isn’t the better solution not to accept PRs from unknown / untrusted sources
I think that’s partly the point of this exercise - if they find a meow they now know this is an untrusted source.
Because it’s pretty easy to say ‘ignore untrusted sources’ but when you’re maintaining an open source repo (especially if it’s still pretty small/new) this detection is part of the cognitive burden. Almost every contribution will technically be from an unknown source for a long time, until, if you’re lucky, some drive-by contributors turn regular.














Was it already with the same text/emoji combo?
Cause that particular tears of joy emoji only became standardized in Unicode 6.0, 2010. It was presumably around a bit before that but nobody except the Japanese really did a lot of emoji stuff much before that (iirc Google and Apple only started adding the first emoji to their keyboards 2007-08).
Either way would find it very interesting if somebody was already using the emoji way before that, or the text area of the picture went through multiple iterations.