3 ms·
That analogy might work with the original formulation of this idea: if someone opens a "big" pull request on a project you weary of, hand it over. That PR, even
by ploxiln 7y ago
That analogy might work with the original formulation of this idea: if someone opens a "big" pull request on a project you weary of, hand it over. That PR, even without substantial review, can show effort and familiarity, and you could argue there's a really good chance they'll try to be good stewards.
But in this case, it's not "a member of that community who also has potato farming skills", it's an absolute nobody, who you haven't seen doing any farming, or eating, before. It's a big world, there are crazies out there, they show up every once in a while.
And finally, it's the internet, it's not really like anything that came before. You can be more trusting in a small town than in a big city. The internet is 1000 times bigger than the biggest city, it's a whole new kind of thing. If 99.9% of people out there have good intentions, that still leaves millions of people on the internet trying figure out a way to take advantage of you.
- dustfinger 7y agoTrust issues can often be mitigated with verifiable signatures. Perhaps if there was a protocol in place requiring each release to be signed by the current maintainer and all commits signed by the individual contributors, then a change in signature on the release would have provided a strong downstream signal that maintenance had changed hands. Without verifiable signatures, downstream is drinking the water without testing it. As you said, there are crazies out there, who knows what they might put in the water.