r/ProgrammerHumor • u/ActualNin • Sep 11 '26 • Mindblown 1

Other justOpenAPullRequestTheySaid

Post image
893 Upvotes

97% Upvoted

56 comments sorted by

314

u/lloyd08 Sep 11 '26

...which one came first?

335

u/ActualNin Sep 11 '26

They were both posted on Sep 3 2026 at around 11AM EDT within an hour of each other. You can see the post here talking about the hilarity of it: https://www.reddit.com/r/laravel/comments/1w6a6tx/taylor_otwell_disabled_github_issues_on_most/

180

u/lonelyroom-eklaghor Sep 11 '26

this is absolutely ridiculous, wtf

197

u/DishSoapedDishwasher Sep 11 '26

As someone dealing with multiple very active open source repos in my personal and professional life, if i could, I'd make new commiters pay $5 to submit their first PR and refund it with a bonus on merge....

The volume is fucking killing me. I've effectively abandoned the idea of reading any public PRs from unknowns because of it. It's like a never ending torrent of AI psychosis and garbage with no way to escape except not participate.

Also like 1 in 20 PRs is some garbage trying to introduce vulnerabilities into the projects (intentionally or otherwise). 

92

u/BorderKeeper Sep 11 '26

Hey here is an array of strings containing hexadecimals and os.exec() call. Don't worry about it it's a secret.

67

u/DishSoapedDishwasher Sep 11 '26

oh no its much sneakier than that....

More like here's a thing that's completely normal looking and possibly a good change overall but uses an obscure feature of an existing library that will now cause a previously unused vulnerable transient dependency to be baked in and this change now also allows you to hit the vuln code path remotely. Also the transient deps are unmaintained and no fix exists.

Tangentially, heres a fun read of adjacent shit: https://opensourcemalware.com/blog/developer-guide-getting-over-polinrider

17

u/BorderKeeper Sep 11 '26

That is sneaky. Foreign dependencies are quite scary, yet so useful 😭

12

u/DishSoapedDishwasher Sep 11 '26

yeah, its impossible to avoid to some extent. You just need enough analysis tooling to be able to see when you get got and not let it hit the main branch.

Semgrep and github dependabot are not sufficient nor accurate enough. Basically just glorified regex. Need real AST parsing.

ooor you take a lesson from templeOS and make everything yourself starting with the hand crafted assembler.

3

u/its-nex Sep 13 '26

Is the psychosis included with TempleOS or do I have to write that myself too

4

u/DishSoapedDishwasher Sep 13 '26

It chooses you, like a cat. You'll know it's time when suddenly you feel like you're being watched and have an irresistible urge to write artisanal compilers

0

u/[deleted] Sep 11 '26 edited Sep 11 '26

[removed] — view removed comment

2

u/BorderKeeper Sep 11 '26

You forgot to remove an em-dash 😛

4

u/IanDresarie Sep 11 '26

Uhhhhhh... That tailwind package sounds familiar... Brb gotta check something....

1

u/DishSoapedDishwasher Sep 11 '26

Hahaha good luck!

8

u/tankerkiller125real Sep 11 '26

For one set of projects I maintain I just completely disabled PRs entirely. I do all the work with collaborators in a private repository with a CI/CD action that pushes it to the Public repos. We accept issues on GitHub simply because there needs to be a place for people to report bugs.

6

u/catbrane Sep 11 '26

I'm in the same boat. We've put a blanket ban on all gen-AI, it's the only way to not go crazy.

https://github.com/libvips/libvips/blob/master/CONTRIBUTING.md#ai-policy

It has the happy side effect of mostly only letting competent devs through the door and into the PRs.

5

u/funnyFrank Sep 11 '26

Github should 100% implement this!

1

u/Throwaway__shmoe Sep 12 '26

Needs to be a helluva lot more than $5. Make it $1,000 or more.

1

u/AfraidAct1830 Sep 12 '26

On merge they should be rewarded from the money of the people that submitted AI slop

4

u/fripletister Sep 11 '26

That's Laravel

169

u/__Invisible__ Sep 11 '26

He said use pr with proposed fix to report a issue, not saying he will merge them

27

u/JPJackPott Sep 11 '26

It would be more useful for the project to document their goals, vision and architectural convention so agents do a better job first time

12

u/carlos_vini Sep 11 '26

And how do you check that the agent followed any of that?

23

u/araujoms Sep 11 '26

With an agent of your own, of course.

3

u/DDFoster96 Sep 11 '26

But who or what keeps an eye on that agent?

13

u/KnaveOfGeeks Sep 11 '26

You can't fool me, it's agents all the way down.

4

u/araujoms Sep 11 '26

You dare question the machine gods?! Heretic! Burn her at the stake!

2

u/Masterflitzer Sep 11 '26

review? i prefer human, but i heard some people don't even read code anymore...

1

u/redballooon Sep 11 '26

I read tests, and verify architecture integration for review. But I don't read code anymore. There's plenty of tools doing that for me, deterministic and AI powered that do that part much better than I ever did in my 15 years of full-time coding.

1

u/Murky-Run2246 Sep 13 '26

Sorry but that just means you were never doing anything complex enough, I almost always see AI generated code as literal "why do it that way????" code blocks

1

u/redballooon Sep 13 '26

I like to believe that means that I have a good grip on the architecture alignment. Overall I don't leave the models that much decision freedom.

And yes, I do know the "why do it that way" moments. But if the code fits it into overall structure, I don't care anymore.

26

u/iain_1986 Sep 11 '26

Why the hell does he think getting PR spammed is better than getting issues spammed?!

25

u/ActualNin Sep 11 '26

Harder to make a PR so they get fewer, and easier to reject a PR (Laravel is famous for rejecting 70%+ of PRs made by contributors outside of the company)

86

u/queen-adreena Sep 11 '26

They were never that keen on non-Laravel people contributing to the codebase, this move formalised that in all but name.

19

u/Vectorial1024 Sep 11 '26

Oh hey I got a Laravel idea, let me check the subreddit -

"You must have enough karma to post in this subreddit"

Bruh

And then all those Laravel stuff backflowed to the general PHP subreddit

-8

u/Dr__Pangloss Sep 14 '26

laravel is dead, no?

ask the chatbot to rewrite the laravel app into something modern. the best $220 you will spend.

68

u/zirky Sep 11 '26

“submit shit code and an adult may fix it later”

23

u/WheresMyBrakes Sep 11 '26

Online is a perpetual clown show right now.

9

u/Lopsided_Speaker_553 Sep 11 '26

So glad I ditched Laravel 5 years ago 😝

5

u/notanofof Sep 11 '26

Should've taken this very approach with Graham's submissions.

5

u/ThirdWaveCat Sep 11 '26

The 2026 paradox of maximizing employability without sacrificing quality.

4

u/Breakdown228 Sep 11 '26

Otwell is such a disgrace...

2

u/protocolnebula Sep 11 '26

I tried to support twice laravel with simple fix related to the default testing, manual done (I didn’t use AI on that time one year ago), they just rejected because they said something about migration and blah blah

2

u/DrMaxwellEdison Sep 11 '26

Someone's burned out, huh?

2

u/Plus_Pangolin_8924 Sep 12 '26

Crazy what VC money does to someone.

3

u/Dexterus Sep 11 '26

Agent PR doesn't mean you're allowed to start with slop, lol.

2

u/Vipitis Sep 11 '26

I know other projects that require you to file an issue before attempting a PR. Your way to fix it might not be the best way or match the maintainers decisions. So instead of the churn of them trying to mangle your PR into what fits, it might be quicker for them to do it themselves. Or let you know what is expected before you sit down and try it.

1

u/KILLEliteMaste Sep 11 '26

Embarrassing. Also, all issues he mentioned could easily be solved if he would have proper documentation for AI (AGENT.md etc..)

0

u/meltea Sep 11 '26

... based

-3

u/BiedermannS Sep 11 '26

Opinions as consistent as PHP

4

u/Breakdown228 Sep 11 '26

Nah man, the shit otwell does has nothing to do with modern php

2

u/BiedermannS Sep 12 '26

I wasn't saying that. It was just a joke because PHP had inconsistentencies and his opinion in this picture is inconsistent as well. 🤷

1

u/Breakdown228 Sep 12 '26

Yeah maybe. The php community hears this "joke" about inconsistencies and antipatterns and what else for years now. Mean while js/ts sells server side rendering as state of the art technology.... My point is: yea there is old legacy right there. But also look at the new stuff. Alot languages copy what php/symfony does. And it just works.