Open Source as We Know It Is Dead

But it's honestly how I've started to feel: open source, as I've known it, is dying. And I sadly think AI is what's killing it.It was never just the codeWhen people talk about open source, they usually talk about code.

Licenses, packages, download counts, stars. That was never the part that kept me coming back though.It was the people. It was fixing a typo in a README and having someone say thanks. It was a stranger on the other side of the world finding a bug in my code and sending a fix before I'd even woken up. It was arguing (politely, mostly) in an issue thread about the right API, and ending up with something better than either of us would've built alone.My first real GitHub PRs were in June 2014, three years to the day after I made that account. We were using PointDNS, and their little Node.js client crashed with SyntaxError: Unexpected end of input whenever you listed records on a big zone. It wasn't handling chunked responses, so I fixed it. Two hours later, feeling brave, I opened a second PR: a "global tidy up" that touched almost every line in the file. My description said, with all the confidence of someone who had never really maintained anything:We're huge fans of your service, but this node.js module was rather counter-intuitive to use. Hopefully this pull request will help solve that issue for any future developers!A maintainer merged both the next morning - no back and forth, no checklist, no bots. A stranger sent them 300 lines of unsolicited changes, and they took a chance on it. I can't fully explain what that did for me, except that it made me feel like I belonged.A PR isn't just a diff - it's someone saying "I used your thing, I cared enough to make it better, and I'm trusting you with my work." Reviewing it is you saying "I see you, let's do this together." That exchange, repeated millions of times, is what built the Internet we all use every day.Looking back at that second PR, I'm honestly a little embarrassed. An unsolicited rewrite from someone nobody had heard of, with a slightly cocky description? Miguel Grinberg, who maintains Flask-SocketIO, put it bluntly this year: "Today, an unsolicited PR is a red flag."

If mine landed in a repo today, I'd assume an agent wrote it too, and I wouldn't blame anyone for closing it.Andreas Kling said it best when Ladybird stopped accepting public PRs: "A substantial patch used to imply substantial effort, and that effort was a reasonable proxy for good faith. That assumption no longer holds." A real person wrote my PR, nervous, hoping it was good enough. The effort was the signal. That's what's gone.It's not fun anymoreSomething shifted over the last year or so, and it's been hard to put into words.Open a PR on a popular repo today and observe what happens.

Within seconds, a bot leaves an AI review summarizing your own change back to you. Another bot posts a preview deployment. Another posts a "walkthrough" with a sequence diagram nobody asked for. Sometimes a fourth shows up to respond to the third. By the time a human actually looks at it, the thread is a wall of generated text, and the real conversation (the human part) is buried somewhere in the middle.That's the good case, where a human wrote the PR. The bad case is when nobody really did, like PRs that "fix" issues that don't exist, or PRs that rewrite half a file with confident, plausible, completely wrong code, or security reports that read like the real thing until you realize the vulnerability was hallucinated. And there are apparently accounts opening dozens of these a day across hundreds of repos, just farming green squares for a résumé.I've started muting notifications from repos I used to love following since it's mostly just noise now, and that makes me sadder than I expected it to.Even that first PointDNS PR, sitting quietly for over a decade, picked up a string of junk comments last November from an account I'd never seen. A #, a ###, a broken screenshot upload. I honestly don't know if it was a bot or a person. That's kind of the point.I don't blame maintainers one bitAI slop PRs are the worst kind of work. They look like contributions, so you feel obligated to read them. They take real time to review, and then more time to explain why they're wrong to someone (or something) that isn't listening. That's time not spent on the actual project, or with family, or sleeping.And the doors are closing.

Fast.Not everywhere, and not all in the same way, but the direction of travel is hard to miss. curl ended its monetary bug bounty after the signal-to-noise ratio collapsed. Daniel Stenberg wrote that the share of real reports had fallen below 5%: “Not even one in twenty was real.”tldraw started automatically closing external PRs.

Ghostty tightened its AI policy, with Mitchell Hashimoto writing that low-effort AI contributions had increased the “bad” count “by 10x if not more.” Jazzband, home to dozens of Python projects, shut down entirely, blaming GitHub’s “slopocalypse” of generated PRs and issues.OpenJDK banned LLM-generated contributions, naming reviewer burden as the first risk. Ladybird stopped accepting public pull requests. Godot now requires code to be human-authored and bans autonomous agents. COSMIC requires contributors to confirm that their PRs contain no LLM-generated code, comments, or descriptions.

(It's been 15 years for me)If you’ve written JavaScript in the last decade, you’ve almost certainly run his code.The details vary, but the shape is the same: maintainers are no longer just deciding whether a contribution is good, they’re deciding whether they can afford to find out. I don’t think they’re wrong, and that's the really difficult part. Every maintainer closing the door is probably making the rational choice for their project, their time, and their sanity.