4 ms·

Many have started adding collaborator status to any user that makes a non-trivial commit to both show appreciation and lighten the load.

akerro 10y ago
So they are also able to push directly to master, push bad changes, backdoor/add malware to your projects and make a release. I would be careful with this.
- diggan 10y ago
  I'm one of the people who do this, if anyone is doing more significant change than just updating the readme/fixing a typo, give them collaborator status after checking out their profile. I think the benefit of people feeling proud of being a collaborator and trust from me, is bigger than the risk of someone ruining their own reputation by adding a backdoor. But, most of my projects are tiny-ish and not even close to big, so I guess I have a bit more flexibility in this. EDIT: Just remembered that you can activate "Protected Branches" on Github (and I'm sure something similar exists for Bitbucket and Gitlab as well) that disables pushes straight to master.
- lmm 10y ago
  They can't make a release without the signing keys. (Well, they can, but everyone will know it wasn't one of mine)
- sotojuan 10y ago
  It's all about trust. So far no one I know has been burned.
- mrob 10y ago
  You're not just trusting them to have good intentions, you're also trusting them to keep their system secure. If you have commit access to a popular project then your commit credentials are a high value target. What do you know about their security practices?
j_s 10y ago
http://felixge.de/2013/03/11/the-pull-request-hack.html http://felixge.de/2013/03/11/the-pull-request-hack.html https://news.ycombinator.com/item?id=5357417 https://news.ycombinator.com/item?id=5357417
- kens 10y ago
  The pull request hack saved my project. I had created an open source project but didn't have time to keep up with it, was falling behind, and hated looking at the open issues. (I imagine many of you know the feeling.) After reading the pull request hack, I gave commit access to some people who had made solid contributions. One of them ran with it, replying to issues, merging outstanding pull requests, closing obsolete issues, and doing a great job. (Thanks z3t0!) If you're feeling overwhelmed by an open source project or no longer enjoying it, give the pull request hack a try.
yaur 10y ago
Ugh. I ended up making a bunch of contributions to a project that we were using for work and the maintainer did this. It was a headache for >1 year after we stop using it and the maintainer disappeared.

akerro 10y ago

So they are also able to push directly to master, push bad changes, backdoor/add malware to your projects and make a release. I would be careful with this.

diggan 10y ago
I'm one of the people who do this, if anyone is doing more significant change than just updating the readme/fixing a typo, give them collaborator status after checking out their profile. I think the benefit of people feeling proud of being a collaborator and trust from me, is bigger than the risk of someone ruining their own reputation by adding a backdoor. But, most of my projects are tiny-ish and not even close to big, so I guess I have a bit more flexibility in this. EDIT: Just remembered that you can activate "Protected Branches" on Github (and I'm sure something similar exists for Bitbucket and Gitlab as well) that disables pushes straight to master.
lmm 10y ago
They can't make a release without the signing keys. (Well, they can, but everyone will know it wasn't one of mine)
sotojuan 10y ago
It's all about trust. So far no one I know has been burned.
mrob 10y ago
You're not just trusting them to have good intentions, you're also trusting them to keep their system secure. If you have commit access to a popular project then your commit credentials are a high value target. What do you know about their security practices?

j_s 10y ago

http://felixge.de/2013/03/11/the-pull-request-hack.html http://felixge.de/2013/03/11/the-pull-request-hack.html https://news.ycombinator.com/item?id=5357417 https://news.ycombinator.com/item?id=5357417

kens 10y ago
The pull request hack saved my project. I had created an open source project but didn't have time to keep up with it, was falling behind, and hated looking at the open issues. (I imagine many of you know the feeling.) After reading the pull request hack, I gave commit access to some people who had made solid contributions. One of them ran with it, replying to issues, merging outstanding pull requests, closing obsolete issues, and doing a great job. (Thanks z3t0!) If you're feeling overwhelmed by an open source project or no longer enjoying it, give the pull request hack a try.

yaur 10y ago

Ugh. I ended up making a bunch of contributions to a project that we were using for work and the maintainer did this. It was a headache for >1 year after we stop using it and the maintainer disappeared.