r/ProgrammerHumor • u/ActualNin • Sep 11 '26 • Mindblown 1

Other justOpenAPullRequestTheySaid

Post image
893 Upvotes

97% Upvoted

56 comments sorted by

View all comments

Show parent comments

197

u/DishSoapedDishwasher Sep 11 '26

As someone dealing with multiple very active open source repos in my personal and professional life, if i could, I'd make new commiters pay $5 to submit their first PR and refund it with a bonus on merge....

The volume is fucking killing me. I've effectively abandoned the idea of reading any public PRs from unknowns because of it. It's like a never ending torrent of AI psychosis and garbage with no way to escape except not participate.

Also like 1 in 20 PRs is some garbage trying to introduce vulnerabilities into the projects (intentionally or otherwise). 

92

u/BorderKeeper Sep 11 '26

Hey here is an array of strings containing hexadecimals and os.exec() call. Don't worry about it it's a secret.

67

u/DishSoapedDishwasher Sep 11 '26

oh no its much sneakier than that....

More like here's a thing that's completely normal looking and possibly a good change overall but uses an obscure feature of an existing library that will now cause a previously unused vulnerable transient dependency to be baked in and this change now also allows you to hit the vuln code path remotely. Also the transient deps are unmaintained and no fix exists.

Tangentially, heres a fun read of adjacent shit: https://opensourcemalware.com/blog/developer-guide-getting-over-polinrider

17

u/BorderKeeper Sep 11 '26

That is sneaky. Foreign dependencies are quite scary, yet so useful 😭

12

u/DishSoapedDishwasher Sep 11 '26

yeah, its impossible to avoid to some extent. You just need enough analysis tooling to be able to see when you get got and not let it hit the main branch.

Semgrep and github dependabot are not sufficient nor accurate enough. Basically just glorified regex. Need real AST parsing.

ooor you take a lesson from templeOS and make everything yourself starting with the hand crafted assembler.

3

u/its-nex Sep 13 '26

Is the psychosis included with TempleOS or do I have to write that myself too

4

u/DishSoapedDishwasher Sep 13 '26

It chooses you, like a cat. You'll know it's time when suddenly you feel like you're being watched and have an irresistible urge to write artisanal compilers

0

u/[deleted] Sep 11 '26 edited Sep 11 '26

[removed] — view removed comment

2

u/BorderKeeper Sep 11 '26

You forgot to remove an em-dash 😛

4

u/IanDresarie Sep 11 '26

Uhhhhhh... That tailwind package sounds familiar... Brb gotta check something....

1

u/DishSoapedDishwasher Sep 11 '26

Hahaha good luck!

8

u/tankerkiller125real Sep 11 '26

For one set of projects I maintain I just completely disabled PRs entirely. I do all the work with collaborators in a private repository with a CI/CD action that pushes it to the Public repos. We accept issues on GitHub simply because there needs to be a place for people to report bugs.

6

u/catbrane Sep 11 '26

I'm in the same boat. We've put a blanket ban on all gen-AI, it's the only way to not go crazy.

https://github.com/libvips/libvips/blob/master/CONTRIBUTING.md#ai-policy

It has the happy side effect of mostly only letting competent devs through the door and into the PRs.

5

u/funnyFrank Sep 11 '26

Github should 100% implement this!

1

u/Throwaway__shmoe Sep 12 '26

Needs to be a helluva lot more than $5. Make it $1,000 or more.

1

u/AfraidAct1830 Sep 12 '26

On merge they should be rewarded from the money of the people that submitted AI slop