4 ms·

I don't understand it. If you are a project maintainer on GitHub, how could you accept a PR from an anonymous user? Let's say you accepted it, and later some c

I don't understand it. If you are a project maintainer on GitHub, how could you accept a PR from an anonymous user? Let's say you accepted it, and later some company said that the code from that PR is "stolen" from their code base, and that's true, how do you deal with that?

deanclatworthy 9y ago
There's absolutely no way for you to verify that code submitted as a PR isn't stolen, anonymous or not. Even if I created an account with a legitimate identity and submitted a PR to your project which you accepted and then found out was stolen, what can you do about it? Slap on the wrist and move on. I hate the idea of having an identity on github. I don't want to be contacted for support, and I don't want my email being harvested by spam bots and recruiting agencies (both of which has happened).
- fishywang 9y ago
  The absolute solution for that is force contributors to sign CLA, and I don't think there's a way to sign that anonymously. I know a lot of smaller projects won't bother with CLA, but their maintainers can still assess the possibility of stolen code and act accordingly. If I'm a maintainer and the possibility of an incoming PR is stolen (the complexity of the PR, basically) is high enough, I would look at the information associated with the contributor (the GitHub account, the email address, etc.). If it's someone contribute a lot to other open source projects I would be more likely to accept it. Actually on second thought, GitHub really should provide free CLA management service to all its users: you (as a project maintainer) can enable CLA requirement on your project, once enabled a GitHub-run CLA bot will ask new contributors sign a CLA in their first PR, and you can get all the signed CLAs when needed. If GitLab or BitBucket provide this feature before GitHub I'll move my projects over in a heartbeat.

deanclatworthy 9y ago

There's absolutely no way for you to verify that code submitted as a PR isn't stolen, anonymous or not. Even if I created an account with a legitimate identity and submitted a PR to your project which you accepted and then found out was stolen, what can you do about it? Slap on the wrist and move on. I hate the idea of having an identity on github. I don't want to be contacted for support, and I don't want my email being harvested by spam bots and recruiting agencies (both of which has happened).

fishywang 9y ago
The absolute solution for that is force contributors to sign CLA, and I don't think there's a way to sign that anonymously. I know a lot of smaller projects won't bother with CLA, but their maintainers can still assess the possibility of stolen code and act accordingly. If I'm a maintainer and the possibility of an incoming PR is stolen (the complexity of the PR, basically) is high enough, I would look at the information associated with the contributor (the GitHub account, the email address, etc.). If it's someone contribute a lot to other open source projects I would be more likely to accept it. Actually on second thought, GitHub really should provide free CLA management service to all its users: you (as a project maintainer) can enable CLA requirement on your project, once enabled a GitHub-run CLA bot will ask new contributors sign a CLA in their first PR, and you can get all the signed CLAs when needed. If GitLab or BitBucket provide this feature before GitHub I'll move my projects over in a heartbeat.