6 ms·

'I will take "problems that could be easily be solved by implementing a Pfand system" for $200, Alex.' Seriously. Just ask for a US$10 deposit for the each PR.

'I will take "problems that could be easily be solved by implementing a Pfand system" for $200, Alex.' Seriously. Just ask for a US$10 deposit for the each PR. If the PR is accepted (not even merged, just accepted as "this is a good effort"), give it back. Hell, give double the amount for good effort and you got yourself a cheap way to attract good contributors. Best case, bots will balk at the payment. Worst case, the funds can be used to hire someone specifically for triage.

skrebbel 5mo ago
Easily? You think the kind of people who think it makes sense to make bogus slop PRs are going to react reasonably to overburdened volunteer maintainers refusing to give them their US$10 back?
- rglullis 5mo ago
  Yes. Once a PR is rejected, contact from that bot is blocked. No appeals.
  - rtdq 5mo ago
    The worst case is that someone loses out on $10, no? How does this work if the maintainer is the swindler?
    - smaudet 5mo ago
      I don't think that is a (very realistic) concern. AI is slop, the problem is not that the real contributors are struggling to get PRs merged. The bigger issue being, raising the bar to students who may have otherwise had productive careers (but education is a general issue, where the students don't even yet recognize they are being scammed).
      - rtdq 5mo ago
        I don't follow, and I'd be concerned that this opens up a cottage industry of bots generating plausible looking repositories that unwitting contributors would attempt to contribute to. We already know that bots are astroturfing repos to generate overinflated star counts. I'd say the least crap option here is to honeypot PR contributions from bots
        smaudet 5mo ago
        This feels like bot logic, lol. Unless the contributors don't care about the repos they contribute to, this is not a likely scenario. AI doesn't care. We do.
        rtdq 5mo ago
        What is bot logic exactly? You keep describing this as not a likely or realistic scenario. But why is the likelihood even of relevance here? The way to avoid the worst case i.e scammed of your money, is to not even put it on the table in the first place.
        smaudet 5mo ago
        > What is bot logic exactly? Ill thought out logic like your own. I think you are likely a bot at this point. It's not likely, because that's not something that people are likely to do. Only a bot like yourself with a poor model of the world will do this type of thing. It will be amusing to see the AI bots trying to run the scam you are describing and then nobody will contribute to the fake projects... except other fake AI contributors.
        rtdq 5mo ago
        Dude, you're claiming that there's no likelihood of people getting swindled out of their money by handing it over to strangers. So your reaction is to play the bot card? We're done. You're clearly not arguing in good faith here.
        5mo ago
  - godelski 5mo ago
    So I pay $10 when your bot fucks up? That's called theft. And for what, one banana?
    - rglullis 5mo ago
      Obviously, the triage should be done by a human and not automated.
      - godelski 5mo ago
        Doesn't that put us into the same position? Let's also be realistic, everything that can be automated will. Even if that thing is worse off for it. There's a clear historic pattern of this. Companies and people love to be penny wise and pound foolish.
        rglullis 5mo ago
        > Doesn't that put us into the same position? Of course not, because the number of low-quality PRs with $10 attached to it will be lower than whatever number of PRs are being created now.
        godelski 5mo ago
        You also lose out on a lot of would-be PRs. By people who don't have the money, don't have trust, or have a visceral "fuck you" stance. There's a lot more reasons that this suggestion creates a gate that dissuades the people you want. I stand by that the solution is naïve, but you're welcome to give it a try on your projects. I'm sure it'll be effective at reducing a lot of spammers, but I'm also pretty convinced it'll come with a large false positive rate, which is invisible (giving you false confidence)
        rglullis 5mo ago
        > You also lose out on a lot of would-be PRs. I am more concerned about the sustainability of the projects as a whole than trying to optimize the number of potential random PRs. > you're welcome to give it a try on your projects. It's not exactly the same, but in a way I'm already doing that with Communick. I'm running one of the few Matrix and Fediverse services where members must pay to have access. Up until last week, I was giving 14 days as a free trial period and no deposit/confirmed subcription required. But now because of AI bots, I dropped it and I am collecting payment info before activating any account. If I were playing the startup playbook, that would be insane. It's already crazy to try to charge something that people are used to get for free; my conversion rates are already low, requiring credit card info will make them even lower. In the end of the day, I don't care. At first I was really hoping this would be something profitable, right now I just keep it running because I can. Even with the small number of users Ithe servers get, I get enough to cover the better part of operational costs, I get to sharpen my devops skills and have a test lab to learn what is that people really want (i.e, they are willing to pay to have solved) vs what people claim to be a problem. All in all, the Communick instances are not going to win any popularity contest, but my servers have been up and running without major issues or drama for more than 6 years, and that's a lot more than I can say for all the other servers that have come and gone because the admins tried to play the numbers game.
  - skrebbel 5mo ago
    This is never going to work. Sufficiently many of these people are going to find maintainers' home addresses and send them death threats and the likes. If you see how badly some people flip out just because their PR is rejected, it's going to be much much worse if their PR is rejected and their money is taken.
    - rglullis 5mo ago
      Ok. If I'm the maintainer receiving death threats over that, I'd tell them they would get the $10 dollars back, plus some extra money for their troubles. Location of the envelope with the money: the same police station where I'd reported the death threats.
tourist2d 5mo ago
[dead]
kridsdale1 5mo ago
This is exactly the strategy that the owner of the SomethingAwful forum used in 2004 to get rid of bots and assholes. (I used to remember his name, kinda famous, oh well).
- hoistbypetard 5mo ago
  https://en.wikipedia.org/wiki/Richard_Kyanka https://en.wikipedia.org/wiki/Richard_Kyanka
- fullstop 5mo ago
  Lowtax, I think is what you're looking for.
Barbing 5mo ago
$10 to a Silicon Valley software engineer reading this comment may feel like... $(a lot?)... to a range of other would-be contributors (thinking of $6/day minimum wages in some places, for example) Wonder if a dollar would work for now until more people give bots credit cards.
hoistbypetard 5mo ago
I semi-regularly offer drive-by PRs to projects I like and use. They're real PRs, not generated with AI. They range from papercuts to doc fixes to attempts to add that one feature that I want. Sometimes it's a drive-by group of PRs. Or an issue and a PR. I try to conform to what the maintainers prefer. Unless I knew the maintainers personally, this would prevent most of my contributions, which are most often accepted. Maybe it's worth losing out on my small contributions to avoid slop. But things would absolutely be lost this way.
- smaudet 5mo ago
  Agreed... However there's not a good IsThisAnAI() test at present. So unfortunately, we will have to use anti-spammer techniques (because that is exactly what AI is, high(er) quality spam).
applfanboysbgon 5mo ago
This is an evergreen internet comment right here. Condescendingly proclaiming "This problem could be easily solved by [significantly worse solution that had 1/10th the thought put into it as the actual solution by people with a stake in actually solving the problem rather than making quippy armchair comments]". --- I know it's against convention to comment on downvotes, but really? Really? This is controversial? The OP came up with an elegant solution that cleanly solved their problem without subjecting contributors to anything more than a captcha. Then somebody comes along and says "oh, it's so easy, just charge $10". You're going to set up payment infrastructure, incur administrative overhead with human support managing refunds, and deter 99% of actual humans from contributing, and then call that the easy solution that OP is so stupid for not thinking of first? Give me a fucking break. This site really is just Reddit-lite, anyone who thinks about engineering problems seriously would realise this does not stand up as anything beyond a pithy internet solution with three seconds of thought into what actually implementing it would entail.
- rglullis 5mo ago
  Github already has the payment infrastructure. Polar.sh is already doing things that are a lot more complex in this space. If you are in a civilized country which allow direct payments (i.e, anything but North American nowadays) and you don't want to deal with Github or any external system, there is always good old "make a M-PESA/SEPA/Pix/UPI transfer to account XYZ") > the thought put into it as the actual solution by people with a stake in actually solving the problem Let me flip your argument: think of how much time and thought is poured into problems like this one by people who don't even try to implement a Pfand system beforehand.
  - applfanboysbgon 5mo ago
    > Github already has the payment infrastructure. ...which is not available to maintainers to use in this way. > there is always good old "make a M-PESA/SEPA/Pix/UPI transfer to account XYZ" And then lock out anyone who is not from the same country as the maintainer, on a platform that is known for its global reach. Moreover, you're introducing significant anti-human friction. For privacy-conscious people, it's a complete non-starter; I'm not giving my payment information, not for a $1 transaction, and compromising my anonymity just to make a PR for the benefit of other people. That's a small subset. Then, you have the lazy people. The majority of the population will simply not bother with something if it has friction. Getting out their credit card is one of those things, and it's why products/services that offer free trials or a free tier tend to be overwhelmingly more successful -- people want to see a tangible benefit to themselves before they engage in high-friction processes (where "high-friction" is as little friction as requiring a payment, yes). "Free to play" video games with microtransactions engineer first-time purchases to be cheap ($1 or $5) and have 5x or 10x the value of the normal microtransactions, because that first hurdle of getting somebody to hand over their payment information is by far the biggest. I'll take the captcha, thanks. And maintainers will too, because they'd rather have the solution that filters bots and keeps humans contributing rather than the one that filters out both humans and bots.
godelski 5mo ago
This sounds like a great idea until you think about it for more than 30 seconds. Similar to most "it's so easy, you just" ideas. Seriously, chill, then think about how you'd implement it. Then think how it'd go wrong. Then think about how to fix those problems. Repeat until you realize there's a better solution or until you solve the problem without making it overly convoluted. More often than not the former is the better option. More often the latter is just a variant of the sunk cost fallacy and your ego. Reality is (un)surprisingly complex and solutions aren't usually trivial
- dimgl 5mo ago
  This is an overly negative response to a genuine solution. There are a million reasons you shouldn't do X or Y. More than likely GitHub would have to maintain their own internal wallet solution for this, which is a big engineering lift. But we're all just having a discussion.
  - godelski 5mo ago
    > to a genuine solution Except it isn't. It is a lazy solution and impractical one > More than likely GitHub would have to maintain their own internal wallet solution Great, so you even found one of the main issues, which pushes off the problem to a third party which makes it an impossible solution for anyone but GitHub (still a problematic "solution" though) > This is an overly negative response Yet it isn't because even as you noted it's not realistic to implement. There's two types of lazy, and this is the kind that creates more work, not less
    - dxdm 5mo ago
      > There's two types of lazy, and this is the kind that creates more work, not less Well put. Thanks for taking the time to call this out. Your two comments here are balm for the mental anguish and annoyance I went through reading the so-full-of-misplaced-confidence original comment.
igsomething 5mo ago
Then people from a sanctioned countries are blocked from open source, or worse, you have to explain to the bank and/or the government why you sent 20USD to someone in Venezuela.
- rglullis 5mo ago
  And here we have another specimen of "things which crypto are actually useful" spotted in the wild!
  - LtWorf 5mo ago
    I think the intersection of the set of people able and interested in contributing and those who are willing to figure out cryptocurrencies is the empty set.
    - rglullis 5mo ago
      I quick visit to https://gitcoin.co/campaigns https://gitcoin.co/campaigns will show you that you are wrong. Hundreds of projects funded by even more people. Mind you: that's on one of the most convulated ways there is to get involved, because it involves a bunch of smart contract operations and on-chain voting. If we are talking about crypto only as a payment network, things are even simpler.
      - LtWorf 5mo ago
        It's cheating if the projects using it are cryptocurrency related :) A generic python library used by generic people who have no interest in this field is something else.
        rglullis 5mo ago
        Coinbase reports more than 100+ user accounts worldwide. Kraken has ~10M. Also, we are talking about people who are tech-savvy enough to be interested in participating in a FOSS project. Opening an account at an exchange is not rocket science.
bluGill 5mo ago
Why should I trust you to give me my deposit back?
- rglullis 5mo ago
  Because the cost in reputation is not high enough to justify a large scale scam operation? If you don't trust the maintainer, you can always fork a repo and let them merge on their own.
zarzavat 5mo ago
What? No. A PR is me giving my time to the project. I don't get anything out of it except the warm feeling of having helped out. If I have to pay money to submit a PR then I'm going to play video games instead.
- rglullis 5mo ago
  > A PR is me giving my time to the project Unfortunately, the issue is that time is not enough of a filter anymore. The time from machines is basically worthless compared to yours, so you need to give something else, and that something else needs to be something that shows you have actual skin in the game.
  - Lyrkan 5mo ago
    > so you need to give something else Well no, they don't need to. As they said they could just do something else instead of contributing (and I know I would too). Your proposal would just end up killing those open source projects even more than what you are trying to solve.
    - rglullis 5mo ago
      > Your proposal would just end up killing those open source projects Name 3 open source projects that are dependent on a continuous stream of first-time contributors to keep going.
halapro 5mo ago
Possibly the worst idea I've heard this month. No one, meat or chip, would just set aside $10 "for the opportunity to contribute" This is "let them eat cake" level of out of touchness.
- rglullis 5mo ago
  I have 3 PRs on https://github.com/django-oauth/django-oauth-toolkit/pulls https://github.com/django-oauth/django-oauth-toolkit/pulls that haven't been merged for OVER AN YEAR due to the maintaners being overloaded and who are expected to work on this for free. The fact that these PRs are not being promptly reviewed have cost me at least 3000€ in potential grant work. If I was told that I could make a deposit of $10 to get less stressed maintainers and a faster PR review cycle, I wouldn't even blink. I wouldn't even ask for the money back.
  - nijave 5mo ago
    How did it cost you money in grant work? Can't you just fork and use that?
    - rglullis 5mo ago
      Not exactly. NLNet was funding this to get all these different OAuth RFCs nicely integrated with DOT. A lot of my work was already done on separate packages, putting up just another fork without the blessing of the DOT core team would not be of much use to the overall community.
corps_and_code 5mo ago
Interesting idea, I wonder about using it myself. Let's say I'm a maintainer of an open source project on Github/Gitlab. How would you actually implement this deposit-refund loop in practice?
- rglullis 5mo ago
  I believe you are asking me in jest, but if you are genuine, this is what I would add to my CONTRIBUTING.md ``` # FIrst-time contributors Due to the increased number of AI bots and low-effort contributions, we are being forced to add some friction for first-time contributors. PRs are closed for anyone not explicitly added to our list of authorized users. To be accepted in the list, you must do one of the following: - Show a history of meaningful contributions in projects from related technologies done before Jan 1st, 2023. - Be vouched by one of the existing contributors in the core team - (If you have github sponsors/polar/patreon) Be a sponsor for the project for the last 3 months) - Submit a small payment, which will be held in escrow until your PR is accepted. The following methods are accepted (choose all that apply: paypal, SEPA, Crypto, Venmo, Pix, UPI, M-Pesa, etc) ```
  - corps_and_code 5mo ago
    Oh no, I'm being genuine. Documenting the process itself wasn't what I was curious about, I was wondering how you'd go about your last bullet. Accepting lots of currencies can be hard, but I guess I'm not super familiar with online escrow services. I'm not sure how simple they can make that process, or who would pay the cost of using them (I assume they're not free). I was also wondering how automated or manual you would envision the review process. I'm guessing your hope would be that the small deposit would stem the flow of submissions enough to make it all possible to review manually again, and you would also manually return all the payments sent to escrow?
    - rglullis 5mo ago
      Yes, I'm assuming that adding requirement for payment would bring the number of requests down to a level which I could manage with a simple spreadsheet. Paypal/SEPA transfers are free in Europe. And even if I lived in the US and had to pay a small processor fee, I'd be more than willing to cover the $0.50 in fees if that meant I was receiving contributions from people who went through all the trouble.
backwardsponcho 5mo ago
Yeah, because we'd hate to allow people from poor countries to contribute to FOSS projects, right? Or teenagers without full access to online banking. Or the unemployed.
- rglullis 5mo ago
  Oh, give me a break. No one is taking the ability from others to fork the repo. If these exceptional cases really were to happen, how fast would it be for someone else to notice and do one of (a) notify the maintainers to get this particular user whitelisted or (b) front the entry costs?
  - backwardsponcho 5mo ago
    Sounds like bandaids on top of bandaids, at which point you start to wonder if the idea is fundamentally broken.
    - rglullis 5mo ago
      > Sounds like bandaids on top of bandaids And a registration system that amounts to a more complicated captcha doesn't? How long until someone starts farming accounts and run bots that jump through these hoops as well? > wonder if the idea is fundamentally broken. It's only "fundamentally broken" if you need to build a perfect system that needs to accept 100% of legit PRs without raising any level of friction. But we don't need that. Pfand systems are not meant to be perfect, and they are not meant to the single solution to any problem involving the commons. They will not get rid of all bad behavior, but they will certainly bring it a global-scale problem down to levels that can be then managed by other smaller, context-aware systems.

skrebbel 5mo ago

Easily? You think the kind of people who think it makes sense to make bogus slop PRs are going to react reasonably to overburdened volunteer maintainers refusing to give them their US$10 back?

rglullis 5mo ago
Yes. Once a PR is rejected, contact from that bot is blocked. No appeals.
- rtdq 5mo ago
  The worst case is that someone loses out on $10, no? How does this work if the maintainer is the swindler?
  - smaudet 5mo ago
    I don't think that is a (very realistic) concern. AI is slop, the problem is not that the real contributors are struggling to get PRs merged. The bigger issue being, raising the bar to students who may have otherwise had productive careers (but education is a general issue, where the students don't even yet recognize they are being scammed).
    - rtdq 5mo ago
      I don't follow, and I'd be concerned that this opens up a cottage industry of bots generating plausible looking repositories that unwitting contributors would attempt to contribute to. We already know that bots are astroturfing repos to generate overinflated star counts. I'd say the least crap option here is to honeypot PR contributions from bots
      - smaudet 5mo ago
        This feels like bot logic, lol. Unless the contributors don't care about the repos they contribute to, this is not a likely scenario. AI doesn't care. We do.
        rtdq 5mo ago
        What is bot logic exactly? You keep describing this as not a likely or realistic scenario. But why is the likelihood even of relevance here? The way to avoid the worst case i.e scammed of your money, is to not even put it on the table in the first place.
        smaudet 5mo ago
        > What is bot logic exactly? Ill thought out logic like your own. I think you are likely a bot at this point. It's not likely, because that's not something that people are likely to do. Only a bot like yourself with a poor model of the world will do this type of thing. It will be amusing to see the AI bots trying to run the scam you are describing and then nobody will contribute to the fake projects... except other fake AI contributors.
        rtdq 5mo ago
        Dude, you're claiming that there's no likelihood of people getting swindled out of their money by handing it over to strangers. So your reaction is to play the bot card? We're done. You're clearly not arguing in good faith here.
        5mo ago
- godelski 5mo ago
  So I pay $10 when your bot fucks up? That's called theft. And for what, one banana?
  - rglullis 5mo ago
    Obviously, the triage should be done by a human and not automated.
    - godelski 5mo ago
      Doesn't that put us into the same position? Let's also be realistic, everything that can be automated will. Even if that thing is worse off for it. There's a clear historic pattern of this. Companies and people love to be penny wise and pound foolish.
      - rglullis 5mo ago
        > Doesn't that put us into the same position? Of course not, because the number of low-quality PRs with $10 attached to it will be lower than whatever number of PRs are being created now.
        godelski 5mo ago
        You also lose out on a lot of would-be PRs. By people who don't have the money, don't have trust, or have a visceral "fuck you" stance. There's a lot more reasons that this suggestion creates a gate that dissuades the people you want. I stand by that the solution is naïve, but you're welcome to give it a try on your projects. I'm sure it'll be effective at reducing a lot of spammers, but I'm also pretty convinced it'll come with a large false positive rate, which is invisible (giving you false confidence)
        rglullis 5mo ago
        > You also lose out on a lot of would-be PRs. I am more concerned about the sustainability of the projects as a whole than trying to optimize the number of potential random PRs. > you're welcome to give it a try on your projects. It's not exactly the same, but in a way I'm already doing that with Communick. I'm running one of the few Matrix and Fediverse services where members must pay to have access. Up until last week, I was giving 14 days as a free trial period and no deposit/confirmed subcription required. But now because of AI bots, I dropped it and I am collecting payment info before activating any account. If I were playing the startup playbook, that would be insane. It's already crazy to try to charge something that people are used to get for free; my conversion rates are already low, requiring credit card info will make them even lower. In the end of the day, I don't care. At first I was really hoping this would be something profitable, right now I just keep it running because I can. Even with the small number of users Ithe servers get, I get enough to cover the better part of operational costs, I get to sharpen my devops skills and have a test lab to learn what is that people really want (i.e, they are willing to pay to have solved) vs what people claim to be a problem. All in all, the Communick instances are not going to win any popularity contest, but my servers have been up and running without major issues or drama for more than 6 years, and that's a lot more than I can say for all the other servers that have come and gone because the admins tried to play the numbers game.
- skrebbel 5mo ago
  This is never going to work. Sufficiently many of these people are going to find maintainers' home addresses and send them death threats and the likes. If you see how badly some people flip out just because their PR is rejected, it's going to be much much worse if their PR is rejected and their money is taken.
  - rglullis 5mo ago
    Ok. If I'm the maintainer receiving death threats over that, I'd tell them they would get the $10 dollars back, plus some extra money for their troubles. Location of the envelope with the money: the same police station where I'd reported the death threats.

tourist2d 5mo ago

[dead]

kridsdale1 5mo ago

This is exactly the strategy that the owner of the SomethingAwful forum used in 2004 to get rid of bots and assholes. (I used to remember his name, kinda famous, oh well).

hoistbypetard 5mo ago
https://en.wikipedia.org/wiki/Richard_Kyanka https://en.wikipedia.org/wiki/Richard_Kyanka
fullstop 5mo ago
Lowtax, I think is what you're looking for.

Barbing 5mo ago

$10 to a Silicon Valley software engineer reading this comment may feel like... $(a lot?)... to a range of other would-be contributors (thinking of $6/day minimum wages in some places, for example) Wonder if a dollar would work for now until more people give bots credit cards.

hoistbypetard 5mo ago

I semi-regularly offer drive-by PRs to projects I like and use. They're real PRs, not generated with AI. They range from papercuts to doc fixes to attempts to add that one feature that I want. Sometimes it's a drive-by group of PRs. Or an issue and a PR. I try to conform to what the maintainers prefer. Unless I knew the maintainers personally, this would prevent most of my contributions, which are most often accepted. Maybe it's worth losing out on my small contributions to avoid slop. But things would absolutely be lost this way.

smaudet 5mo ago
Agreed... However there's not a good IsThisAnAI() test at present. So unfortunately, we will have to use anti-spammer techniques (because that is exactly what AI is, high(er) quality spam).

applfanboysbgon 5mo ago

This is an evergreen internet comment right here. Condescendingly proclaiming "This problem could be easily solved by [significantly worse solution that had 1/10th the thought put into it as the actual solution by people with a stake in actually solving the problem rather than making quippy armchair comments]". --- I know it's against convention to comment on downvotes, but really? Really? This is controversial? The OP came up with an elegant solution that cleanly solved their problem without subjecting contributors to anything more than a captcha. Then somebody comes along and says "oh, it's so easy, just charge $10". You're going to set up payment infrastructure, incur administrative overhead with human support managing refunds, and deter 99% of actual humans from contributing, and then call that the easy solution that OP is so stupid for not thinking of first? Give me a fucking break. This site really is just Reddit-lite, anyone who thinks about engineering problems seriously would realise this does not stand up as anything beyond a pithy internet solution with three seconds of thought into what actually implementing it would entail.

rglullis 5mo ago
Github already has the payment infrastructure. Polar.sh is already doing things that are a lot more complex in this space. If you are in a civilized country which allow direct payments (i.e, anything but North American nowadays) and you don't want to deal with Github or any external system, there is always good old "make a M-PESA/SEPA/Pix/UPI transfer to account XYZ") > the thought put into it as the actual solution by people with a stake in actually solving the problem Let me flip your argument: think of how much time and thought is poured into problems like this one by people who don't even try to implement a Pfand system beforehand.
- applfanboysbgon 5mo ago
  > Github already has the payment infrastructure. ...which is not available to maintainers to use in this way. > there is always good old "make a M-PESA/SEPA/Pix/UPI transfer to account XYZ" And then lock out anyone who is not from the same country as the maintainer, on a platform that is known for its global reach. Moreover, you're introducing significant anti-human friction. For privacy-conscious people, it's a complete non-starter; I'm not giving my payment information, not for a $1 transaction, and compromising my anonymity just to make a PR for the benefit of other people. That's a small subset. Then, you have the lazy people. The majority of the population will simply not bother with something if it has friction. Getting out their credit card is one of those things, and it's why products/services that offer free trials or a free tier tend to be overwhelmingly more successful -- people want to see a tangible benefit to themselves before they engage in high-friction processes (where "high-friction" is as little friction as requiring a payment, yes). "Free to play" video games with microtransactions engineer first-time purchases to be cheap ($1 or $5) and have 5x or 10x the value of the normal microtransactions, because that first hurdle of getting somebody to hand over their payment information is by far the biggest. I'll take the captcha, thanks. And maintainers will too, because they'd rather have the solution that filters bots and keeps humans contributing rather than the one that filters out both humans and bots.

godelski 5mo ago

This sounds like a great idea until you think about it for more than 30 seconds. Similar to most "it's so easy, you just" ideas. Seriously, chill, then think about how you'd implement it. Then think how it'd go wrong. Then think about how to fix those problems. Repeat until you realize there's a better solution or until you solve the problem without making it overly convoluted. More often than not the former is the better option. More often the latter is just a variant of the sunk cost fallacy and your ego. Reality is (un)surprisingly complex and solutions aren't usually trivial

dimgl 5mo ago
This is an overly negative response to a genuine solution. There are a million reasons you shouldn't do X or Y. More than likely GitHub would have to maintain their own internal wallet solution for this, which is a big engineering lift. But we're all just having a discussion.
- godelski 5mo ago
  > to a genuine solution Except it isn't. It is a lazy solution and impractical one > More than likely GitHub would have to maintain their own internal wallet solution Great, so you even found one of the main issues, which pushes off the problem to a third party which makes it an impossible solution for anyone but GitHub (still a problematic "solution" though) > This is an overly negative response Yet it isn't because even as you noted it's not realistic to implement. There's two types of lazy, and this is the kind that creates more work, not less
  - dxdm 5mo ago
    > There's two types of lazy, and this is the kind that creates more work, not less Well put. Thanks for taking the time to call this out. Your two comments here are balm for the mental anguish and annoyance I went through reading the so-full-of-misplaced-confidence original comment.

igsomething 5mo ago

Then people from a sanctioned countries are blocked from open source, or worse, you have to explain to the bank and/or the government why you sent 20USD to someone in Venezuela.

rglullis 5mo ago
And here we have another specimen of "things which crypto are actually useful" spotted in the wild!
- LtWorf 5mo ago
  I think the intersection of the set of people able and interested in contributing and those who are willing to figure out cryptocurrencies is the empty set.
  - rglullis 5mo ago
    I quick visit to https://gitcoin.co/campaigns https://gitcoin.co/campaigns will show you that you are wrong. Hundreds of projects funded by even more people. Mind you: that's on one of the most convulated ways there is to get involved, because it involves a bunch of smart contract operations and on-chain voting. If we are talking about crypto only as a payment network, things are even simpler.
    - LtWorf 5mo ago
      It's cheating if the projects using it are cryptocurrency related :) A generic python library used by generic people who have no interest in this field is something else.
      - rglullis 5mo ago
        Coinbase reports more than 100+ user accounts worldwide. Kraken has ~10M. Also, we are talking about people who are tech-savvy enough to be interested in participating in a FOSS project. Opening an account at an exchange is not rocket science.

bluGill 5mo ago

Why should I trust you to give me my deposit back?

rglullis 5mo ago
Because the cost in reputation is not high enough to justify a large scale scam operation? If you don't trust the maintainer, you can always fork a repo and let them merge on their own.

zarzavat 5mo ago

What? No. A PR is me giving my time to the project. I don't get anything out of it except the warm feeling of having helped out. If I have to pay money to submit a PR then I'm going to play video games instead.

rglullis 5mo ago
> A PR is me giving my time to the project Unfortunately, the issue is that time is not enough of a filter anymore. The time from machines is basically worthless compared to yours, so you need to give something else, and that something else needs to be something that shows you have actual skin in the game.
- Lyrkan 5mo ago
  > so you need to give something else Well no, they don't need to. As they said they could just do something else instead of contributing (and I know I would too). Your proposal would just end up killing those open source projects even more than what you are trying to solve.
  - rglullis 5mo ago
    > Your proposal would just end up killing those open source projects Name 3 open source projects that are dependent on a continuous stream of first-time contributors to keep going.

halapro 5mo ago

Possibly the worst idea I've heard this month. No one, meat or chip, would just set aside $10 "for the opportunity to contribute" This is "let them eat cake" level of out of touchness.

rglullis 5mo ago
I have 3 PRs on https://github.com/django-oauth/django-oauth-toolkit/pulls https://github.com/django-oauth/django-oauth-toolkit/pulls that haven't been merged for OVER AN YEAR due to the maintaners being overloaded and who are expected to work on this for free. The fact that these PRs are not being promptly reviewed have cost me at least 3000€ in potential grant work. If I was told that I could make a deposit of $10 to get less stressed maintainers and a faster PR review cycle, I wouldn't even blink. I wouldn't even ask for the money back.
- nijave 5mo ago
  How did it cost you money in grant work? Can't you just fork and use that?
  - rglullis 5mo ago
    Not exactly. NLNet was funding this to get all these different OAuth RFCs nicely integrated with DOT. A lot of my work was already done on separate packages, putting up just another fork without the blessing of the DOT core team would not be of much use to the overall community.

corps_and_code 5mo ago

Interesting idea, I wonder about using it myself. Let's say I'm a maintainer of an open source project on Github/Gitlab. How would you actually implement this deposit-refund loop in practice?

rglullis 5mo ago
I believe you are asking me in jest, but if you are genuine, this is what I would add to my CONTRIBUTING.md ``` # FIrst-time contributors Due to the increased number of AI bots and low-effort contributions, we are being forced to add some friction for first-time contributors. PRs are closed for anyone not explicitly added to our list of authorized users. To be accepted in the list, you must do one of the following: - Show a history of meaningful contributions in projects from related technologies done before Jan 1st, 2023. - Be vouched by one of the existing contributors in the core team - (If you have github sponsors/polar/patreon) Be a sponsor for the project for the last 3 months) - Submit a small payment, which will be held in escrow until your PR is accepted. The following methods are accepted (choose all that apply: paypal, SEPA, Crypto, Venmo, Pix, UPI, M-Pesa, etc) ```
- corps_and_code 5mo ago
  Oh no, I'm being genuine. Documenting the process itself wasn't what I was curious about, I was wondering how you'd go about your last bullet. Accepting lots of currencies can be hard, but I guess I'm not super familiar with online escrow services. I'm not sure how simple they can make that process, or who would pay the cost of using them (I assume they're not free). I was also wondering how automated or manual you would envision the review process. I'm guessing your hope would be that the small deposit would stem the flow of submissions enough to make it all possible to review manually again, and you would also manually return all the payments sent to escrow?
  - rglullis 5mo ago
    Yes, I'm assuming that adding requirement for payment would bring the number of requests down to a level which I could manage with a simple spreadsheet. Paypal/SEPA transfers are free in Europe. And even if I lived in the US and had to pay a small processor fee, I'd be more than willing to cover the $0.50 in fees if that meant I was receiving contributions from people who went through all the trouble.

backwardsponcho 5mo ago

Yeah, because we'd hate to allow people from poor countries to contribute to FOSS projects, right? Or teenagers without full access to online banking. Or the unemployed.

rglullis 5mo ago
Oh, give me a break. No one is taking the ability from others to fork the repo. If these exceptional cases really were to happen, how fast would it be for someone else to notice and do one of (a) notify the maintainers to get this particular user whitelisted or (b) front the entry costs?
- backwardsponcho 5mo ago
  Sounds like bandaids on top of bandaids, at which point you start to wonder if the idea is fundamentally broken.
  - rglullis 5mo ago
    > Sounds like bandaids on top of bandaids And a registration system that amounts to a more complicated captcha doesn't? How long until someone starts farming accounts and run bots that jump through these hoops as well? > wonder if the idea is fundamentally broken. It's only "fundamentally broken" if you need to build a perfect system that needs to accept 100% of legit PRs without raising any level of friction. But we don't need that. Pfand systems are not meant to be perfect, and they are not meant to the single solution to any problem involving the commons. They will not get rid of all bad behavior, but they will certainly bring it a global-scale problem down to levels that can be then managed by other smaller, context-aware systems.