3 ms·
The difference is that today this trust is local and organic to a specific project. A centralized reputation system shared across many repos turns that into del
by freakynit 9mo ago
The difference is that today this trust is local and organic to a specific project. A centralized reputation system shared across many repos turns that into delegated trust... meaning, maintainers start relying on an external signal instead of their own review/intuition. That's a meaningful shift, and it risks reducing scrutiny overall.
- stavros 9mo agoThis isn't a centralised reputation system, though, is it? Each project keeps its own whitelist.
- freakynit 9mo agoThats's true.
- october8140 9mo agoI don't think the intent is for trust to be delegated to infinity. It can just be shared easily. I could imagine a web of trust being shared between projects directly working together.
- freakynit 9mo agoThat could happen.. but then it would end up becoming a development model similar to the one followed by sqlite and ffmpeg ... i.e., open for read, but closed(almost?) for writes to external contributions. I don't know whether that's good or bad for the overall open-source ecosystem.
- anon-3988 9mo agoI am still not going to merge random code from a supposed trusted invdividual. As it is now, everyone is supposedly trusted enough to be able to contribute code. This vouching system will make me want to spend more time, not less, when contributing.
- freakynit 9mo agoTrust signals change behavior at scale, even if individuals believe they're immune. You personally might stay careful, but the whole point of vouching systems is to reduce review effort in aggregate. If they don't change behavior, they add complexity without benefi.. and if they do, that's exactly where supply-chain risk comes from.
- bccdee 9mo agoI think something people are missing here is, this is a response to the groundswell in vibecoded slop PRs. The point of the vouch system is not to blindly merge code from trusted individuals; it's to completely ignore code from untrusted individuals, permitting you to spend more time reviewing the MRs which remain.
- aragilar 9mo agoWould it not be better to report accounts then?
- bccdee 8mo agoTo whom? It's not against Github's ToS to submit a bad PR. Anyway, bad actors can just create new accounts. It makes more sense to circulate whitelists of people who are known not to be bad actors. I also like the flexibility of a system like this. You don't have to completely refuse contributions from people who aren't whitelisted, but since the general admission queue is much longer and full of slop, it makes sense to give known good actors a shortcut to being given your attention.
- aragilar 8mo agoSufficiently bad PRs/comments/etc. are against the GitHub Terms of Service, look under section C (Acceptable Use), which links to https://docs.github.com/en/site-policy/acceptable-use-policies/github-acceptable-use-policies https://docs.github.com/en/site-policy/acceptable-use-polici..., which then includes https://docs.github.com/en/site-policy/acceptable-use-policies/github-disrupting-the-experience-of-other-users https://docs.github.com/en/site-policy/acceptable-use-polici..., on which you'll find multiple actions would describe posting AI slop (or things ancillary to it). I wouldn't do this where it's not clear there was an issue, but for something like the really poor OCaml PR that was floating around, reporting the user to me seems like a logical step to reduce the flood.