Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vouch

github.com

Post reply on HN
Print view View original

101–110 of 507 posts

Re: Vouch

#101

Post by buckle8017 »

joecool1029 wrote: post #93
ashton314 wrote: post #19

Earlier quoted context omitted.

> Then again, if this is the case, why would you risk your own reputation to vouch for anyone anyway. Good reason to be careful. Maybe there's a bit of an upside to: if you vouch for someone who does good work, then you get a little boost too. It's how personal relationships work anyway. ---------- I'm pretty skeptical of all things cryptocurrency, but I've wondered if something like this would be an actually good us…

> I'm pretty skeptical of all things cryptocurrency, but I've wondered if something like this would be an actually good use case of blockchain tech… So the really funny thing here is the first bitcoin exchange had a Web of Trust system, and while it had it's flaws IT WORKED PRETTY WELL. It used GPG and later on bitcoin signatures. Nobody talks about it unless they were there but the system is still online. Keep in mi…

Biggest issue was always the fiat transfers.

Re: Vouch

#102

Post by Rumple22Stilk »

verdverm wrote: post #88
rvz wrote: post #73

Earlier quoted context omitted.

This makes a lot more sense for large scale and high profile projects, and it eliminates low quality slop PRs by default with the contributors having to earn the trust of the core maintainers to contribute directly to the project.

it also increases the barrier to new adopters why not use ai to help with the ai problem, why prefer this extra coordination effort and implementation?

That's the whole point. There are many new adopters and few competent ones.

Re: Vouch

#103

Post by Rumple22Stilk »

ashton314 wrote: post #16
davidkwast wrote: post #2

I think LLMs are accelerating us toward a Dune-like universe, where humans come before AI.

Got to go through the Butlerian Jihad first… not looking forward to that bit. (EDIT: Thanks sparky_z for the correction of my spelling!)

The alternative is far far worse.

Re: Vouch

#104

Post by zozbot234 »

mjr00 wrote: post #92
zozbot234 wrote: post #81

Earlier quoted context omitted.

I disagree. The problem with AI slop is not so much that it's from AI, but that it's pretty much always completely unreadable and unmaintainable code. So just tell the contributor that their work is not up to standard, and if they persist they will get banned from contributing further. It's their job to refactor the contribution so that it's as easy as possible to review, and if AI is not up to the task this will obv…

You're giving way too much credit to the people spamming these slop PRs. These are not good faith contributions by people trying to help. They are people trying to get pull requests merged for selfish reasons, whether that's a free shirt or something to put on their resume. Even on the first page of closed ghostty PRs I was able to find some prime slop[0]. It is a huge waste of time for a maintainer to nicely tell pe…

If you can immediately tell "this is just AI slop" that's all the review and "attention" you need; you can close the PR and append a boilerplate message that tells the contributor what to do if they want to turn this into a productive contribution. Whether they're "good faith contributors trying to help" or not is immaterial if this is their first interaction. If they don't get the point and spam the repo again then sure, treat them as bad actors.

Re: Vouch

#105

Post by verdverm »

Rumple22Stilk wrote: post #102
verdverm wrote: post #88

Earlier quoted context omitted.

it also increases the barrier to new adopters why not use ai to help with the ai problem, why prefer this extra coordination effort and implementation?

That's the whole point. There are many new adopters and few competent ones.

I mean to well meaning contributors, I understand the goal of vouch, I think it goes too far and you'll turn off said well meaning contributors

I certainly have dropped off when projects have burdensome rules, even before ai slop fest

Re: Vouch

#106

Post by tempaccount420 »

HumanOstrich wrote: post #27
ashton314 wrote: post #19

Earlier quoted context omitted.

> Then again, if this is the case, why would you risk your own reputation to vouch for anyone anyway. Good reason to be careful. Maybe there's a bit of an upside to: if you vouch for someone who does good work, then you get a little boost too. It's how personal relationships work anyway. ---------- I'm pretty skeptical of all things cryptocurrency, but I've wondered if something like this would be an actually good us…

If we want to make it extremely complex, wasteful, and unusable for 99% of people, then sure, put it on the blockchain. Then we can write tooling and agents in Rust with sandboxes created via Nix to have LLMs maintain the web of trust by writing Haskell and OCaml.

Well done, you managed to tie Rust, Nix, Haskell and OCaml to "extremely complex, wasteful, and unusable"

Re: Vouch

#107

Post by zbentley »

skeptic_ai wrote: post #34
stephantul wrote: post #15

IMO: trust-based systems only work if they carry risk. Your own score should be linked to the people you "vouch for" or "denounce". This is similar to real life: if you vouch for someone (in business for example), and they scam them, your own reputation suffers. So vouching carries risk. Similarly, if you going around someone is unreliable, but people find out they actually aren't, your reputation also suffers. If vo…

Think Epstein but in code. Everyone would vouch for him as he’s hyper connected. So he’d get a free pass all the way. Until all blows in our faces and all that vouched for him now gets flagged. The main issue is that can take 10-20 years for it to blow up. Then you have introverts that can be good but have no connections and won’t be able to get in. So you’re kind of selecting for connected and good people.

Fair (and you’re basically describing the xz hack; vouching is done for online identities and not the people behind them).

Even with that risk I think a reputation based WoT is preferable to most alternatives. Put another way: in the current Wild West, there’s no way to identify, or track, or impose opportunity costs on transacting with (committing or using commits by) “Epstein but in code”.

Re: Vouch

#108

Post by 8n4vidtmkvmk »

BowBun wrote: post #96
rafram wrote: post #74

Earlier quoted context omitted.

[flagged]

Why? I don't appreciate comments that cast doubt on decent technical contributors without any substance to back it up. It's a cheap shot from anonymity.

I'm not the parent but if you know you want to merge a PR "within a few seconds" then you're likely to be merging in bad changes.

If you had left it at know you want to reject a PR within a few seconds, that'd be fine.

Although with safety critical systems I'd probably want each contributor to have some experience in the field too.

Re: Vouch

#109

Post by MarkusQ »

HiPhish wrote: post #85
zozbot234 wrote: post #71

Earlier quoted context omitted.

GitHub needs to implement eBay-like feedback for contributors. With not only reputation scores, but explanatory comments like "AAAAAAAAAAAAAA++++++++++++ VERY GOOD CONTRIBUTIONS AND EASY TO WORK WITH. WOULD DEFINITELY MERGE THEIR WORK AGAIN!"

I think merged PRs should be automatically upvoted (if it was bad, why did you merge it?) and closed unmerged PRs should not be able to get upvoted (if it was good, why did you not merge it?).

Intrinsically good, but in conflict with some larger, out of band concern that the contributor could have no way to know about? Upvote to take the sting out of rejection, along with a note along the lines of "Well done, and we would merge is it weren't for our commitment to support xxx systems which are not compatible with yyy. Perhaps refactor as a plugin?"

Also, upvotes and merge decisions may well come from different people, who happen to disagree. This is in fact healthy sometimes.

Re: Vouch

#110

Post by zbentley »

mjr00 wrote: post #68
skeeter2020 wrote: post #59

Doesn't this just shift the same hard problem from code to people? It may seem easier to assess the "quality" of a person, but I think there are all sorts of complex social dynamics at play, plus far more change over time. Leave it to us nerds to try and solve a human problem with a technical solution...

> Leave it to us nerds to try and solve a human problem with a technical solution... Honestly, my view is that this is a technical solution for a cultural problem. Particularly in the last ~10 years, open source has really been pushed into a "corporate dress rehearsal" culture. All communication is expected to be highly professional. Talk to everyone who opens an issue or PR with the respect you would a coworker. Say…

What on earth makes you think that denouncing a bot PR with stronger language would deter it? The bot does not and cannot care.

If that worked, then there would be an epidemic of phone scammers or email phishers having epiphanies and changing careers when their victims reply with (well deserved) angry screeds.

Post reply on HN