
So they are workshops for one whole day.
And you invited girls and also low representative people in this workshop for free.
Being a coach there means only stay there with the people that join and help them through the process of completing the workshop.
There is a very good guide.
A lot of people can do at home, but being there for them means starting, creating a human connection with people, demonstrating them that their community is not only code, but also a person.
And I also organized two of these other than being coached here in Pescara.
The goal is to organize more of that.
And if you go on the website, you see that every week, a lot of this workshop happen everywhere in the world, from Australia to US, Europe, Africa, everywhere.
Yeah, very nice.
I think that's something that's super important for people to learn earlier, that there's more than just the code and there's more than just the docs and compiler or runtime errors and warnings and stuff like that.
The stereotype of a software developer, someone who is kind of antisocial, just sits there and, you know, holds themselves up in a basement or whatever.
And really, it's a team sport.
And I think that's coming back around to PyCon.
I think that's why PyCon is so interesting, because you make those, you put a face to the name and you realize, oh, there's all these people doing this and making this possible.
It's not just this, you know, pip install this package or whatever.
Totally true.
Python is a community-driven language, but it means that there is a whole community that sustains everyone.
100%.
Now, something else that Django has that's pretty interesting is DjangoNuts, DjangoNuts.space.
I had Sarah Boyce and Tushar Gupta on a while ago to dive deep into this, but this is a really interesting idea as well.
And I think this, pulling this up specifically, because I think it relates, it starts to get into the space of where your talk actually lands, right?
So when I first heard this, I thought, oh, this is to help people get good at Django.
But really, that's not exactly what it is, is it?
Yeah.
I remember seeing the first presentation of the program.
I was very impressed.
So if the Django Girls program helps people that do know anything about programming, start doing that.
This program wants to answer the question of people that already know how to program in Python or in Django, how to start be more involved and start contributing back to the code of Django in particular or other projects.
So now we added in the footer, you can see Beware, Wigdale, other initiatives, very connected with Python and Django.
So the goal is to have a small group of people with a navigator that can help them to start contributing, start reading an issue from the issue tracker, understanding how to contribute in the best effective way and to help them do the steps with other people that already did it.
And it's an accelerator for people that want to contribute back.
I was part of that once as a navigator, and that's been a very great experience.
And now I organize more than one per year, more than one session per year.
And it was great seeing all these people coming for the program and then staying to start contributing effectively.
You can track them on the code base or the blog of Django or these places that they contribute now.
And they go in, I forgot what they're called, but like cohorts or whatever, right?
That goes for a certain period of time.
And then you apply to be part of the cohort and then the cohort runs and so on.
So people out there can go apply.
It's free, right?
You just have to get accepted.
Yeah.
A lot of people apply.
There is a review of the application.
So the admins form a small group of four people, of three or four people with a navigator that can add them.
And then there is a period of six weeks.
And during the while they meet once in a while, they can work to each other because they have a chat.
And they have a way to track all the things they learn, the attempt to contribute.
And they are together as a team for this part of the year, helping them each other and having feedback.
We have a lot of initiative during this period, like talks and meeting online.
And a way to have a support also for things that happen in life is a small version of what can happen for real and the whole community.
When you meet people and you not talk only about the code, sometimes you talk about what happens live, job, other multiple things.
This is a small version of it.
Nice.
You know, there's at least people who are junior developers or earlier stage developers.
I think there's a pretty real challenge of getting a job right now.
And contributing to open source is certainly one of those areas that helps you stand above.
Certainly on a popular project like Django, if you go around and say, yeah, I'm a Django core developer, contributor or whatever, that would make a big difference.
Right.
So I think projects like this, you know, people are really super excited.
Maybe this is a good opportunity to put another feather in the cap or something good on the resume, you know?
Yeah.
Every time I met some new partners in the community, also in my job, every time I pushed them to try to contribute back.
It's good in your resume, if you can show that you contributed.
But more than that, you learn so much in contributing to Django, respect of only using Django in your daily job.
because you are forced to go in the internals of Django with the help of the core contributors.
You can work also in one of the biggest companies, but it's impossible that you have so many skilled Django contributors or Python contributors when you contribute directly with the code.
And it's the fastest way to improve as a developer.
It's more important than having something to put in your CV.
I think it's an accelerator of your learning.
So I've seen multiple people who come out of university or other things like that, gotten onto an open source project and it's just skyrocketed their career, which is super cool.
This portion of Talk Python on Me is brought to you by Agentfield.
What happens when you give hundreds of AI agents a shared code base and let them write code, review each other's work and ship to production?
Well, that's exactly what the team behind Agentfield AI built.
And the wild part, it's not some proprietary system locked behind a paywall.
It's an open source Python library.
Now, where most agent frameworks have you wiring up DAGs and workflows, Agentfield lets you build AI agents the way you build FastAPI microservices.
Think typed Python functions that become autonomous services.
They discover each other at runtime, call each other like APIs, scale independently, fail independently, and recover on their own.
And here's the thing.
You're not just orchestrating LLM calls.
You can orchestrate entire anonymous tools.
Spin up multiple Claude Code instances, codex sessions, any coding harness you want, all running as live nodes on the same architecture, collaborating and verifying each other's output.
That's how they build the factory.
And it's completely free and open source.
Check it out at talkpython.fm/agentfield.
That's talkpython.fm/agentfield.
The link is in your podcast player's show notes.
Thank you to Agentfield for supporting the show.
Okay, last thing before we dive into your main topic is PyCon Italy organizer.
And this is coming up.
First of all, I love the website design.
It looks very fun.
But it's coming up really soon.
Basically seven, no, five days from now from recording.
So people, I think this episode will actually come out after that in terms of on the podcast channels.
But on the YouTube channel, at least, we can encourage people to attend if they're local, somewhat local, or want to just go to Italy for a few days.
Yeah, yeah.
So I started, PyCon Italy is, of course, my preferred conference because it is the first one that I started attending a long time ago.
And after a while, I decided to be involved and help other organizers to organize it.
It will happen next year.
After a long time being organized in Florence, this year we moved, the last year we moved in Bologna.
And now we have a wider venue.
So last year we had more than 1,000 people.
90% of the talk.
Yeah, it's quite big.
90% of the talk are in English.
The keynote, the workshop, we have multiple tracks, I think.
Six tracks plus the workshop and the keynotes.
We usually organize social events like drinks and dinner with local food, of course.
It's from Italy.
And we have the same approach as other community-driven conferences like PyCon US or Europython.
But we give a lot of importance to maybe the lunchtime.
We've spent two hours for having lunch because we think it's a way to network better with other people, with proper food and wine and other things.
You see, we have very great keynotes.
The one you are showing from different communities.
Diego is on the PyCon core team.
Sarah is one Django fellow.
And Dawn is involved in community and so many different things, PyLadis and other things.
And we try to attract a lot of people from Europe.
Usually, a lot of people from Europe and US attend because they can then spend other days traveling around in Italy, which is not bad.
And Bologna this year and also last year is a way to be the central part of Italy.
And traveling very easy to all the other parts of Italy, like you can go in Florence in 30 minutes by train.
The train system works very well.
And yeah, we have the first day, which is open and free for everyone.
So if people listen to you in YouTube, they want to join, they don't have a ticket or they cannot afford it.
The first day is day for beginners.
There is workshop for free for everyone.
You only have to go there and show up without a ticket.
It's a way to bring people, start attending a conference like that, participate in Jungle Girls workshop or other workshops.
It can help you be more involved.
And if you understand only now that you cannot attend because it's too late, you can join us next year because for sure we will have the same enthusiasm, the same great people.
That sounds great.
Do you have a mailing list or something people can sign up for?
Yeah, I think it's in the contact here in the website.
Yeah, on the footer, you can, you can join there and there is a group on Telegram.
There are the mail, the mail for be contacted.
We can share maybe the link in the description of the podcast.
Perfect.
Yeah.
And of course, yeah, yeah.
And of course, if your company is interested, you can sponsor the comfort because there are a lot of opportunities to, you know, meet people, hire developers and, or connect with other communities.
So it'd be great.
Yeah.
Very cool.
All right.
Let's, let's talk about your talk here.
Perfect.
Yeah.
Let's, let's dive into it.
So you do, your talk was AI assisted contributions and maintainer load over here at, at PyCon, which there's your, your selfie getting ready.
That's cool.
Yeah.
I did it at the last moment before closing with, with, with Simon Wilson, was the host of the AI track.
Yeah.
So this was definitely in the, I thought it was cool.
They had an AI track, right?
Yeah.
It was the first one in the track.
There was a security track and an AI track.
And I'll tell you what, the AI track was hacked.
There was a lot of people in those talks.
So I thought that was really cool.
Yeah.
So tell us a bit about your talk and then we can dive into, you know, you had a bunch of like pull quotes, little examples from different maintainers and luminaries and so on.
So I thought we could kind of talk through those as a way to cover in the topic, but tell people a bit about high level about your talk.
Yeah.
So the idea for the talk came to me when I started seeing more and more contribution in the Django project or Python or connected projects, open source project in general.
So, since the last year, I started seeing more and more contribution, very strange to be go to wide as a scope and maintainer start complaining about it.
And I collected the tons of them.
Then I selected a few to show in the, here in the talk.
The point was that using AI is a good thing.
It's a, it can be a good thing.
It's a tool that can improve your productivity during the day.
If you know how to use it, but can be also, bad things for maintainer that have to filter and review more pull requests than before, more issue or bigger
pull requests without having in the other side, someone that know what they are sending to you because they can create a lot of code very easily.
But maybe if they are not careful, they cannot understand what they are proposing to merge.
And in the process of this month, the past year, I was seeing that this was accelerating.
It was accelerating a lot from very few.
Yeah.
I found, I've yeah, I found that graph, on GitHub in it's, I mean, you cannot imagine a more vertical increase in usage.
And I'll put this in a link in the show notes for people, but it's, it's crazy, right?
And that's what the maintainers are experiencing.
Exactly.
So I was collecting all this information, realizing that it was a scalar rating.
And so after collecting a lot of them also, because in the, also in the jungle community, we were observing this amount of requests.
Then I, started singing different, project and we started reasoning on how to do, how to face this amount of requests.
we created a, working group in the jungle community or the AI.
We started doing some work workshop and I wanted to share what was happening.
I don't share any solution, how to face it, but I was interesting to, to share what was happening and what different project were doing to face it.
Yeah.
It's, it's a challenge.
It's definitely a challenge.
so let's go through, I think we can, you're a big fan of movies.
I can tell you have a lot of movie quotes and the space odyssey and other ones.
I introduced my daughter to the concept of, how and, and the space odyssey when she first learned about AI and she thought it was the most amazing thing.
Yeah.
True.
So let's see, here we are.
All right.
So the first quote comes from Ken, which, which Ken is this?
You remember?
Ken Thompson was the co-creator of, co-creator of Unix.
Yeah.
Cool.
And so the quote is, you can't trust code that you did not totally create yourself.
I think this is an interesting way to start this conversation because this comes from a time far before open source, right?
Unix was created quite a while ago and there's something true to this, but I also think you, you don't, you can't necessarily trust code that you did write yourself.
Yeah.
For complicated systems.
And I think we've seen that you, you can actually trust code in the right systems with the right guardrails.
Like look at Django, for example, most of the code that you run when you run Django, even if you're a core developer, you yourself didn't write.
Right.
Simon Wilson and a few other folks who created it, even they probably didn't write most of the Django code at the way it is today.
Right.
Yeah.
So that you can still find some code that they wrote, but now there are so many contributors.
Yeah.
I showed these quotes and also the previous one, not because I think they were totally right in general, but to show people that the fear of new technology has been something in the Howard community that started from the beginning of open source from the late seventies.
And it is normal that when a new technology like AI show up, the first reaction can be both refusing it totally, or maybe to embrace it because it's something sucking in new.
And, I wanted to show that some quotes from the past apply also perfectly today from some reaction we are seeing in the community.
Yeah.
It's very, it's a good quote.
And it's, and I like the idea of you putting it there.
It's, it's easy to feel like this is a brand new problem in some ways.
And it is a brand new problem, but not entirely.
Right.
These ideas have been there before.
And open source was revolutionary when it came out.
Yeah.
Totally.
Not just in the fact that it made a big change, but as it was kind of overthrowing some of the ideas of how software should be built, sold, shared, licensed, all that kind of stuff.
Yeah. Yeah.
I think the open source preserved the first, the beginning of, computer science as a science, discipline, because before then the science was sharing then everything with everyone in every part of the world and discussing it.
And before companies started closing part of the code, they decided to continue that track and continue to sharing as much as possible.
And this is what bring us today discussing, open source languages or framework.
There's the obligatory single developer in Nebraska, Lego block block or J, J, J, not Jenga.
Jenga.
What is that?
Jenga.
Thank you.
Jenga.
And so it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like it seems like
So I like these two words because you can put there instead of Nebraska, your hometown or your project that you like the most that you contribute to.
And it's worked the same.
I think this is the majority of open source projects.
And it's interesting how some of them are so central.
We're going to come back to talk about curl a little bit later, I think.
And that's one of them we had.
Was it OpenSSL, I think, was one that really felt maybe inspired this diagram?
Actually, I can't exactly remember, but yeah.
And that's why I kind of talked so much about Django and the DSF and stuff.
It's true there's not that many people relative to how many are using it, but it's actually quite a bit more than most projects that do look like this.
And so when you start swamping that little peg at the end with 15,000 line PRs, it just fixes a minor problem, just optimizes.
Here you go.
It's just too much, right?
Exactly.
You had this interesting analogy with a picture of Django, the guitar player.
And there was a lot of funny, and this is the AI generator one, right?
So there's a lot of interesting things that came up when you said, make me such a picture, right?
You want to talk us through this analogy real quick?
Yeah.
So to show how AI can impact the project, I contribute more, which is Django.
I said, okay, let's try to ask AI to improve the image of Django Reinhardt, which is the chess guitarist that inspired the name of Django, the framework.
And asking the AI to improve the picture, it did different things.
That is very, a metaphor of what it can do to your code too.
For example, you bring a new, very new guitar, which is something that AI usually do.
When you try to modernize your code or use AI in your code, it usually brings new packages or new things.
Maybe your code is very old, but it brings new dependencies, the latest technologies.
The other things that I changed it was removing some bad parts, like for example, the smoking cigarette.
It was common at the time when the pictures originally were taken, but nowadays we know that maybe it cannot be so good things.
And it did also a strange thing that took me a few times to see.
It was adding an additional finger in the hand of Django Reinhardt, which is strange.
It's the metaphor of the code you can have generated from the AI that at first look, it seems normal.
But when you dip that a bit, you understand that it is something that was not possible, having, in this case, an additional finger.
That's a really good analogy.
Yeah, you're like, oh, look, this is a great, I can't believe how perfect, look, everything looks, wait a minute.
And that's also true for AI contributions as well, is it looks fine.
I found that's also true actually for speech to text.
It's really, I broke my hand really badly, like in three places up and down my hand in, I don't know, quite a while ago, but seven or eight years.
But I was still running Talk Python and the business I had, I still get, but I had an insane amount of email and stuff I had to do to keep things going.
And so I had to use speech to text.
And I think the reason I bring this up is I think it's a bit of an interesting analogy for AI as well as I would use speech to text.
It would transcribe it.
And then I would, I would go to send it.
And I had the hardest time actually finding the grammar errors.
But I would say stuff like, we're going to look at their project and figure something, you know, and it would, it would use the different kind of there, right?
Not the belonging of the person, but the location there.
But because it was phonetically correct, I would read it back and it would sound okay.
And there was just something about my brain couldn't find the problem.
So I had to put a footer in my email, like, sorry, I hurt my hand, have to do voice to text.
Please just forgive the mistakes.
I couldn't, I couldn't find a point where I could get it down to zero mistakes.
And nowadays probably the transcription would be quite a bit better, but it's, there's something about looking at it and it looks right and it sounds right, but it's not right.
That just makes it very hard to internalize the mistake, you know?
Totally true.
AI is very great in generating content that look like perfect when you see at first glance.
But when you deep dive a bit, especially for code, you can find that one, small characters can change the meaning of the things.
And a lot of people, when I show this picture, didn't realize at the first glance that this is an additional finger on the, on the picture because it seems very, very nice at the beginning.
Yeah.
The most subtle thing for me is the amplifier, honestly.
Yeah.
That was interesting.
I use it as a metaphor because I say that beginning AI can amplify the effect of so many things.
I use it then in the rest of my talk to say a lot of project already recognize AI as a tool that can amplify a lot of effects.
You have to be aware that it can amplify positive and negative effects, you know, your code.
Yeah.
It's an amplifier, but what is it amplifying, right?
This is an amazing analogy.
Now people who know me know that I certainly am on the positive side of, of working with AI, especially the newer agentic ones.
I think you can do really incredible stuff, not necessarily discussing the environmental and, and copyright aspects, but just as a tool, I think it's absolutely incredible.
But I think it's also really important to acknowledge its weaknesses where you have to put in guardrails, how you should use it.
Right.
And, and I think that's a good analogy for it.
okay.
Yeah.
Amplifier.
So if you got low quality code, maybe it just really like makes way more of that.
Right?
So yeah.
So recognizing the fact that AI is a very good tool that can amplify positive and negative think is something real.
I think I use AI every day for my daily job, but I can recognize the fact that people can use it in a bad way.
And so open tons of poor requests that are bad in your project.
So we have to be realistic here and to see that maybe it can use correctly.
Everyone want to do that, but it's not every time the case.
So, yeah, we're going to get into the different projects that do and some of their policies or whatever, and some of them are just no.
I think that's a little bit short sighted, but we're going to get to we'll get to that.
We'll get to that.
So you put out there that AI does not change the nature of open source.
It changes the scale.
Yeah.
This is what my thoughts when I, for the first time, work on the slides for what I was observing.
Then I changed a bit this idea because when I spoke with people, I realized that was a slightly different because I, exactly, I presented this talk
DjangoCon Europe in Athens in April, one month ago, and I received this very interesting feedback.
one of them was the fact that maybe changing the scale, the scale of the contribution of the amplifying things, AI was a tool that was able to change the nature of open source.
Because if you cannot trust people that open up requests, if you lose your trust in other members
that are involved because they have too much, so they contribute in a bad way, open source will change.
So we have to be aware of that.
I think.
A rule of thumbs or whatever, like sort of AI ethics, I guess, is it shouldn't, it shouldn't take you less time to create a thing that it takes someone else to review that thing.
It shouldn't take you less time to just read a thing.
Right.
But I imagine there's a lot of people out there who are just, oh, I've got this great idea for Django or whatever, you know, open source project.
Make it for me and then I'll submit it as a PR and did they test it?
Did they verify it?
Did they work on dry principles of refactoring everything just right?
You know, some people absolutely.
And that's, that's the challenge.
You don't want to throw that away necessarily, but a lot of times I think they just see it works and test pass maybe and send it.
You know, one of the projects I showed later in the talk stated in the guideline exactly what you just said, that if your pull request required less effort and has reviewing it.
So we throw away that the contribution because it can be a waste of time.
It's good that we can use this tool to vibe code things.
So to create them locally for ourselves, but, contributing and deploying it in production is a different thing.
Now you put out an example from OCaml that says there was a, somebody did a PR with a 13,323 lines, added 30 or changed and 36 lines removed.
No issue.
Just drop the pull request.
Right?
Like that's problematic.
I think this is, I tried to show some examples starting from the beginning to show how it escalated.
So this is one of the first I saw in November, a few months ago.
I was one of the first with a proper discussion that, people talk about.
So this pull request was created without any discussion from someone that was involved in the project and they closed it.
Of course, which was impossible to review.
It doesn't have to be this way.
You know, you could go to your AI and say, I want to add this feature.
Your job is to minimally add the absolute minimum amount of changes to the code such that this feature works or whatever.
Right?
Like just as if you were a developer, you know, I'm going to reformat the entire project and you're, you're a different formatter.
And then just change a bunch of other things.
Right.
It's, it's, but again, I think it's the amplification, the amplifier that you talked about.
The person who did this PR doesn't understand contributing to open source.
They may understand software, but not, not working on a team sort of thing.
Right?
Exactly.
In fact, they were forced to close the discussion of this because it was.
That's right.
The, the, it says something like, I have the impression that this conversation is becoming less productive.
So I'll move ahead and lock the topic.
Cause it's just out of control.
Right?
Yeah, absolutely.
Go dot was another.
Yeah, these things escalated from one single request to a lot of them.
So, each in only three months from the previous example to this one, I saw in the months that there was, escalated and this case, they created so many slow pull requests
for this project that they were exhausted and they put out in the social, this, this emergency.
Yeah.
I'll throw out another example.
Cause I want to come back to it as a counter example, but this is does not just, disprove or devalue it.
the maintainer of curl, Daniel Stenberg, I believe he's become sort of a poster child for, maintainer abuse, I think, cause he's written a lot about it and curls so popular, but they had a bug bounty program, which is slightly different than accepting PRs, but
it's still accepting contributions from people.
And this bug bounty program was out there to help find bugs in curl, which is really important and you get paid for it.
And the motivation to, come contribute to go dot or OCaml is like, Hey, I get my name listed as a contributor.
That's great.
Or I just get a feature I want, but for the bug bounty, you got money.
So that thing just got absolutely swamped to the point where they canceled.
I don't know if they canceled the bug bounty, but they certainly took away the financial reward for it.
Right.
That's pretty bad.
Yeah.
I, I thought that the project was facing this problem.
I, I can say that also Django used this type of program and we starting seeing more and
more, issue when they tried to modify things or the environment of some very old bug, trying
to find edge cases for the main goal to have a rewarding from that, but the issue were not real.
We're only trying to force some strange cases when the code behaved like that.
And we saw something like that also when there was some initiative like, October 1st or similar, where people in the past tried to open us very small pull requests with a typo only to have
some rewards from, from that.
I, I really disliked.
October fest.
I mean, I run, I have a bunch of GitHub repositories.
I'd looked the other day.
I have some like 390 GitHub repositories, but a much smaller, much, much smaller portion are actual projects that people can use mostly web stuff.
But even for these little tiny projects that have a couple hundred stars, I would get PRs.
Like I've, there was a problem with your read me.
I fixed it and they'll like change an adjective from like quickly to fastly or something.
I'm like, no, I am not playing your, oh, I contributed and got a PR accepted game.
And I was just like, why do, why do we need this?
This is, this is not in the spirit of it and it's not, it's just not right.
So I can only imagine with AI now what it's like.
Yeah.
And this is the main motivation because we, as I said before, we started that project like Django not space to help people to properly contribute to a project, not only fix a typo to have a reward, it can be a t-shirt or money.
It's not our open source work.
Yeah, for sure.
Jazz band.
This is another project that I don't know if this is what directly caused such a problem, but it might've been the final straw.
So tell us about jazz band.
Yeah.
so Janice was the creator of jazz band was also now in the board of PSF contributed in the Django ecosystem for so long time.
And they created this very good project where people can go and self-maintain projects in a direct and democratic way.
And was very effective.
There is a lot of projects that are very well used, like the Django debug toolbar, but also not specific for Django, like pip-tools that I personally use for long times was very effective to generate your log file.
You can do today with uv lock, for example.
Yeah.
I was on team, I'm on team pip-tools as well.
I love that thing.
Perfect.
I used for so many times.
I liked the fact that you were able to create a log file locally and don't have any additional dependencies on production, only installing it with pips.
So in the, this context, Jetsband was the containers, that, hosted all these projects,
maintained, but more and more, he has issues with the lack of maintainers, lack of time of people, having more and more, contribution open it.
So in this case, the, the, some issues were already there in the project, maintaining, maybe move to the other things in the meantime, but the AI accelerated, amplified the process
suddenly having the slope of pull requests, you know, this project accelerated the process to sunset.
And in fact, then it's wrote directly here in the article, I extracted only that parts that was useful for the slide, but at a certain point he writes clearly that there is, was the slope apocalypse as he wrote here.
And then they decided to set the project.
Yeah.
That's too bad.
You know, I think it's really, it's really interesting, the timing of this, because you said use AI at work.
I definitely do as well.
And I think recently it has gotten so incredibly good.
I, I would encourage people to absolutely use the very best model that you can afford to, to do your work.
And especially if you're going to do a PR or something, I think a lot of the challenges is the AIs were not as good.
And I think people would say, oh, I, I'll just use, I don't want to wait.
So I'll use this fast one, or I don't want to spend that much money on it.
So I'll use haiku rather than opus or something like that.
And coming back around to curl, Daniel Stenberg recently wrote a new post called high quality chaos, saying there's, there's not really much more AI slop actually said, I complained and complained
about the high frequency junk submissions of the, to the curl bug bounty program in March.
Once again, something like said, the slop, the slop situation is not a problem anymore.
Actually has graphs of like percent of slop, which is a really interesting thing, but it's just the amount of contributions, even though they're finding real issues are, it's like out of
control. So even, even if you have, if you have all of this stuff coming in, how are you going to deal with it? So I think partly this, this is just speculation on my part. I'd love to hear what you
think as well, but I think this slop apocalypse is a little bit fading, but it's just left such a sour taste in the mouth of so many maintainers that now they see AI. They're just like, no, that puts aside
the thing of like 13,000 lines of PR, which is just also no. But what is your thought on, on the kind of kind of legacy of older AI versus newer AI? Do you, do you agree? Do you disagree? I thought it was
interesting that Daniel Stenberg kind of like was so against it. And I was like, I'm against it, but for a new reason now.
Yeah. it, it remembers me, reading the hackers for Steven Levy, the book from the eighties when he wrote about the beginning of, occurs in the original meaning and the open source
context, the story was that at the beginning at the initial, teams or university, they
started creating code and sharing with, with each other without any license at all, or very freely. And then someone show up and started applying some license on it and started to sell this code.
So they face in that moment, they realized that some type of mutings was needed, like open source
license and started using it. We are now in a similar situation when until yesterday was enough to have
the process of having pull requests and trust each other. Now with this amount of pull requests, it's not
enough. this mechanism, we have to find something new to try to filter better the amount of contribution.
The, the tool is not bad per se is the way people are using it. And maybe it's changing because, when you have your new toys, you want to try with everything, you start creating things after a while you realize
the best way to use it. So maybe now people are more aware of, or to use properly AI or LLM. So people are improving, but still we need some way to collect or to handle better this new.
Yeah, I agree. I agree. I agree. In your research, did you find something I haven't seen a lot from, and I'm wondering if you found it is, did you find people using AI as a first level analysis before
they even looked at it? So were people setting up AI bots on like the GitHub or other, other work and say a CI flow to analyze the PR for certain criteria before they even have to look at it? I feel like,
I mean, there's like code rabbit and some other things. I saw many different way to use it.
I don't, I, I'm not, this is not a recommendation by the way. I just, it's just, something that I've heard of, that's sort of in that space, you know? Yeah. I remember seeing multiple
way to, to use AI. Someone who of course was to use AI to analyze AI contribution.
Like turn it against themselves. Like if there's AI slop coming in, like get an AI guardian though, just battles it back. You know? Yeah. Yeah. It can work. It can also work very bad for, for us if it's not
working properly. more and more, I've seen project experimenting, trying to have different approach of this, this problem. For example, I remember seeing a project from Armin Ronacher,
the creator of original creator of Flask. They remember exactly the project was, experiencing heat, but the thing was to close every pull request. That's the first thing.
They close every pull request. And they ask the creator to open and trying to explain, you know, in some way, why, it's worth it to reopening hits. For some reason, the AI was not good at doing
this stuff. And so in this way they recognized that people were effectively interacting, you know, not a bot, for example, and like a GitHub recapture. Exactly. Exactly. It was an experiment.
Another interesting one is, do you know, Granyan, the server, they're writing in Rust for Whiskey.
Yeah. Yeah, absolutely. I've had Giovanni on the show to talk about it. And it's also powers talk Python and the courses and stuff. So yeah, I definitely know it. And the maintainer,
uh, was listening in, in, in, in some interview and he said that he was using AI after they merged
the commit, he went back in time to the previous pointed of the code and asked AI to, create the same feature for them. And they, they analyzed the difference between what was the quality of code
created by AI and was, was merged to have some sort of comparison, to see how, how good was the work of core contributed that not very well that they called. So I had so many different
experiments and I'm not sure one of these is the best of the others, but it's interesting that people are experimenting with it. Yeah. I think we're still finding our way. Yeah. I think we're still
finding our way. Speaking of finding our way, let's, I want to talk about this next. So Mariota just, announced, a new guidelines for using AI tools when contributing to CPython. Thank you, Paolo,
for pointing me at this morning. So this came out, I don't know, what was the time on this?
Day and a half ago, something like that. Yeah. Exactly. And it's, it's interesting. Is this the link? No, this says the person submitting an issue or PR is responsible for its content,
regardless of whether AI tools were used in its creation. Generative AI tools can produce output quickly, but discretion, good judgment, critical thinking are the foundation of all good contributions.
We value good code, concise, accurate documentation, and well-scoped PRs without the unneeded code churn.
It goes on with details about acceptable use and other things. What's I think noteworthy here is that it's not just, no, we will not, we will not accept AI generated PRs. It's, it's, you have to use good
engineering regardless of the tools, right? Yeah. I showed multiple examples of, guidelines or API and AI policy in different projects. And the Python one was the first one, the first level.
when I used it, they, they was slightly different, but the meaning is exactly the same. You are responsible for what you contribute. you can use different tools and AI is a tool as another one.
So, but still the responsibility is yours when you contribute. And this is one of the first level of strictness or guidelines I found that it is important that they state the fact that they
consider AI as another tool and not a person. and you can use it, but you have to do.
Yeah. Consciously.
Yeah. I think it's reasonable. Another one is over here. There's this article on Redmonk by Kate Holterhoff called the generative AI policy landscape and open source. And this is much, much broader. It says,
um, she compiled and analyzed the generative AI policies of 86 open source foundations, including, organizations, including foundations, like the Linux foundation, Apache eclipse,
kernel curl, matplotlib, and so on. And then there's this bunch of graphs and stuff, about 60,
55% said permissive. We allow it. 25% said banned instantly, somewhere undecided. There's what you've seen this too, right? What are your thoughts on this? Pretty interesting.
Yeah. I saw it. The article is from, four, five months ago. So I was, was observing was the
fact that it was, changing every week. This is every week there are new project or like we just saw that Python project changed a bit, the guidelines about AI and so are doing all the other, yeah,
extrapolated from this, some of, project that analyze, other than that here, you see, there are a majority of projects that are permissive. What I did is to analyze how permissive they were in the
same context. So from Python to Arch or FastAPI or Matplotlib, they are, different shades of
permission level they guaranteed to the contributor. only one project that I found was no contribution, no AI contribution at all. the other one were slightly different to each other. And they tried
to, to show how can be slightly different between every, every small, every different project.
I think a really interesting part of this report is there's a different reason. They asked the different projects. What reasons do you have for either having a policy or having a ban? And they
broke it down by quality, copyright, and ethics. And certainly it looks like the biggest area is just quality. Like there is ethics is some of them are high and some of them are low, right? There's some
debate there. Copyright is maybe in the middle, but certainly quality is where people seem to like, well, you know, ethics aside, just the peer, just like, it doesn't give me good stuff is what
people said they were worried about. Yeah. I also think they are connected. a lot of time, what we do here is to have high qualities in maintaining good connection between projects. So
ethics and copyright is also a way to maintain high quality. It's only not only how fast can be your code
in executing is also of us can exchange with other projects we are using. You usually use a stack of layers in your project when you deploy it. If you can interact better with others, it's the better.
I do. I do wonder how much of this is old opinion versus new opinion. The reports, when is the report published? Although it's been updated, like published and updated. It's
February 26th, 2026. That's not super, super old, but the report was written now, but the people's opinion from say, Ashi Linux may have been formed two years ago, right? Like I, in terms of the quality
bar, like, I don't think ethics or copyright really changes meaningfully over that time period, but I think the quality may, so it's going to be interesting to see how this evolves.
Yeah. Yeah, for sure.
All right. We're getting short on time. I think maybe let's wrap this up with two things. I'm going to include, some levity, a joke at the end for people, that they can appreciate because I think
it's good, but let's sort of have you close things out. Let's just give, what advice you have for maintainers and you know, all this research you've, you've studied a lot of it. You've lived in the space a lot. So what do you think? What do you say to folks out there?
Yeah. Well, I say that exactly at the, at the end of the, my talk is that, we have to consider this AI, as a tools, new tools, very powerful that we can use and we have to use properly. It can
change the scale of your project and the things we need more is having more human, the loop to face all these things, like be connected more and more in community, like with it's PyCon US more and more
when I met people in PyCon US people asked to be in a channel together to discuss this type of things.
Another example I show was to start collaborating more closely between person of the community. And for example, we are just starting now with cartoon ribs on the experiment to have small Django sprints.
We named it Django on the Mad that we had an experiment additional last year in Spain. In September, we will have another one here where I live in Pescara, on the Arctic Arctic sea. And we, but we want to
create a format that people can replicate elsewhere, to meet in person, to, share their personal thoughts and the, about how to use properly these new tools and how to manage it. So I think the secret
here is to, to be more connected with your community, which is the most important value of your project. AI can produce code. The things that AI cannot produce is connection between people. It's
impossible to generate that. You only have to create in person or directly or online, but directly with other people that like we are doing now here, speaking with each other. And this is the best thing we can
continue doing, creating connection, speaking, because it's the only way to find a solution, a better solution, experimenting together and evolving as a community, as a project. This is the point I think.
Yeah. Very nice. I certainly want to encourage people out there to think, think before they just fire off a AI based ER, you know, maybe have, maybe open an issue and have a conversation about it. Is this
what you want, what exactly you want with it? And then, you know, kind of like the Python and CPython guidelines recommended. All right. I want to leave some, I want to leave the audience with something fun here for this, this conversation, just, just as a bit of a joke. If you're feeling, you're
feeling a bit overwhelmed, too much AI, I believe Glyph turned me onto this. this German guy does incredible videos and this one is called Senior Engineer Tries Vibe Coding. Have you seen this, Paulo?
No, no, it's first time. Oh, you have to watch it. It's, you know, it's, it's absolutely golden.
It's, it's, this guy is just like, got a towel, like he's not working out too much. And we've tried this for four and a half days now. I'm not even getting paid. We're going to do the UI over
again, but it's just, you'll really appreciate it if you've worked with AI and it's been.
Yeah. I need to check it for sure. Yeah. So I'll, I'll leave that in the show notes for everyone as a a bit of a way to lighten, lighten the mood and enjoy it. But I don't know. Let's also,
let's get your final thoughts on AI going forward and in the world of open source, which is how do you see it shaping up? Yeah. My final thought is, you have to track it as a, as a tool and,
be more connected with other people to exchange as many interesting things you can do with this tool without, leaving, high heads, other people. The only way you can improve us, this field is,
we, we together with other, with other people. So experiment it, share your thoughts, the more you can, and it's the best way you can improve.
Yeah. A hundred percent. I feel like this is, there is an engineering skill that is different than the engineering skills we had before. And a lot of people just see it as a chat box and without
looking at it and applying it as a, a practice of engineering, you end up with a lot of the junk and you end up with this like joke video we got here. So I just encourage people to look into,
treat this as a serious skill, not just a chat box that's supposed to understand every nuanced thing you ask for. Yeah. And don't trust something or someone that say that you're
absolutely right every, every time. Oh my gosh. You're absolutely right. This has absolutely been a great episode. Thank you, Paulo. Thank you for having me and goodbye for everyone.
Yeah. Bye. Bye.
This has been another episode of Talk Python To Me. Thank you to our sponsors. Be sure to check out what they're offering. It really helps support the show. What if your AI agents worked like fast
API microservices, typed autonomous and discovering each other at runtime. That's the world agent field is building. Join them at talkpython.fm/agent field. If you or your team needs to learn Python,
we have over 270 hours of beginner and advanced courses on topics ranging from complete beginners to async code, Flask, Django, HTMX, and even LLMs. Best of all, there's no subscription in sight.
Browse the catalog at talkpython.fm. And if you're not already subscribed to the show on your favorite podcast player, what are you waiting for? Just search for Python in your podcast player. We should be right at the top. If you enjoy that geeky rap song, you can download the full track. The link is
actually in your podcast below, share notes. This is your host, Michael Kennedy. Thank you so much for listening. I really appreciate it. I'll see you next time.
Bye.
Talk Python To Me.
Yeah, we ready to roll. Upgrading the code. No fear of getting old.
We tapped into that modern vibe. Overcame each storm. Talk Python To Me. I sync is the norm.