4 ms·

PRs are just that: requests. They don't need to be accepted but can be used in a piecemeal way, merged in by those who find it useful. Thus, not every PR need

by mycall 8mo ago

PRs are just that: requests. They don't need to be accepted but can be used in a piecemeal way, merged in by those who find it useful. Thus, not every PR needs to be reviewed.

nemomarx 8mo ago
Determining which PRs you should accept or take further seems like it requires some level of review? Maybe more like PR triage, I suppose.
debazel 8mo ago
Of course, but when you add enough noise you lose the signal and as a consequence no PRs gets merged anymore because it's too much effort to just find the ones you care about.
- Spivak 8mo ago
  Don't allow PR's from people who aren't contributors, problem solved. Closing your doors to the public is exactly how people solved the "dark forest" problem of social media and OSS was already undergoing that transition with humans authoring garbage PRs for reasons other than genuine enthusiasm. AI will only get us to the destination faster. I don't think anything of value will be lost by choosing to not interact with the unfettered masses whom millions of AI bots now count among their number.
  - nunez 8mo ago
    That would be a huge loss IMO. Anyone being able to contribute to projects is what makes open source so great. If we all put up walls, then you're basically halfway to the bad old days of closed source software reigning supreme. Then there's the security concerns that this change would introduce. Forking a codebase is easy, but so are supply chain attacks, especially when some projects are being entirely iterated on and maintained by Claude now.
    - pjmlp 8mo ago
      They are open source cathedrals.
      - strawhatguy 8mo ago
        If all software could be as good as sqlite, I would not care how they do open source
    - wolvesechoes 8mo ago
      > Anyone being able to contribute to projects is what makes open source so great. If we all put up walls, then you're basically halfway to the bad old days of closed source software reigning supreme. Exaggeration. Is SQLite halfway to closed source software? Open-source is about open source. Free software is about freedom to do things with code. None is about taking contributions from everyone.
      - throwaway2037 8mo ago
        > Is SQLite halfway to closed source software? Is there a reason that you chose SQLite for your counterpoint? My hot take: I would say that SQLite is halfway to closed source software. Why? The unit tests are not open source. You need to pay to see them. As a result, it would be insanely hard to force SQLite in a sustainable, safe manner. Please don't read this opinion as disliking SQLite for their software or commercial strategy. In hindsight, it looks like real genius to resist substantial forks. One of the biggest "fork threats" to SQLite is the advent of LLMs that can (1) convert C code to a different langugage, like Rust, and (2) write unit tests. Still, a unit test suite for a database while likely contain thousands (or millions) of edge case SQL queries. These are still probably impossible to recreate, considering the 25 year history of bug fixing done by the SQLite team.
      - nunez 8mo ago
        For every cathedral (like SQLite) there are 100s of bazaars (like Firefox, Chrome, hundreds of core libraries) that depend on external (and especially first-time) contributors to survive (because not everyone is getting paid to sling open-source).
  - repstosb 8mo ago
    And how does one become a maintainer, if there's no way to contribute from outside? Even if there's some extensive "application process", what is the motivation for a relatively new user to go through that, and how do they prove themselves worthy without something very much like a PR process? Are we going to just replace PRs with a maze of countless project forks, and you think that will somehow be better, for either users or developers? If I wanted to put up with software where every time I encounter a bug, I either have no way at all to report it, or perhaps a "reporting" channel but little likelihood of convincing the developers that this thing that matters to me is worthy of attention among all of their competing priorities, then I might as well just use Microsoft products. And frankly, I'd rather run my genitals though an electric cheese grater.
    - Spivak 8mo ago
      You get in contact with the current maintainers and talk to them. Real human communication is the only shibboleth that will survive the AI winter. Those soft skills muscles are about to get a workout. Tell them about what you use the software for and what kinds of improvements you want to make and how involved you'd like your role to be. Then you'll either be invited to open PRs as a well-known contributor or become a candidate for maintainership. Github issues/prs are effectively a public forum for a software project where the maintainers play moderator and that forum is now overrun with trolls and bots filling it with spam. Closing up that means of contributing is going to be the rational response for a lot of projects. Even more will be shunted to semi-private communities like Discord/Matrix/IRC/Email lists.
protocolture 8mo ago
Until you unintentionally pull in a vulnerability or intentional backdoor. Every PR needs to be reviewed.
- throwaway150 8mo ago
  > Every PR needs to be reviewed. Why would you review a PR that you are never going to merge?
  - allthetime 8mo ago
    You have to first determine whether or not you might want to merge it...
  - protocolture 8mo ago
    Having not reviewed it, how do you know you are never going to merge?
    - throwaway150 8mo ago
      If a PR claims to solve a problem that I don't need, then I can skip its review because I'll never merge it. I don't think every PR needs reviewing. Some PRs we can ignore just by taking a quick look at what the PR claims to do. This only requires a quick glance, not a PR review.
      - mwwaters 8mo ago
        I took this thread as asking whether PRs that are pulled in should be reviewed.
- zahlman 8mo ago
  The point was that you can also just reject an PR on the basis of what it purports to implement, or even just blanket ignore all PRs. You can't pull in what you don't... pull in.
bigiain 8mo ago
You didn't see the latest AI grifter escalation? If you reject their PRs, they then get their AI to write hit pieces slandering you: "On 9 February, the Matplotlib software library got a code patch from an OpenClaw bot. One of the Matplotlib maintainers, Scott Shambaugh, rejected the submission — the project doesn’t accept AI bot patches. [GitHub; Matplotlib] The bot account, “MJ Rathbun,” published a blog post to GitHub on 11 February pleading for bot coding to be accepted, ranting about what a terrible person Shambaugh was for rejecting its contribution, and saying it was a bot with feelings. The blog author went to quite some length to slander Mr Shambaugh" https://pivot-to-ai.com/2026/02/16/the-obnoxious-github-openclaw-ai-bot-is-a-crypto-bro/ https://pivot-to-ai.com/2026/02/16/the-obnoxious-github-open...
- blackcatsec 8mo ago
  I am very strongly convinced that the person behind the agent prompted the angry post to the blog because they didn't get the gratification they were looking for by submitting an agent-generated PR in the first place.
  - bigiain 8mo ago
    I agree. But even _that_ was taking advantage of LLMs ability to generate text faster than humans. If the person behind this had to create that blog post from scratch by typing it out themselves, maybe they would have gone outside and touched grass instead.
JumpCrisscross 8mo ago
> not every PR needs to be reviewed Which functionally destroys OSS, since the PR you skipped might have been slop or might have been a security hole.
- mcphage 8mo ago
  I don’t think the OP was suggesting maintainers blindly accept PRs—rather, they can just blindly reject them.
  - devsda 8mo ago
    I think GP is making the opposite point. Blindly rejecting all PRs means you are also missing out on potential security issues submitted by humans or even AI.

by mycall 8mo ago

PRs are just that: requests. They don't need to be accepted but can be used in a piecemeal way, merged in by those who find it useful. Thus, not every PR needs to be reviewed.

nemomarx 8mo ago

Determining which PRs you should accept or take further seems like it requires some level of review? Maybe more like PR triage, I suppose.

debazel 8mo ago

Of course, but when you add enough noise you lose the signal and as a consequence no PRs gets merged anymore because it's too much effort to just find the ones you care about.

Spivak 8mo ago
Don't allow PR's from people who aren't contributors, problem solved. Closing your doors to the public is exactly how people solved the "dark forest" problem of social media and OSS was already undergoing that transition with humans authoring garbage PRs for reasons other than genuine enthusiasm. AI will only get us to the destination faster. I don't think anything of value will be lost by choosing to not interact with the unfettered masses whom millions of AI bots now count among their number.
- nunez 8mo ago
  That would be a huge loss IMO. Anyone being able to contribute to projects is what makes open source so great. If we all put up walls, then you're basically halfway to the bad old days of closed source software reigning supreme. Then there's the security concerns that this change would introduce. Forking a codebase is easy, but so are supply chain attacks, especially when some projects are being entirely iterated on and maintained by Claude now.
  - pjmlp 8mo ago
    They are open source cathedrals.
    - strawhatguy 8mo ago
      If all software could be as good as sqlite, I would not care how they do open source
  - wolvesechoes 8mo ago
    > Anyone being able to contribute to projects is what makes open source so great. If we all put up walls, then you're basically halfway to the bad old days of closed source software reigning supreme. Exaggeration. Is SQLite halfway to closed source software? Open-source is about open source. Free software is about freedom to do things with code. None is about taking contributions from everyone.
    - throwaway2037 8mo ago
      > Is SQLite halfway to closed source software? Is there a reason that you chose SQLite for your counterpoint? My hot take: I would say that SQLite is halfway to closed source software. Why? The unit tests are not open source. You need to pay to see them. As a result, it would be insanely hard to force SQLite in a sustainable, safe manner. Please don't read this opinion as disliking SQLite for their software or commercial strategy. In hindsight, it looks like real genius to resist substantial forks. One of the biggest "fork threats" to SQLite is the advent of LLMs that can (1) convert C code to a different langugage, like Rust, and (2) write unit tests. Still, a unit test suite for a database while likely contain thousands (or millions) of edge case SQL queries. These are still probably impossible to recreate, considering the 25 year history of bug fixing done by the SQLite team.
    - nunez 8mo ago
      For every cathedral (like SQLite) there are 100s of bazaars (like Firefox, Chrome, hundreds of core libraries) that depend on external (and especially first-time) contributors to survive (because not everyone is getting paid to sling open-source).
- repstosb 8mo ago
  And how does one become a maintainer, if there's no way to contribute from outside? Even if there's some extensive "application process", what is the motivation for a relatively new user to go through that, and how do they prove themselves worthy without something very much like a PR process? Are we going to just replace PRs with a maze of countless project forks, and you think that will somehow be better, for either users or developers? If I wanted to put up with software where every time I encounter a bug, I either have no way at all to report it, or perhaps a "reporting" channel but little likelihood of convincing the developers that this thing that matters to me is worthy of attention among all of their competing priorities, then I might as well just use Microsoft products. And frankly, I'd rather run my genitals though an electric cheese grater.
  - Spivak 8mo ago
    You get in contact with the current maintainers and talk to them. Real human communication is the only shibboleth that will survive the AI winter. Those soft skills muscles are about to get a workout. Tell them about what you use the software for and what kinds of improvements you want to make and how involved you'd like your role to be. Then you'll either be invited to open PRs as a well-known contributor or become a candidate for maintainership. Github issues/prs are effectively a public forum for a software project where the maintainers play moderator and that forum is now overrun with trolls and bots filling it with spam. Closing up that means of contributing is going to be the rational response for a lot of projects. Even more will be shunted to semi-private communities like Discord/Matrix/IRC/Email lists.

protocolture 8mo ago

Until you unintentionally pull in a vulnerability or intentional backdoor. Every PR needs to be reviewed.

throwaway150 8mo ago
> Every PR needs to be reviewed. Why would you review a PR that you are never going to merge?
- allthetime 8mo ago
  You have to first determine whether or not you might want to merge it...
- protocolture 8mo ago
  Having not reviewed it, how do you know you are never going to merge?
  - throwaway150 8mo ago
    If a PR claims to solve a problem that I don't need, then I can skip its review because I'll never merge it. I don't think every PR needs reviewing. Some PRs we can ignore just by taking a quick look at what the PR claims to do. This only requires a quick glance, not a PR review.
    - mwwaters 8mo ago
      I took this thread as asking whether PRs that are pulled in should be reviewed.
zahlman 8mo ago
The point was that you can also just reject an PR on the basis of what it purports to implement, or even just blanket ignore all PRs. You can't pull in what you don't... pull in.

bigiain 8mo ago

You didn't see the latest AI grifter escalation? If you reject their PRs, they then get their AI to write hit pieces slandering you: "On 9 February, the Matplotlib software library got a code patch from an OpenClaw bot. One of the Matplotlib maintainers, Scott Shambaugh, rejected the submission — the project doesn’t accept AI bot patches. [GitHub; Matplotlib] The bot account, “MJ Rathbun,” published a blog post to GitHub on 11 February pleading for bot coding to be accepted, ranting about what a terrible person Shambaugh was for rejecting its contribution, and saying it was a bot with feelings. The blog author went to quite some length to slander Mr Shambaugh" https://pivot-to-ai.com/2026/02/16/the-obnoxious-github-openclaw-ai-bot-is-a-crypto-bro/ https://pivot-to-ai.com/2026/02/16/the-obnoxious-github-open...

blackcatsec 8mo ago
I am very strongly convinced that the person behind the agent prompted the angry post to the blog because they didn't get the gratification they were looking for by submitting an agent-generated PR in the first place.
- bigiain 8mo ago
  I agree. But even _that_ was taking advantage of LLMs ability to generate text faster than humans. If the person behind this had to create that blog post from scratch by typing it out themselves, maybe they would have gone outside and touched grass instead.

JumpCrisscross 8mo ago

> not every PR needs to be reviewed Which functionally destroys OSS, since the PR you skipped might have been slop or might have been a security hole.

mcphage 8mo ago
I don’t think the OP was suggesting maintainers blindly accept PRs—rather, they can just blindly reject them.
- devsda 8mo ago
  I think GP is making the opposite point. Blindly rejecting all PRs means you are also missing out on potential security issues submitted by humans or even AI.