4 ms·

I'm curious how/if this can handle sponsor theft. The mechanism: someone posts an issue and puts a bounty on it. A working fix is imported by a developer. The s

by runako 6y ago

I'm curious how/if this can handle sponsor theft. The mechanism: someone posts an issue and puts a bounty on it. A working fix is imported by a developer. The sponsor then grabs the diff and applies it to their own private fork of the code. Most open source bugs never get fixed (or get fixed slowly), and this project would select further for issues that are not already being addressed for whatever reason. So it's not unreasonable to think that many PRs would not be merged inside 6 months, even if they are valid fixes. (Raise your hand if you've ever contributed a PR to an OSS project and had it linger for > 6 months.) That risk, plus the low bounties identified by other posters here, seem very tough to overcome.

themanmaran 6y ago
Well luckily git has timestamps. And we have a manual approval step before bounties are paid out. So the original developer would have to raise a dispute somewhere (issue, email, etc.) and I could go through the commit history to see who wrote the code originally. Although I think that would be an extreme edge case. Especially with a low bounty. I don't think it's worth the effort of ripping off another contributor. And if the bounty was like $10,000. I would pay a lot more attention to the solution before sending out the money.