DOP 361: When Code Got Cheap, Reviewing Got Expensive

#361: Picture a 6,000-line pull request landing in your project from someone you’ve never heard of. Every test passes - yours, theirs, all of it. And you can tell it was generated. Not assisted. Generated. What do you do with it? Viktor’s first move is to poke the premise: how do you even know it was generated and not assisted? You can’t. Nobody can. That distinction is already gone.

So the real question isn’t whether AI wrote it. It’s what a maintainer is for. Viktor’s answer is blunt - a maintainer’s first job is to guide people in and help them contribute, and if you think your job is mainly to write code, you picked the wrong role. The moment you allow PRs, you stopped being an individual contributor and became a manager. That’s the job. You don’t get to complain about the job you signed up for. Don’t want it? Fine - do what Ghostty did, do what curl did, turn PRs off and say so out loud. Just don’t hide behind unknown contributors, because every single person on your project was an unknown contributor on their first commit, including you.

A software developer says send me anything but a PR and lists four reasons: unknown contributors are a security risk, supply chain attacks are real, style disagreements eat maintainer time across time zones, and LLMs killed code-writing as the bottleneck so the stranger’s PR doesn’t help with the parts that are still hard. Viktor grants the security point and then points at XZ - social engineering, a long con, zero AI required. The risk was always there. What changed is quantity, not the percentage. And the maintainer who thinks a manual, line-by-line review still works in 2026 is, in his words, terribly wrong.

Viktor guesses he can review 6,000 lines in about the time it takes to hand-review 600. CodeRabbit and Greptile clear the obvious junk so he can spend his attention on architecture and the feature itself - the stuff he never had energy for after slogging through nitpicks by hand. His read on the whole backlash: there’s a new third group of maintainers now, the ones who aren’t good enough with agents to fight agents, and they’re the ones falling behind. Writing code is cheap. Reviewing it well is the expensive part - and the ones who refuse to use agents to review are drowning while blaming the contributors. There’s a cost angle too. If you don’t have tokens, you’re in trouble, and not everyone can afford them. Tokens are becoming table stakes, like an internet connection. Which raises the question: what happens to open source when the reviewing tools cost money the maintainer doesn’t have?