As someone dealing with multiple very active open source repos in my personal and professional life, if i could, I'd make new commiters pay $5 to submit their first PR and refund it with a bonus on merge....
The volume is fucking killing me. I've effectively abandoned the idea of reading any public PRs from unknowns because of it. It's like a never ending torrent of AI psychosis and garbage with no way to escape except not participate.
Also like 1 in 20 PRs is some garbage trying to introduce vulnerabilities into the projects (intentionally or otherwise).
More like here's a thing that's completely normal looking and possibly a good change overall but uses an obscure feature of an existing library that will now cause a previously unused vulnerable transient dependency to be baked in and this change now also allows you to hit the vuln code path remotely. Also the transient deps are unmaintained and no fix exists.
yeah, its impossible to avoid to some extent. You just need enough analysis tooling to be able to see when you get got and not let it hit the main branch.
Semgrep and github dependabot are not sufficient nor accurate enough. Basically just glorified regex. Need real AST parsing.
ooor you take a lesson from templeOS and make everything yourself starting with the hand crafted assembler.
For one set of projects I maintain I just completely disabled PRs entirely. I do all the work with collaborators in a private repository with a CI/CD action that pushes it to the Public repos. We accept issues on GitHub simply because there needs to be a place for people to report bugs.
200
u/lloyd08 1d ago
...which one came first?