6 ms·

I don't want to sound too negative but doesn't this look like they were in need of volunteers even by risking the repo's integrity by allowing total strangers c

by h1d 10y ago

I don't want to sound too negative but doesn't this look like they were in need of volunteers even by risking the repo's integrity by allowing total strangers commit access from lack of commitment from the real core team? It almost sounds like perl6 is a publically writeable repo.

avar 10y ago
What do you think the risk is? That some sociopath gains access to the perl6 repo and replaces all the code with a shellscript that "sudo rm -rf /"'s? Sure, that's possible, but good contributors will vastly outnumber bad contributors, and such a person's commit access would be revoked instantly. There's still code review for everything, and such a change would not go unnoticed. Just look at Wikipedia. That's the equivalent of a publically writeable repo and hasn't turned into a total shitshow as a result. As the Perl 6 ecosystem demonstrates you get way more out of inclusiveness than being paranoid about some hypothetical bad actor getting access to your repo.
- ycensorator 10y ago
  I don't think there is nearly as much code review in open source projects as people would like to think. Then there is the problem of churn if the new committers get confident and rewrite minor things, which is quite taxing on the existing committers. Wikipedia is a good example that a small number of people either have to guard their territory ferociously or else have everything rewritten. Now, sometimes a rewrite is in order, but in general churn is a major time sink for longer term committers and in fact one of the reasons they ultimately leave.
- pwdisswordfish 10y ago
  > That some sociopath gains access to the perl6 repo and replaces all the code with a shellscript that "sudo rm -rf /"'s? No, that some sociopath gains access to the perl6 repo and introduces subtle, plausibly deniable backdoors. I have looked at Wikipedia. I saw that obvious vandalism, like inserting "HAHA PENIS" in the middle of an article about — I don't know — US presidential candidates, is detected quickly; sometimes it is even caught by filters before it can be saved. Fabricating citations about a fictitious Bhutanese author[1] or Aboriginal deity[2], on the other hand, can go unnoticed for months. This is exacerbated by the fact that your typical "counter-vandalism patrol" usually looks only for the former; even though most hoaxes aren't even especially sophisticated and fall apart after 15 minutes of research. But who can blame those people? It's the easiest way to score virtue points. I don't know why some people are so okay with the most popular reference work of today being developed by a process basically equivalent to Twitch Plays Pokémon. It doesn't even work for the latter... and yet here we are. [1] http://wikipediocracy.com/2015/04/05/bhutanese-passport-what-does-the-hoax-say/ http://wikipediocracy.com/2015/04/05/bhutanese-passport-what... [2] https://en.wikipedia.org/wiki/Jar%27Edo_Wens_hoax https://en.wikipedia.org/wiki/Jar%27Edo_Wens_hoax (embrace the irony!)
  - sqeaky 10y ago
    The thing that your post misses and that most people who criticize Wikipedia miss, is that all stuff written everywhere could be wrong or malicious. Any book, any blog, anything could be wrong by accident or on purpose. Wikipedia is open enough we can investigate it and readily determine who the malicious or incorrect actors are. Which is far more than any book from antiquity, most blogs and even much professional journalism provides. Should we trust wikipedia implicitly? Of course not. Should we trust any single source simplicity? Of course not.
    - pwdisswordfish 10y ago
      When you view any page's history, all you get is a list of pseudonyms and IP addresses. Sure, you can probably get the country of origin and sometimes maybe even the employer from the latter, but that's basically it. I don't think that's very much, given that nobody on Wikipedia is required to disclose who they are in real life (there's even a policy specifically against posting such information about others[1]). Well, okay, in theory users with a financial conflict of interest in a topic are required to disclose it, but in practice PR agencies can often get away doing anything to articles about their clients. And openness in itself doesn't guarantee reliability anyway. OpenSSL being open-source didn't prevent Heartbleed from happening. The so-called "Linus's law" is often a mere vacuous truth; there's rarely enough eyeballs to make even the most obvious bugs shallow. And eyeballs themselves don't help if they keep looking in the wrong places. The problem with Wikipedia isn't merely that it may be sometimes inaccurate. It is that its sources of inaccuracies are much more numerous, most rather predictable, and yet next to nothing is done to address that. A book written by a single author may also be inaccurate; but I'd be more inclined to believe a book written by someone 0) whose good reputation is at stake and who therefore has an disincentive to actively misinform (sometimes at least), and 1) who has an editor above them watching out for inconsistencies; rather than a bunch of pseudonyms and numbers that can immediately publish anything they think up with basically no oversight. Trustworthiness is a spectrum, and Wikipedia does significantly worse on it than many other sources. Review processes on Wikipedia are overworked and even those focus mostly on style rather than substance. There are some relatively sensible policies enacted, but they are quite vague (and therefore bendable to ever-changing whims of particular users) and selectively enforced. And don't get me started with the dispute resolution processes... There is no systematic, consistently applied process to ensure Wikipedia's accuracy. It is addressed just like the gun problem is in the US; it proceeds from one outrageous incident to another[2], with everyone barely applying ad-hoc measures after the fact, while the people who do have the power to make a real difference are either in complete denial that this is a problem at all or are too attached to the idea that the foundational laws can never ever be wrong to actually enact meaningful reforms. [1] https://en.wikipedia.org/wiki/Wikipedia:OUTING https://en.wikipedia.org/wiki/Wikipedia:OUTING [2] https://en.wikipedia.org/wiki/Wikipedia:List_of_Wikipedia_hoaxes https://en.wikipedia.org/wiki/Wikipedia:List_of_Wikipedia_ho...
perlgeek 10y ago
Well, we've been doing this since 2007 at least, likely longer, and haven't detected a single instance of such a behavior. That is a data point. Also, if you don't want to sound too negative, maybe just leave out "from lack of commitment from the real core team". Your question makes sense without it, and that's what comprises much of the negativity in your comment.

by h1d 10y ago

avar 10y ago

What do you think the risk is? That some sociopath gains access to the perl6 repo and replaces all the code with a shellscript that "sudo rm -rf /"'s? Sure, that's possible, but good contributors will vastly outnumber bad contributors, and such a person's commit access would be revoked instantly. There's still code review for everything, and such a change would not go unnoticed. Just look at Wikipedia. That's the equivalent of a publically writeable repo and hasn't turned into a total shitshow as a result. As the Perl 6 ecosystem demonstrates you get way more out of inclusiveness than being paranoid about some hypothetical bad actor getting access to your repo.

ycensorator 10y ago
I don't think there is nearly as much code review in open source projects as people would like to think. Then there is the problem of churn if the new committers get confident and rewrite minor things, which is quite taxing on the existing committers. Wikipedia is a good example that a small number of people either have to guard their territory ferociously or else have everything rewritten. Now, sometimes a rewrite is in order, but in general churn is a major time sink for longer term committers and in fact one of the reasons they ultimately leave.
pwdisswordfish 10y ago
> That some sociopath gains access to the perl6 repo and replaces all the code with a shellscript that "sudo rm -rf /"'s? No, that some sociopath gains access to the perl6 repo and introduces subtle, plausibly deniable backdoors. I have looked at Wikipedia. I saw that obvious vandalism, like inserting "HAHA PENIS" in the middle of an article about — I don't know — US presidential candidates, is detected quickly; sometimes it is even caught by filters before it can be saved. Fabricating citations about a fictitious Bhutanese author[1] or Aboriginal deity[2], on the other hand, can go unnoticed for months. This is exacerbated by the fact that your typical "counter-vandalism patrol" usually looks only for the former; even though most hoaxes aren't even especially sophisticated and fall apart after 15 minutes of research. But who can blame those people? It's the easiest way to score virtue points. I don't know why some people are so okay with the most popular reference work of today being developed by a process basically equivalent to Twitch Plays Pokémon. It doesn't even work for the latter... and yet here we are. [1] http://wikipediocracy.com/2015/04/05/bhutanese-passport-what-does-the-hoax-say/ http://wikipediocracy.com/2015/04/05/bhutanese-passport-what... [2] https://en.wikipedia.org/wiki/Jar%27Edo_Wens_hoax https://en.wikipedia.org/wiki/Jar%27Edo_Wens_hoax (embrace the irony!)
- sqeaky 10y ago
  The thing that your post misses and that most people who criticize Wikipedia miss, is that all stuff written everywhere could be wrong or malicious. Any book, any blog, anything could be wrong by accident or on purpose. Wikipedia is open enough we can investigate it and readily determine who the malicious or incorrect actors are. Which is far more than any book from antiquity, most blogs and even much professional journalism provides. Should we trust wikipedia implicitly? Of course not. Should we trust any single source simplicity? Of course not.
  - pwdisswordfish 10y ago
    When you view any page's history, all you get is a list of pseudonyms and IP addresses. Sure, you can probably get the country of origin and sometimes maybe even the employer from the latter, but that's basically it. I don't think that's very much, given that nobody on Wikipedia is required to disclose who they are in real life (there's even a policy specifically against posting such information about others[1]). Well, okay, in theory users with a financial conflict of interest in a topic are required to disclose it, but in practice PR agencies can often get away doing anything to articles about their clients. And openness in itself doesn't guarantee reliability anyway. OpenSSL being open-source didn't prevent Heartbleed from happening. The so-called "Linus's law" is often a mere vacuous truth; there's rarely enough eyeballs to make even the most obvious bugs shallow. And eyeballs themselves don't help if they keep looking in the wrong places. The problem with Wikipedia isn't merely that it may be sometimes inaccurate. It is that its sources of inaccuracies are much more numerous, most rather predictable, and yet next to nothing is done to address that. A book written by a single author may also be inaccurate; but I'd be more inclined to believe a book written by someone 0) whose good reputation is at stake and who therefore has an disincentive to actively misinform (sometimes at least), and 1) who has an editor above them watching out for inconsistencies; rather than a bunch of pseudonyms and numbers that can immediately publish anything they think up with basically no oversight. Trustworthiness is a spectrum, and Wikipedia does significantly worse on it than many other sources. Review processes on Wikipedia are overworked and even those focus mostly on style rather than substance. There are some relatively sensible policies enacted, but they are quite vague (and therefore bendable to ever-changing whims of particular users) and selectively enforced. And don't get me started with the dispute resolution processes... There is no systematic, consistently applied process to ensure Wikipedia's accuracy. It is addressed just like the gun problem is in the US; it proceeds from one outrageous incident to another[2], with everyone barely applying ad-hoc measures after the fact, while the people who do have the power to make a real difference are either in complete denial that this is a problem at all or are too attached to the idea that the foundational laws can never ever be wrong to actually enact meaningful reforms. [1] https://en.wikipedia.org/wiki/Wikipedia:OUTING https://en.wikipedia.org/wiki/Wikipedia:OUTING [2] https://en.wikipedia.org/wiki/Wikipedia:List_of_Wikipedia_hoaxes https://en.wikipedia.org/wiki/Wikipedia:List_of_Wikipedia_ho...

perlgeek 10y ago

Well, we've been doing this since 2007 at least, likely longer, and haven't detected a single instance of such a behavior. That is a data point. Also, if you don't want to sound too negative, maybe just leave out "from lack of commitment from the real core team". Your question makes sense without it, and that's what comprises much of the negativity in your comment.