Ladybird stops taking pull requests — because a big patch no longer proves effort

Why a from-scratch browser is closing its doors to outside code

Ladybird — the independent, built-from-nothing browser engine that became a darling of the 'we don't need another Chromium' crowd — announced a change to how it develops. The short version: it will no longer accept public pull requests, all currently open public PRs get closed, and code changes will only be introduced by project maintainers. Bug reports, code reductions, security reports, standards and design discussion stay open. Writing code for them does not.

The argument: trust used to be a byproduct of effort

The post's thesis is precise and doesn't actually blame AI on the surface — it blames what AI did to a signal. For decades, the team writes, code contributions were how open source learned who to trust: people showed up, did the work, took responsibility, stuck around. That loop relied on one assumption, and the post states it plainly:

• "A substantial patch used to imply substantial effort, and that effort was a reasonable proxy for good faith. That assumption no longer holds."
• "A pull request no longer tells us as much as it used to about the person submitting it."
• "Whether code was typed by hand is beside the point. What matters is who is responsible for it once it enters the browser."

The browser-specific stakes raise the cost of being wrong: a browser "runs untrusted input from the entire internet on the user's machine," so a single disguised vulnerability is catastrophic. The conclusion: the people introducing changes "must be the people who decide those changes belong in the project, and who will answer for the consequences."

The thread: 'death of open source' vs 'a free puppy'

With 521 comments, the thread is a referendum on what open source even means now. The most resonant supporting observation came from someone watching the exact same dynamic at another large project:

"I've been looking a lot at Godot … PRs lately, and there's been kind of a surge of wholy ai-generated PRs … even the people who are all in on ai haven't internalized that there's no inherent value in producing a big lump of code. They've massively decreased the work they put in but still expect the same pre-ai reaction/gratitude when submitting a big PR." — a commenter tracking Godot's AI-PR surge

The single line everyone agreed was the crux got quoted back repeatedly:

"'A substantial patch used to imply substantial effort, and that effort was a reasonable proxy for good faith. That assumption no longer holds.' … I believe this is the key point the article makes and it's valid for most projects out there" — a commenter naming the load-bearing sentence

A Linux Foundation maintainer confirmed it's an everywhere-problem, not a Ladybird quirk:

"I manage multiple open source Github enterprises for the Linux Foundation. Something like this is under discussion in all of them - the amount of terrible PRs and issues being filed is overwhelming." — a Linux Foundation open-source maintainer

Then the pushback, and it's serious. A retired ex-Chrome engineer flagged the cost to openness itself:

"Fascinating to see that Chromium/Gecko/WebKit are now more 'open' browser engines than Ladybird, at least in one important respect." — a retired engineer who worked on Chrome at Google

And a pointed objection that the new rule wastes everyone's time — you can find and fix a bug, but you can't tell them how:

"So I can find a bug, I can fix it, but I am not allowed to tell them how exactly I did it. Instead they have to re-figure it out. … Reviewing code fixes is strictly easier than coming up with them yourself." — a developer who has upstreamed fixes to V8

The uncomfortable asterisk

Two facts complicate the clean narrative. First, a commenter who has watched the repo noted the policy may be partly about control, not just slop: the lead author "tends to regularly make nontrivial >1k LOC PRs … and merge them on the same day with no reviews at all," wrote a commenter uneasy with the project's own merge pace — which sits awkwardly next to a post about contribution rigor. Second, several pointed out this model already has a famous, successful precedent: "SQLite … has been developed this way pretty much forever," noted a Clojure developer.

The deeper read, from a maintainer's chair, is that 'free contributions from strangers' was never actually free. "'free' in 'free code contributions by strangers' is like 'free' in 'free puppy'," wrote a long-time HN contributor. AI didn't invent the cost of reviewing outside code — it just removed the effort-filter that used to keep the puppies to a manageable litter. What changed isn't Ladybird's openness; it's that a green CI checkmark and a 10,000-line diff no longer tell you anything about the human who sent them.