4 ms·

GitHub "community" is just awful. There are people trying to get real work done in that thread, but then there are all these random bystanders piling up to thro

by zokier 2y ago

GitHub "community" is just awful. There are people trying to get real work done in that thread, but then there are all these random bystanders piling up to throw in their comments which range from useless to actively harmful and distracting. And it's not an isolated case, this happens pretty much always when some issues attracts attention on GH. Can't we respect the project and give the people there space to work, and leave the peanut gallery commenting to reddit/hn/twitter/whatev.

Cthulhu_ 2y ago
GH needs a system like most forum communities have where comments can be put in a moderation / approval queue before being public.
- keepamovin 2y ago
  Not a bad idea. I guess the UX is not hard, but likely it would clash with GH's bias towards openness/transparency/public record. Possibly risk making moderation 1st class citizen, they may fear this would detract from the main purpose of collaborative code production. Yet...it could help that. But I understand it's a tricky nuance. So, they have comment minimization by assigned moderators. Or you can just delete / edit comments and issues. Obviously not as powerful as a pre-screening queue. Less work tho!
  - Bluestein 2y ago
    They'd end up like SO ...
ivanjermakov 2y ago
This is why a lot of projects use other tools for bug tracking and merging, e.g. bugzilla, youtrack, atlassian etc.
- AshamedCaptain 2y ago
  The opposite. Whenever some project migrates to an inferior alternative like Github or Discord they always claim a number of arguments which boil down to "it's where people go these days" (e.g. less friction for newcomers, most people have an account there already, larger community, whatever excuse you can come up). So I say they are getting exactly what they wanted to get.
  - ivanjermakov 2y ago
    > less friction for newcomers This is exactly the problem. If you want your resort be vandalized, build a nice road to it. And some orgs are even eager to fuel this with things like Hacktoberfest.
- mistrial9 2y ago
  Apache Foundation maintains a lengthy list of capable projects ... shout out to TRAC first
nindalf 2y ago
I like the comment that started with "way too many arm chair 'researchers' in this thread" and then goes on to rudely say that the maintainers are doing a bad job because they merged in the original changes by Jia Tan. What are you sitting on, if not an arm chair? We all agree that the xz attack was of unparalleled sophistication and complexity, spread carefully over years, funded by a State. Many people were taken in so how is it helpful to pile on Jia Tan's primary victims?
- prmoustache 2y ago
  The question is still very relevant. Why are PR like this merged to begin with?
  - joh6nn 2y ago
    The malicious commit was designed to be confusing, as noted in the first comment of the investigation: > but calls to safe_fprintf were replaced with calls to the unsafe fprintf. The diff doesn't make this obvious due to the removal of a newline in a parameter list. It wasn't noticed because it was specifically designed not to be obvious.
  - pas 2y ago
    because there are hundreds of thousands of programmers who don't have the need for "better" and are willing to put up with C and shell scripts, and "small incremental changes"
- freedomben 2y ago
  I thought that was a good question, and certainly one I'd like to know the answer too, but I very much agree it was done rudely. It didn't seem like it was asked in good faith. Anyone who has maintained large/complex software like this knows that name recognition is worth a ton, and it kind of has to be that way. It's just not practical at all to scrutinize every commit/change as though the committer is an adversary, and particularly when you know the person it is not a reasonable ask. I would bet the truth is basically "yes, we knew him so it didn't get full scrutiny," and honestly that's an honest (but hard to give) answer. I do hope (perhaps naively) that this (security code reviews) is something AI can get really good at in the future, because that would be a real value add IMHO.
madeofpalk 2y ago
Absolute worst is when you see the "Hi from HN :wave:" comments when Github issues/PRs linked to from here. Maintainers can 'lock down' the issue to just projects members, but that's very much an after-the-fact thing.
assbuttbuttass 2y ago
People treat Github like social media
- posed 2y ago
  It is a social medium by definition, tbf.
- Bluestein 2y ago
  This.- PS. And, for some people it might undoubtedly be *all* their "social" ...
- turtle_heck 2y ago
  That's because it kinda is a social network. You can "follow" people after all.
- ahepp 2y ago
  It seems like GitHub encourages that? I mean, emoji reacts to issue comments? Not really sure what the point of that is besides "driving engagement". I guess the argument for it is that it lets people easily "get involved"? Seems like there's some merit to making it easy for users to leave feedback. Maybe thumbs-up or thumbs-down on an issue really is valuable feedback in some situations. I'm torn between saying the social features are bad because they lower the barrier for low quality engagement, and saying that even low quality engagement can lead to valuable insights.
- zokier 2y ago
  Github is social media
- omoikane 2y ago
  Github launched with the tag line "social code hosting" in 2008: https://web.archive.org/web/20081216011059/https://github.com/ https://web.archive.org/web/20081216011059/https://github.co... Which changed to "social coding" later: https://web.archive.org/web/20110217073759/https://github.com/ https://web.archive.org/web/20110217073759/https://github.co... "social coding" eventually moved to the page title, and disappeared from the page itself: https://web.archive.org/web/20120202143623/https://github.com/ https://web.archive.org/web/20120202143623/https://github.co... "Social code hosting" and "social coding" are not on the front page anymore, but they definitely kept all the social features.
ahoka 2y ago
Because it's September, 1993.
keepamovin 2y ago
Liberal use of the GH moderations tools, like block user, and interaction limits, is your friend.

by zokier 2y ago

Cthulhu_ 2y ago

GH needs a system like most forum communities have where comments can be put in a moderation / approval queue before being public.

keepamovin 2y ago
Not a bad idea. I guess the UX is not hard, but likely it would clash with GH's bias towards openness/transparency/public record. Possibly risk making moderation 1st class citizen, they may fear this would detract from the main purpose of collaborative code production. Yet...it could help that. But I understand it's a tricky nuance. So, they have comment minimization by assigned moderators. Or you can just delete / edit comments and issues. Obviously not as powerful as a pre-screening queue. Less work tho!
- Bluestein 2y ago
  They'd end up like SO ...

ivanjermakov 2y ago

This is why a lot of projects use other tools for bug tracking and merging, e.g. bugzilla, youtrack, atlassian etc.

AshamedCaptain 2y ago
The opposite. Whenever some project migrates to an inferior alternative like Github or Discord they always claim a number of arguments which boil down to "it's where people go these days" (e.g. less friction for newcomers, most people have an account there already, larger community, whatever excuse you can come up). So I say they are getting exactly what they wanted to get.
- ivanjermakov 2y ago
  > less friction for newcomers This is exactly the problem. If you want your resort be vandalized, build a nice road to it. And some orgs are even eager to fuel this with things like Hacktoberfest.
mistrial9 2y ago
Apache Foundation maintains a lengthy list of capable projects ... shout out to TRAC first

nindalf 2y ago

I like the comment that started with "way too many arm chair 'researchers' in this thread" and then goes on to rudely say that the maintainers are doing a bad job because they merged in the original changes by Jia Tan. What are you sitting on, if not an arm chair? We all agree that the xz attack was of unparalleled sophistication and complexity, spread carefully over years, funded by a State. Many people were taken in so how is it helpful to pile on Jia Tan's primary victims?

prmoustache 2y ago
The question is still very relevant. Why are PR like this merged to begin with?
- joh6nn 2y ago
  The malicious commit was designed to be confusing, as noted in the first comment of the investigation: > but calls to safe_fprintf were replaced with calls to the unsafe fprintf. The diff doesn't make this obvious due to the removal of a newline in a parameter list. It wasn't noticed because it was specifically designed not to be obvious.
- pas 2y ago
  because there are hundreds of thousands of programmers who don't have the need for "better" and are willing to put up with C and shell scripts, and "small incremental changes"
freedomben 2y ago
I thought that was a good question, and certainly one I'd like to know the answer too, but I very much agree it was done rudely. It didn't seem like it was asked in good faith. Anyone who has maintained large/complex software like this knows that name recognition is worth a ton, and it kind of has to be that way. It's just not practical at all to scrutinize every commit/change as though the committer is an adversary, and particularly when you know the person it is not a reasonable ask. I would bet the truth is basically "yes, we knew him so it didn't get full scrutiny," and honestly that's an honest (but hard to give) answer. I do hope (perhaps naively) that this (security code reviews) is something AI can get really good at in the future, because that would be a real value add IMHO.

madeofpalk 2y ago

Absolute worst is when you see the "Hi from HN :wave:" comments when Github issues/PRs linked to from here. Maintainers can 'lock down' the issue to just projects members, but that's very much an after-the-fact thing.

assbuttbuttass 2y ago

People treat Github like social media

posed 2y ago
It is a social medium by definition, tbf.
Bluestein 2y ago
This.- PS. And, for some people it might undoubtedly be *all* their "social" ...
turtle_heck 2y ago
That's because it kinda is a social network. You can "follow" people after all.
ahepp 2y ago
It seems like GitHub encourages that? I mean, emoji reacts to issue comments? Not really sure what the point of that is besides "driving engagement". I guess the argument for it is that it lets people easily "get involved"? Seems like there's some merit to making it easy for users to leave feedback. Maybe thumbs-up or thumbs-down on an issue really is valuable feedback in some situations. I'm torn between saying the social features are bad because they lower the barrier for low quality engagement, and saying that even low quality engagement can lead to valuable insights.
zokier 2y ago
Github is social media
omoikane 2y ago
Github launched with the tag line "social code hosting" in 2008: https://web.archive.org/web/20081216011059/https://github.com/ https://web.archive.org/web/20081216011059/https://github.co... Which changed to "social coding" later: https://web.archive.org/web/20110217073759/https://github.com/ https://web.archive.org/web/20110217073759/https://github.co... "social coding" eventually moved to the page title, and disappeared from the page itself: https://web.archive.org/web/20120202143623/https://github.com/ https://web.archive.org/web/20120202143623/https://github.co... "Social code hosting" and "social coding" are not on the front page anymore, but they definitely kept all the social features.

ahoka 2y ago

Because it's September, 1993.

keepamovin 2y ago

Liberal use of the GH moderations tools, like block user, and interaction limits, is your friend.