3 ms·

Have never understood the desire to hoard commit rights, half the point of RCS is rollback, and as the article says, once intent is established through effort (

by dmw_ng 3y ago

Have never understood the desire to hoard commit rights, half the point of RCS is rollback, and as the article says, once intent is established through effort ("proof of work") there is little risk in assuming good faith until demonstrated otherwise. Commit rights are an asymmetrical reward for someone showing interest in a piece of code - cheap to offer and incredibly valuable to receive. They also immediately reduce the long term burden and "ownership" of the code, and for the trusted committer, massively reduce friction and any sense of gatekeeping in contributing to the project. I've done this on at least 4 projects, 3 of them were eventually transferred to the new long term maintainer and 1 became an org of its own, with two maintainers having full admin

aseipp 3y ago
Really depends on the dynamics of the project, and its life cycle. If you're in a well-established project with norms, conventions, long-time users, existing long-time developers, stable features and cadence, and have a lot of code to maintain -- I think being conservative with who you give commit rights to is fairly important. The project is going to have expectations around conventions, maintenance, what quality bar to meet, etc and breaking from those isn't always a good thing. I do think being more liberal with commit bits helps a lot more when you have a project you want to grow, that is new, and you have a lot of code that needs to be written by a lot of people, and ideas to explore, and things that even need rewriting. You need the code written, people to use the software, so you know where to further drive improvements. You need people willing to dogfood and rewrite things and fix the thing they just broke. I wouldn't give commit rights to anybody in that case but, like. If you have a solid history of +5 patches, you have some clear FOSS experience of your own, clearly have skill, and it's early on in the life of the project? I just need the help? Yeah, you could make worse decisions. I have been on both very established projects of 20+ years where commit rights came months after writing patches, and newer projects where they came days after writing patches because the project was (is) still growing. Ultimately, I think it comes down to having an idea of where you want things to go, and picking out the people who seem to share that idea.
woodruffw 3y ago
I don’t think “hoarding” is a useful framing. Instead, the observation is that granting others access to projects has a time dimension: you need to not only find them trustworthy now, but also reasonably believe that they will remain trustworthy. That last part is much harder, and includes things that are partially outside of the other person’s control (like account takeovers, being targeted by foreign and domestic law enforcement, etc.). I generally think projects should accept more maintainers; however, your point about asymmetry goes both ways.
n4te 3y ago
In my experience commit rights also decrease the quality of the code. Nearly everyone sucks. I've had to rewrite FOSS to get rid of the ugly. Ideally I could have kept a better eye on the commits but time doesn't always allow.
unshavedyak 3y ago
I'd probably "hoard" rights. Which is to say, any FOSS project that i am invested in, i am going to fight hard to ensure someone does not have the ability to make my life more difficult. I'd love to give out commit rights, but if it's some random good quality PR there's a very large chance that i now have to maintain that code - as well as any future code they merge if given rights. I hand out code rights freely to those who seem similarly invested. As they can then share the burden for each new issue popping up, etc. However writing the code (the PR) is usually not the hard part in a FOSS project. The fortitude to maintain it is. As the weeks, months and years go by - who will be around? "Commit rights" here seem pretty off-topic to me, honestly. This is FOSS. Assuming a permissive license, you can fork it and publish your own freely. It's not an insult to me for you to do that. But yea, if i'm looking for an out - i'll hand them out to anyone interested. If however i'm needing to maintain it for my own purpose, then my time and will are the resources i'm most concerned about. A single PR is not a the only variable in the equation there, imo.
- casey2 3y ago
  Exactly 0 people are maintainers of projects they don't have commit access to. Even if they dip after 6 month it's far better to have the option to remove any of the 6 months worth of commits in the current codebase than to hypothesis about the state of a future codebase/environment 6 months ago. This becomes even easier with good commit messages. If somebody is a user and decides to write a pull request, they are already invested anything more is virtue signaling, no amount of which will guarantee that they will be there in years, which is an unreasonable stipulation for a project that could be obsolete yesterday.
  - danielheath 3y ago
    When they dip 6 months time, you’re maintaining whatever strange crap they let into your project. If they offer to maintain it, I’d sooner point my docs to suggest using their fork instead of my repo. That makes them the maintainer without me offering to support what they do
  - em-bee 3y ago
    removing code that is not dead, but because it is bad quality is about the hardest thing to do. because if i had time to clean up the code, i could have done it when the pull request was made. so i prefer to gatekeep and not let in bad code to begin with. if it is an application i depend on, then i need to trust the the code to be good enough. mistakes are ok, i make them too. but giving someone commit rights and then finding out 6 months later that almost everything they committed was not good sounds like a bad idea. i also believe that code should be reviewed by a second person, if possible. so if i have a one-man project and there is a second contributor, i would review their pull-requests and commit them. if they in turn are able and willing to review my commits, i might give them commit rights as long as we both can agree to review each others commits. in that case, the other person will only commit code i have written, and i will commit code they have written. (or however we set up the process. either way i will still have seen all the code going into the project.) but i agree with the article. it really depends on the nature of the project. i do have some projects where i am just messing around, creating something useful, but not critical. having others directly commit to that would probably not be a big problem, even if the code they write is messy, as long as it works, it'll be ok. alternatively, if i do have the time to review code, i can also do that after it has been committed. if it's bad, i can clean it up then. and if there is to much cleanup work happening i can revoke commit rights and i'll only have to remove the most recent commits that i don't have the time to clean up.
cortesoft 3y ago
> there is little risk in assuming good faith until demonstrated otherwise. The risk is that a malicious user fakes good commits, earns commit rights, and then pushes malware that is then installed by unsuspecting downstream users before the code is found and reverted. This can be partially mitigated by making sure they don’t have permission to create a release, but it would still be possible to compromise developers working off the main branch.

by dmw_ng 3y ago

aseipp 3y ago

Really depends on the dynamics of the project, and its life cycle. If you're in a well-established project with norms, conventions, long-time users, existing long-time developers, stable features and cadence, and have a lot of code to maintain -- I think being conservative with who you give commit rights to is fairly important. The project is going to have expectations around conventions, maintenance, what quality bar to meet, etc and breaking from those isn't always a good thing. I do think being more liberal with commit bits helps a lot more when you have a project you want to grow, that is new, and you have a lot of code that needs to be written by a lot of people, and ideas to explore, and things that even need rewriting. You need the code written, people to use the software, so you know where to further drive improvements. You need people willing to dogfood and rewrite things and fix the thing they just broke. I wouldn't give commit rights to anybody in that case but, like. If you have a solid history of +5 patches, you have some clear FOSS experience of your own, clearly have skill, and it's early on in the life of the project? I just need the help? Yeah, you could make worse decisions. I have been on both very established projects of 20+ years where commit rights came months after writing patches, and newer projects where they came days after writing patches because the project was (is) still growing. Ultimately, I think it comes down to having an idea of where you want things to go, and picking out the people who seem to share that idea.

woodruffw 3y ago

I don’t think “hoarding” is a useful framing. Instead, the observation is that granting others access to projects has a time dimension: you need to not only find them trustworthy now, but also reasonably believe that they will remain trustworthy. That last part is much harder, and includes things that are partially outside of the other person’s control (like account takeovers, being targeted by foreign and domestic law enforcement, etc.). I generally think projects should accept more maintainers; however, your point about asymmetry goes both ways.

n4te 3y ago

In my experience commit rights also decrease the quality of the code. Nearly everyone sucks. I've had to rewrite FOSS to get rid of the ugly. Ideally I could have kept a better eye on the commits but time doesn't always allow.

unshavedyak 3y ago

I'd probably "hoard" rights. Which is to say, any FOSS project that i am invested in, i am going to fight hard to ensure someone does not have the ability to make my life more difficult. I'd love to give out commit rights, but if it's some random good quality PR there's a very large chance that i now have to maintain that code - as well as any future code they merge if given rights. I hand out code rights freely to those who seem similarly invested. As they can then share the burden for each new issue popping up, etc. However writing the code (the PR) is usually not the hard part in a FOSS project. The fortitude to maintain it is. As the weeks, months and years go by - who will be around? "Commit rights" here seem pretty off-topic to me, honestly. This is FOSS. Assuming a permissive license, you can fork it and publish your own freely. It's not an insult to me for you to do that. But yea, if i'm looking for an out - i'll hand them out to anyone interested. If however i'm needing to maintain it for my own purpose, then my time and will are the resources i'm most concerned about. A single PR is not a the only variable in the equation there, imo.

casey2 3y ago
Exactly 0 people are maintainers of projects they don't have commit access to. Even if they dip after 6 month it's far better to have the option to remove any of the 6 months worth of commits in the current codebase than to hypothesis about the state of a future codebase/environment 6 months ago. This becomes even easier with good commit messages. If somebody is a user and decides to write a pull request, they are already invested anything more is virtue signaling, no amount of which will guarantee that they will be there in years, which is an unreasonable stipulation for a project that could be obsolete yesterday.
- danielheath 3y ago
  When they dip 6 months time, you’re maintaining whatever strange crap they let into your project. If they offer to maintain it, I’d sooner point my docs to suggest using their fork instead of my repo. That makes them the maintainer without me offering to support what they do
- em-bee 3y ago
  removing code that is not dead, but because it is bad quality is about the hardest thing to do. because if i had time to clean up the code, i could have done it when the pull request was made. so i prefer to gatekeep and not let in bad code to begin with. if it is an application i depend on, then i need to trust the the code to be good enough. mistakes are ok, i make them too. but giving someone commit rights and then finding out 6 months later that almost everything they committed was not good sounds like a bad idea. i also believe that code should be reviewed by a second person, if possible. so if i have a one-man project and there is a second contributor, i would review their pull-requests and commit them. if they in turn are able and willing to review my commits, i might give them commit rights as long as we both can agree to review each others commits. in that case, the other person will only commit code i have written, and i will commit code they have written. (or however we set up the process. either way i will still have seen all the code going into the project.) but i agree with the article. it really depends on the nature of the project. i do have some projects where i am just messing around, creating something useful, but not critical. having others directly commit to that would probably not be a big problem, even if the code they write is messy, as long as it works, it'll be ok. alternatively, if i do have the time to review code, i can also do that after it has been committed. if it's bad, i can clean it up then. and if there is to much cleanup work happening i can revoke commit rights and i'll only have to remove the most recent commits that i don't have the time to clean up.

cortesoft 3y ago

> there is little risk in assuming good faith until demonstrated otherwise. The risk is that a malicious user fakes good commits, earns commit rights, and then pushes malware that is then installed by unsuspecting downstream users before the code is found and reverted. This can be partially mitigated by making sure they don’t have permission to create a release, but it would still be possible to compromise developers working off the main branch.