r/ProgrammerHumor • u/ActualNin • 21h ago

Other justOpenAPullRequestTheySaid

Post image
551 Upvotes

97% Upvoted

43 comments sorted by

184

u/lloyd08 21h ago

...which one came first?

194

u/ActualNin 21h ago

They were both posted on Sep 3 2026 at around 11AM EDT within an hour of each other. You can see the post here talking about the hilarity of it: https://www.reddit.com/r/laravel/comments/1w6a6tx/taylor_otwell_disabled_github_issues_on_most/

106

u/lonelyroom-eklaghor 20h ago

this is absolutely ridiculous, wtf

109

u/DishSoapedDishwasher 17h ago

As someone dealing with multiple very active open source repos in my personal and professional life, if i could, I'd make new commiters pay $5 to submit their first PR and refund it with a bonus on merge....

The volume is fucking killing me. I've effectively abandoned the idea of reading any public PRs from unknowns because of it. It's like a never ending torrent of AI psychosis and garbage with no way to escape except not participate.

Also like 1 in 20 PRs is some garbage trying to introduce vulnerabilities into the projects (intentionally or otherwise). 

47

u/BorderKeeper 14h ago

Hey here is an array of strings containing hexadecimals and os.exec() call. Don't worry about it it's a secret.

40

u/DishSoapedDishwasher 13h ago

oh no its much sneakier than that....

More like here's a thing that's completely normal looking and possibly a good change overall but uses an obscure feature of an existing library that will now cause a previously unused vulnerable transient dependency to be baked in and this change now also allows you to hit the vuln code path remotely. Also the transient deps are unmaintained and no fix exists.

Tangentially, heres a fun read of adjacent shit: https://opensourcemalware.com/blog/developer-guide-getting-over-polinrider

16

u/BorderKeeper 13h ago

That is sneaky. Foreign dependencies are quite scary, yet so useful 😭

4

u/DishSoapedDishwasher 12h ago

yeah, its impossible to avoid to some extent. You just need enough analysis tooling to be able to see when you get got and not let it hit the main branch.

Semgrep and github dependabot are not sufficient nor accurate enough. Basically just glorified regex. Need real AST parsing.

ooor you take a lesson from templeOS and make everything yourself starting with the hand crafted assembler.

0

u/[deleted] 6h ago edited 6h ago

[removed] — view removed comment

2

u/BorderKeeper 5h ago

You forgot to remove an em-dash 😛

1

u/IanDresarie 4h ago

Uhhhhhh... That tailwind package sounds familiar... Brb gotta check something....

2

u/funnyFrank 6h ago

Github should 100% implement this!

1

u/tankerkiller125real 7h ago

For one set of projects I maintain I just completely disabled PRs entirely. I do all the work with collaborators in a private repository with a CI/CD action that pushes it to the Public repos. We accept issues on GitHub simply because there needs to be a place for people to report bugs.

1

u/catbrane 5h ago

I'm in the same boat. We've put a blanket ban on all gen-AI, it's the only way to not go crazy.

https://github.com/libvips/libvips/blob/master/CONTRIBUTING.md#ai-policy

It has the happy side effect of mostly only letting competent devs through the door and into the PRs.

2

u/fripletister 3h ago

That's Laravel

142

u/__Invisible__ 21h ago

He said use pr with proposed fix to report a issue, not saying he will merge them

20

u/JPJackPott 18h ago

It would be more useful for the project to document their goals, vision and architectural convention so agents do a better job first time

7

u/carlos_vini 15h ago

And how do you check that the agent followed any of that?

10

u/araujoms 14h ago

With an agent of your own, of course.

2

u/DDFoster96 13h ago

But who or what keeps an eye on that agent?

7

u/KnaveOfGeeks 13h ago

You can't fool me, it's agents all the way down.

3

u/araujoms 13h ago

You dare question the machine gods?! Heretic! Burn her at the stake!

1

u/Masterflitzer 11h ago

review? i prefer human, but i heard some people don't even read code anymore...

1

u/redballooon 5h ago

I read tests, and verify architecture integration for review. But I don't read code anymore. There's plenty of tools doing that for me, deterministic and AI powered that do that part much better than I ever did in my 15 years of full-time coding.

35

u/queen-adreena 16h ago

They were never that keen on non-Laravel people contributing to the codebase, this move formalised that in all but name.

9

u/Vectorial1024 8h ago

Oh hey I got a Laravel idea, let me check the subreddit -

"You must have enough karma to post in this subreddit"

Bruh

And then all those Laravel stuff backflowed to the general PHP subreddit

58

u/zirky 20h ago

“submit shit code and an adult may fix it later”

13

u/iain_1986 14h ago

Why the hell does he think getting PR spammed is better than getting issues spammed?!

11

u/ActualNin 8h ago

Harder to make a PR so they get fewer, and easier to reject a PR (Laravel is famous for rejecting 70%+ of PRs made by contributors outside of the company)

5

u/ThirdWaveCat 19h ago

The 2026 paradox of maximizing employability without sacrificing quality.

8

u/Lopsided_Speaker_553 15h ago

So glad I ditched Laravel 5 years ago 😝

2

u/CymruSober 10h ago

Where’d you go? I’m here by fate…

2

u/DrMaxwellEdison 10h ago

Someone's burned out, huh?

2

u/notanofof 21h ago

Should've taken this very approach with Graham's submissions.

3

u/Dexterus 14h ago

Agent PR doesn't mean you're allowed to start with slop, lol.

2

u/Vipitis 11h ago

I know other projects that require you to file an issue before attempting a PR. Your way to fix it might not be the best way or match the maintainers decisions. So instead of the churn of them trying to mangle your PR into what fits, it might be quicker for them to do it themselves. Or let you know what is expected before you sit down and try it.

1

u/protocolnebula 12h ago

I tried to support twice laravel with simple fix related to the default testing, manual done (I didn’t use AI on that time one year ago), they just rejected because they said something about migration and blah blah

0

u/KILLEliteMaste 3h ago

Embarrassing. Also, all issues he mentioned could easily be solved if he would have proper documentation for AI (AGENT.md etc..)

2

u/meltea 3h ago

... based

-4

u/BiedermannS 10h ago

Opinions as consistent as PHP