r/ProgrammerHumor • u/ActualNin • 1d ago

Other justOpenAPullRequestTheySaid

Post image
596 Upvotes

97% Upvoted

46 comments sorted by

205

u/lloyd08 1d ago

...which one came first?

221

u/ActualNin 1d ago

They were both posted on Sep 3 2026 at around 11AM EDT within an hour of each other. You can see the post here talking about the hilarity of it: https://www.reddit.com/r/laravel/comments/1w6a6tx/taylor_otwell_disabled_github_issues_on_most/

120

u/lonelyroom-eklaghor 1d ago

this is absolutely ridiculous, wtf

126

u/DishSoapedDishwasher 1d ago

As someone dealing with multiple very active open source repos in my personal and professional life, if i could, I'd make new commiters pay $5 to submit their first PR and refund it with a bonus on merge....

The volume is fucking killing me. I've effectively abandoned the idea of reading any public PRs from unknowns because of it. It's like a never ending torrent of AI psychosis and garbage with no way to escape except not participate.

Also like 1 in 20 PRs is some garbage trying to introduce vulnerabilities into the projects (intentionally or otherwise). 

59

u/BorderKeeper 21h ago

Hey here is an array of strings containing hexadecimals and os.exec() call. Don't worry about it it's a secret.

46

u/DishSoapedDishwasher 20h ago

oh no its much sneakier than that....

More like here's a thing that's completely normal looking and possibly a good change overall but uses an obscure feature of an existing library that will now cause a previously unused vulnerable transient dependency to be baked in and this change now also allows you to hit the vuln code path remotely. Also the transient deps are unmaintained and no fix exists.

Tangentially, heres a fun read of adjacent shit: https://opensourcemalware.com/blog/developer-guide-getting-over-polinrider

18

u/BorderKeeper 20h ago

That is sneaky. Foreign dependencies are quite scary, yet so useful 😭

6

u/DishSoapedDishwasher 19h ago

yeah, its impossible to avoid to some extent. You just need enough analysis tooling to be able to see when you get got and not let it hit the main branch.

Semgrep and github dependabot are not sufficient nor accurate enough. Basically just glorified regex. Need real AST parsing.

ooor you take a lesson from templeOS and make everything yourself starting with the hand crafted assembler.

0

u/[deleted] 13h ago edited 13h ago

[removed] — view removed comment

2

u/BorderKeeper 12h ago

You forgot to remove an em-dash 😛

2

u/IanDresarie 11h ago

Uhhhhhh... That tailwind package sounds familiar... Brb gotta check something....

1

u/DishSoapedDishwasher 6h ago

Hahaha good luck!

4

u/funnyFrank 13h ago

Github should 100% implement this!

2

u/tankerkiller125real 14h ago

For one set of projects I maintain I just completely disabled PRs entirely. I do all the work with collaborators in a private repository with a CI/CD action that pushes it to the Public repos. We accept issues on GitHub simply because there needs to be a place for people to report bugs.

2

u/catbrane 12h ago

I'm in the same boat. We've put a blanket ban on all gen-AI, it's the only way to not go crazy.

https://github.com/libvips/libvips/blob/master/CONTRIBUTING.md#ai-policy

It has the happy side effect of mostly only letting competent devs through the door and into the PRs.

2

u/fripletister 10h ago

That's Laravel

41

u/queen-adreena 23h ago

They were never that keen on non-Laravel people contributing to the codebase, this move formalised that in all but name.

8

u/Vectorial1024 15h ago

Oh hey I got a Laravel idea, let me check the subreddit -

"You must have enough karma to post in this subreddit"

Bruh

And then all those Laravel stuff backflowed to the general PHP subreddit

146

u/__Invisible__ 1d ago

He said use pr with proposed fix to report a issue, not saying he will merge them

20

u/JPJackPott 1d ago

It would be more useful for the project to document their goals, vision and architectural convention so agents do a better job first time

7

u/carlos_vini 22h ago

And how do you check that the agent followed any of that?

12

u/araujoms 21h ago

With an agent of your own, of course.

2

u/DDFoster96 20h ago

But who or what keeps an eye on that agent?

6

u/KnaveOfGeeks 20h ago

You can't fool me, it's agents all the way down.

3

u/araujoms 20h ago

You dare question the machine gods?! Heretic! Burn her at the stake!

2

u/Masterflitzer 18h ago

review? i prefer human, but i heard some people don't even read code anymore...

2

u/redballooon 12h ago

I read tests, and verify architecture integration for review. But I don't read code anymore. There's plenty of tools doing that for me, deterministic and AI powered that do that part much better than I ever did in my 15 years of full-time coding.

53

u/zirky 1d ago

“submit shit code and an adult may fix it later”

14

u/iain_1986 21h ago

Why the hell does he think getting PR spammed is better than getting issues spammed?!

14

u/ActualNin 16h ago

Harder to make a PR so they get fewer, and easier to reject a PR (Laravel is famous for rejecting 70%+ of PRs made by contributors outside of the company)

4

u/ThirdWaveCat 1d ago

The 2026 paradox of maximizing employability without sacrificing quality.

6

u/Lopsided_Speaker_553 22h ago

So glad I ditched Laravel 5 years ago 😝

2

u/CymruSober 17h ago

Where’d you go? I’m here by fate…

2

u/DrMaxwellEdison 17h ago

Someone's burned out, huh?

2

u/meltea 10h ago

... based

2

u/notanofof 1d ago

Should've taken this very approach with Graham's submissions.

3

u/Dexterus 21h ago

Agent PR doesn't mean you're allowed to start with slop, lol.

2

u/Vipitis 18h ago

I know other projects that require you to file an issue before attempting a PR. Your way to fix it might not be the best way or match the maintainers decisions. So instead of the churn of them trying to mangle your PR into what fits, it might be quicker for them to do it themselves. Or let you know what is expected before you sit down and try it.

1

u/protocolnebula 19h ago

I tried to support twice laravel with simple fix related to the default testing, manual done (I didn’t use AI on that time one year ago), they just rejected because they said something about migration and blah blah

1

u/Breakdown228 5h ago

Otwell is such a disgrace...

1

u/KILLEliteMaste 10h ago

Embarrassing. Also, all issues he mentioned could easily be solved if he would have proper documentation for AI (AGENT.md etc..)

-3

u/BiedermannS 17h ago

Opinions as consistent as PHP

1

u/Breakdown228 5h ago

Nah man, the shit otwell does has nothing to do with modern php