---
title: "\"Somebody is always paying the token bill\": AI and Open Source with Brian Proffitt & Jason Brooks"
date: 2026-09-10T08:00:37Z
modified: 2026-09-10T11:35:35Z
permalink: "https://redmonk.com/videos/brian-proffitt-jason-brooks/"
type: video
status: publish
excerpt: ""
wpid: 5102
categories:
  - Podcast
series:
  - Conversations
channel:
  - RedMonk Video
featured_image: "http://redmonk.com/wp-content/uploads/2026/09/Brian-Proffitt-Jason-Brooks.jpg"
timestamp: 2026-09-10T11:35:35Z
tags:
  - Podcast
  - Conversations
  - RedMonk Video
---

Generated code is arriving faster than maintainers can read it. RedMonk’s Steve O’Grady discusses this new reality with Jason Brooks and Brian Proffitt, both managers in Red Hat’s Open Source and AI Program Office. Proffitt’s teams are adding what he calls human speed bumps upstream: PR templates that ask whether AI wrote the patch, and if so, what the prompt was. The point is transparency, not blocking the flow. Brooks argues for the importance of human decision makers because writing code may cost close to nothing now, but getting another person to accept it still costs plenty, and someone always pays the token bill. The conversation also touches on maintainer burnout, why saying “no” is still a legitimate answer to a pull request, Fedora Hummingbird and its agentically assembled packages, and the thing Proffitt worries about most: trust.

This RedMonk video is sponsored by Red Hat.

## Links

- [LinkedIn: Brian Proffitt](https://www.linkedin.com/in/brianproffitt/)
- [LinkedIn: Jason Brooks](https://www.linkedin.com/in/jason-brooks-3090342/)

# Transcript

**Stephen O’Grady (00:04)**
Good morning, good afternoon, good evening. I am Steve O’Grady co-founder of RedMonk, the developer and practitioner focused industry analyst firm. And we are here to talk about unsurprisingly, sort of in in this day and age, AI, of course, because we have to talk about that all the time. and I’m here with two two folks that had quite a bit of experience with open source and community governance and all that fun stuff. and we want to talk a little bit about sort of where those two things intersect. so why don’t we start with Jason? You’re sort of next in my in my sort of screen here. So you wanna introduce yourself briefly?

**Jason Brooks (00:39)**
yep, Jason Brooks. I’ve worked at Red Hat for fourteen years and I am the manager in the open source and AI program office and the people who who are on my team work with open source projects that are strategic to Red Hat to try to help them be successful.

**Stephen O’Grady (00:56)**
Awesome. And Brian.

**Brian Proffitt (00:59)**
Yeah, so I’m Brian Proffitt. I’m also a manager within Red Hat’s AI and Open Source Program Office. and also with a extensive background like Jason in technology journalism. and my team is responsible for communicating all the different mess messaging around what we’re doing in AI and open source and also educating. So we have a lot of training and enablement curricula that we’re you

Sharing with our customers, our partners, and also upstream communities, especially now around all this stuff around AI and how to deal with.

**Stephen O’Grady (01:40)**
And deal with it, we we sort of all must, right? that’s a it’s a perfect segue. So I don’t know you’d cer certainly tell anybody who’s listening to this, I’m sure, you know, AI has had a massive impact on the industry broadly. It’s impacting sort of pick a sector, pick a category, pick a you know, sort of vertical, pick a business, right? You know, AI is is everywhere, it’s ubiquitous, and you know, its implications are often sort of difficult to to sort of tease out in substance, right? Because in many cases there’s a

you know sort of a a superficial or surface impact, but then there are ripple effects, but you know, sort of below the surface, right? And sort of one of the most sort of obvious for this is that you know, for a couple of years, you know, we’ve seen you know tremendous improvements in sort of self-reported productivity from developers. and yet the impact for their organizations has been mixed at best. So we’re in theory creating code faster, and yet

you know the the sort of actual benefits from a organizational standpoint or a project standpoint are often sort of in question. So with that sort of background, I think where we want to start is in a sort of Brian, you know sort of from your from your perspective, you know sort of overlooking you know OSPO and all sort of things open source at sort of Red Hat. you know, we have obviously this flood of AI code. some of it’s good, some of it’s slop.

sort of in your experience sort of what are the guardrails, you know, projects can implement, you know, to sort of maintain the code quality, you know, you know, sort of without sort of bottlenecking things such that we don’t get that benefit, you know, sort of as we’re talking like how do you put guardrails in and keep things moving? you know, because there’s all sorts of you mentioned, you know, sort of at at one point in one of your presentations, plausible but not always correct, which I think is is sort of

you know, sort of one of the more difficult cases to handle where it’s like, hey, there is this code and it looks okay, but in fact it’s not. and that makes it that much

**Brian Proffitt (03:41)**
Yeah.

**Stephen O’Grady (03:41)**
more difficult to detect. So, you know, sort of as you think about this, how do you think about all right, what are the guardrails we can put in place? Whether those are are people in process guardrails, whether they’re automated or something, you know, sort of everything in between.

**Brian Proffitt (03:53)**
Yeah, well yeah, great question to start out with. So a a lot of what we’re trying to do right now, at the beginning, because we’re all trying to all get our hands wrapped around these tools, whether it’s generative AI or agentic AI. So the first step that we’re trying to do around our upstream communities that we’re participating in is essentially trying to introduce a level a new governance layer that will basically what I call our human speed bumps that will encourage transparency and also sort of tease out a lot of these generative AI contributions that are coming in. Because the real problem as you said is it’s either good or bad or somewhere in between and e anywhere on that spectrum it has to be dealt with. Even if it’s all crap, it the you have to take out the trash. So you’re

**Stephen O’Grady (04:48)**
Yeah. Mm-hmm.

**Brian Proffitt (04:51)**
gonna have to deal with it. So These processes that I’m talking about include things like having like templates on your contributions, on your PRs and whatnot, that say, is this AI generated? Yes or no? and obviously there’s some honor system here. If they say yes, then it leads into, okay, what were your prompts? What what was your reasoning behind this?

What we’re trying to do is not necessarily stop the incoming flow of AI, but encourage people to be transparent and understand what it is they’re they’re contributing. Because the real problem, and you alluded to this earlier, like within companies, but the big problem out in the open source ecosystem is right now, like forger like forges like GitHub and GitLab kind of encourage this whole mentality of the more I contribute, the more karma I get.

So you have people who are incentivized for making a solid green contribution wall. by, you know, and so we’re trying to get around that and and try to say, okay, look, you’re gonna turn this in. It’s you you either did it all with generative AI or you resisted or whatever. Do you understand what you’re doing? Do you understand why you did it? Do you understand the context of the issue that you’re trying to solve?

And then if we can do that, what we’re trying to do is encourage this participation not just with code, but now with like follow-up conversations. and and we hope that that will introduce a little bit of a slowdown on the fire hose coming in while

**Stephen O’Grady (06:37)**
Mm-hmm. Yeah.

**Brian Proffitt (06:40)**
moving forward, you know, as we get our hands around the other things, then we can look at things like automated. agentic AI solutions that will help review at scale. And I think moving forward, it’s probably going to be some kind of combination of the two as we do that. But that’s where we are right now. And it yeah, we I’ve seen evidence. I’ve got a data team where we’ve done this in our project. It seems to be working with the open source software that we’re hosting and fostering. so we’re seeing some anecdotal evidence that it’s helping, but we

**Stephen O’Grady (07:21)**
Okay.

**Brian Proffitt (07:22)**
have a long way to go.

**Stephen O’Grady (07:23)**
Yeah. And so that’s sort of some of the theory and the the sort of intent, if you will. So Jason, in practice, right? You know, sort of in the field, project like Fedora, you know, how are you looking at things like all right, how do I verify the provenance of this AI generated patch? Like how do we basically how do we sort of intake and ingest code when you can’t rely necessarily solely on the authority of a human contributor?

**Jason Brooks (07:51)**
Yeah. Well, I think that the the trick, right, is that I think Fedora and I really think this is the norm among projects that I’ve I’ve been paying attention to, they just kind of reject that premise that you can’t rely on the human and they just say, No,

**Stephen O’Grady (08:05)**
Mm-hmm.

**Jason Brooks (08:06)**
we’re going to rely on the human. So, you know, I mean it’s like There’s all these AI processes happening, all these these agents they’re out buzzing around doing things, but you know, in zero of those cases is there not some human who is ultimately has set that process running. Somebody is always paying the token bill. Somebody’s intentions are behind that, even if they’re like poorly articulated. So, you know, the way that Fedora started off with the policy and and I think that it’s just, you know, it’s in the early time of playing out really, is that we’re not going to assume the responsibility of, you know, vetting, you know, mindless robot products. You know, y you’re a person. You know, I I th I thought that when

**Stephen O’Grady (08:51)**
Yeah. Yeah.

**Jason Brooks (08:52)**
Brian said that about the wall, you know, the contribution wall on GitHub or there’s all these stuff

**Stephen O’Grady (08:55)**
Yeah. Yep.

**Jason Brooks (08:57)**
going on, it’s i it what it popped up in my head is that in a place like Fedora, you have the luxury of an actual community. And so if some sort of, you know, code spewing robot just shows up, it’s not hard for everyone to say, wait a minute, no, you know, this is this this isn’t how we do things here. So,

**Stephen O’Grady (09:15)**
Yeah. Yep.

**Jason Brooks (09:17)**
you know, it’s kind of a it’s it’s I don’t know, you know, it’s a cheat, you know, it’s a it’s a it’s a human you know, the human cheat where

**Stephen O’Grady (09:23)**
Yeah. Yeah.

**Jason Brooks (09:25)**
where like what I was thinking about as we were going in this interview is that, you know, the the cost of producing code might be going to zero, but the cost

**Stephen O’Grady (09:32)**
Mm-hmm. Yep.

**Jason Brooks (09:34)**
of making a contribution, of actually collaborating with people, of getting people to accept what you spew out, that still has a cost to it.

And Fedora is relying on that, you know.

**Stephen O’Grady (09:42)**
Yeah, that’s a good point.

Yep. Yep. No, that’s a good point. That’s a good way to put it, I think. sort of so on that note, Brian, so as we as we sort of bot traffic, you know, dwarfs human interaction, you know, we have this sort of flood of of incoming contributions, you know, and there’s other things

It it’s it’s funny to me that you know these these sort of autonomous loops were very much in fashion at the start of the year and now it’s you know, no, hey, they may be sort of passe or whatever. But I either way, right? We have all this sort of code coming in. respect to the obvious question. So, you know, if you’re looking at it, you know, sort of from a high level, from an industry standpoint, is anyone actually getting this right? Is anybody doing this really well? are are we just buying time until Tools catch up? Like w where would you sort of say we are as an industry?

**Brian Proffitt (10:35)**
I would say we’re probably at the at the very start of of figuring this out. I I I think we

**Stephen O’Grady (10:42)**
Mm-hmm.

**Brian Proffitt (10:43)**
are at a point where the technology has gotten ahead of the the human governance patterns and the the development workflows and everything like that. So I think we are all trying to figure this out. I mean we saw an example late last week, I was you know, about a you know, w a bot that escaped. And went off and cribbed the answer. And this is by a company, not naming names, that was actually building the learning model. So

**Stephen O’Grady (11:11)**
Yeah.

**Brian Proffitt (11:14)**
I’m gonna say no, that we haven’t quite figured

**Stephen O’Grady (11:16)**
Yeah, yeah.

**Brian Proffitt (11:17)**
this out yet. I I think it’s gonna take a lot of effort to wrap our heads around this because as Jason’s already alluded to, like there there’s always a cost to us somewhere. and we haven’t figured out where the costs really lie. We think it’s in tokens, sure. I think it’s in technical debt, you know, another person’s gonna think it’s somewhere else, you know, it’s like

**Stephen O’Grady (11:42)**
Yeah, yeah.

**Brian Proffitt (11:43)**
community reputation, that’s a s so it’s a lot. So I think collectively, I think we’re all gonna have to not standards, but I think we’re gonna have to come up with best practices around all of this in an especially in the open source ecosystem that will let people

use this technology generally safely. and I think we have a ways to go. And a lot of communities right now, we’re still at the stage where a lot of people are just like, they’re stiff arming everything. They’re like, nope, nope, no generative AI.

**Stephen O’Grady (12:16)**
Yeah, yeah. Yep.

**Brian Proffitt (12:18)**
And then you have people who are like, let’s bring it all in and okay. So yeah,

**Stephen O’Grady (12:21)**
Yeah, yeah. Yeah.

**Brian Proffitt (12:23)**
I think we’re at the beginning. I as like I said this be when we were talking before the interview, you know, it reminds me a lot of the early days of Linux.

where,

**Stephen O’Grady (12:32)**
Mm-hmm.

**Brian Proffitt (12:32)**
you know, we were I was blowing out cathode Ray tube monitors by making the wrong X window settings, right? So I kinda

**Stephen O’Grady (12:40)**
Mm-hmm. Yep. Yep.

**Brian Proffitt (12:42)**
feels like we’re in that era right now with with AI.

**Stephen O’Grady (12:44)**
Yeah.

I’d say that’s pretty fair. and I think it’s notable that you both referred to costs. Yeah, because the the next question I want to ask Jason is you know, the sort of all too real, and we hear this all the time, you know, talking to different communities and different developers, you know, is the is the sort of I mean I guess it’s a for permanent question, but I think it’s it’s getting worse. You know, sort of is the developer burnout?

Right. and more specifically the maintainer burnout, you know, sort of for projects. So, you know, as I said, this has been a problem for years. and then, you know, as we sort of all know and we’ve we’ve sort of discussed already, you know, that the cost sort of cost of creating code at least has gone to near zero. so how does Fedora like how how do you see what what is the human side of this look like? How do you sort of I mean, obviously you can’t fix and solve burnout, but how do you mitigate it?

**Jason Brooks (13:40)**
Yeah. Well, I I think that we have to always we have to remind ourselves that saying no is always an option. You know, just because you have a billion merge requests, that doesn’t mean you have to merge any of them, you know. And you’ve gotta decide to be what kind of project you’re gonna be. And it could be hey, I don’t have time for that project. And then if it’s if those folks, you know, who who wanna make those contributions want it enough the through the magic of open source we can fork

And do your own thing. So that’s the thing I think everyone has to keep in mind is that just because you’ve got a flood doesn’t mean that you have to manage the flood. Now, there’s a lot of great stuff in there, I’m sure. And so but I and y and you I feel I’m sure there’s the pressure, I know there’s the pressure to want to get at that and and bring in the community. The other thing is that, you know, again, this flood is a flood of people or at least processes that people have launched. And it’s fair to ask those people to participate in the process of handling The flood. So, you know, the just the classic, you know, like you say, what are the incentives? I want to get some code in this project. Okay, what’s it gonna take to get the code in the project? I’ve gotta build up my stature by, you know, chopping wood, carrying water type things. I’ve got to participate

**Stephen O’Grady (14:51)**
Mm-hmm. Yep.

**Jason Brooks (14:53)**
in reviews. So I think that’s the thing we have to remind ourselves that, again, these are other people and it’s fair to ask those people to participate or you know, if you don’t want to manage the part that participation. They can always, you know, do another thing and let a thousand flowers bloom. But the other thing I’ll say is

**Stephen O’Grady (15:06)**
Yeah. Yeah, move along. Mm-hmm.

**Jason Brooks (15:09)**
that there are promising tools to say, look, here are here are our standards for the project, here’s our style guide, here’s these things that can, you know, AI tools can aid in some of that triage and doing some of that work. So that’s a piece of it. But I think where we where right now we have to keep our main focus on is hey, it’s okay to require contributors to make contributions beyond code. You know, we have to insist

**Stephen O’Grady (15:34)**
Yeah.

**Jason Brooks (15:35)**
on that.

**Stephen O’Grady (15:36)**
Yeah. No, I think that’s fair. You know, we gotta sort of share the load as it were. all right, so Brian, if if we can agree that sort of AI is not going anywhere, which I know there are sort of the the minority out there that I think thinks that the genie can be put back in the bottle, but I I I think the reality is is that it’s not going anywhere and devs are gonna use it. you know, from your perspective, like what’s the most important trait, you know, for open source communities? you know, sort of in order to remain sort of trust is trusted steward moving forward? Like how do they What do they need to do to to essentially leverage these tools, but leverage them safely?

**Brian Proffitt (16:09)**
I I think probably if I put it in one word it would be transparency. I think everybody everybody on all parts of this process have to be as transparent. Contributors have to be transparent. Yes, I did use some form of AI assistance. I think committers and maintainers, you know, everybody on the in you know on the receiving end, so to speak, they have to be transparent about what their policies are and be very

**Stephen O’Grady (16:35)**
Uh-huh.

**Brian Proffitt (16:35)**
clear about them. And as Jason says, not be afraid to say no.

and and and come in and it’s it’s say exactly what they are. we are what worries me the most about AI beyond the mechanics of it is something I believe you’re kind of alluding to in your question is that we cannot have a lack of trust here. I think a lot of people are a little bit afraid of if we have too much non-human activity in this pipeline, whatever you want to call it, that

we’re going to lose trust. And and I think for me that’s the most worrisome part of it. the logistics we’ll figure out, we’ll build better tools. We’ll do that. But if we lose trust in the process, you know, if our end users do no longer trust the security of what whatever we’re building, for instance, we’ve lost a lot. Because as you know,

it’s really easy to tear apart trusts and really difficult to build it back up. So I think that transparency at every part of this process and all this integration and thinking and conversations that we’re having, I think that’s going to be key to success moving forward for the open source ecosystem.

**Stephen O’Grady (17:53)**
Yeah, no, I think that’s exactly right. And then I think that sort of brings us to to the last question for today, you know, for for Jason, which is you know, obviously AI has been in market for, you know, what is it, six years now, in terms of being able to generate code, maybe longer. I can’t get my sort of math right. but it it’s been here for a while. Obviously Fedora has been sort of in particular has been sort of in the middle of it, right? You know, sort of as so many communities are.

So what have you learned, right? You know, what sort of change in in your sort of policies with respect to AI and how do you expect them to change sort of moving forward?

**Jason Brooks (18:31)**
Yeah, I think that we, you know, we’re about we’re about a just under a year into the ratification by the council of the Fedora policy. So I don’t think we’re quite at the stage of making changes to it yet. I I do think the thing that we will be challenged by and other projects will be challenged by is this agentic factory type of you know, model. And so what does it

**Stephen O’Grady (18:50)**
Yeah. Yeah.

**Jason Brooks (18:52)**
look like to say, you know, again, it’s always gonna be people and trusting people, but what does it look like to say Trust me, this is my code too. Trust me, this is the factory that I maintain and design. And by the way, you can look at all the specs of it and exactly what it does, but trust the output of that model. Which I think does ext I I ca I can imagine that working. But, you know, that’s gonna be a a a shift and it’s gonna take time to for people to see how these things work and to process it and build up that trust. But like right now with this Fedora hummingbird, you know, this is like a new kind of branch of Fedora that is

agentically assembled. And you know, it’s one thing for Red Hat to assign a bunch of engineers to build a thing, but in order for this to become like a full part of f the Fedora community, the community will have to digest what it means. Like you know, the individual rawhide package maintainers need to say need to trust the indiv you know, trust these p change sets. And then maybe someday the eventual upstreams of those projects need to trust. So

you know, trust the the outputs. So I think that that is what will be next and those changes will involve some policy changes, you know, to as we adapt to those. but that’s what I see coming up, you know, ahead. But it’ll take some work to to get there.

**Stephen O’Grady (20:17)**
Yeah, I think, you know, I I I was talking to another another person I’m sure you both know, Adam Jacob a while ago. And one of the things he was talking about is is that the

**Brian Proffitt (20:25)**
Mm-hmm.

**Stephen O’Grady (20:28)**
you know, again, sort of get into the the sort of second level and second order effects here. You know, one of the things we haven’t worked out in many cases is etiquette. Right. So all these things that we’d grow not you know, we’ve grown up like you can’t do this and you can do this. Well, that looks different. You know, sort of in a world where machines are building a lot of this stuff. So

**Brian Proffitt (20:44)**
Exactly.

**Stephen O’Grady (20:44)**
I think that the sort of the the probably the closing theme here is is that obviously there’s a lot of change. Open source communities are gonna be sort of in many cases at the forefront of this and are gonna, you know, sort of have to learn some some some hard lessons, I would assume. so I’m sure we will be checking in with you you both, you know, sort of as we as we roll along as we roll along. But yeah, that’ll that’ll wrap us for today. Jason, Brian, just want to say thanks so much for coming on that coming on the show and talking to us.

**Jason Brooks (21:12)**
Yeah, thank you. It was great.

**Brian Proffitt (21:13)**
Yeah, thank you Steve

**Stephen O’Grady (21:14)**
Awesome.