Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vouch

github.com

Post reply on HN
Print view View original

131–140 of 507 posts

Re: Vouch

#131

Post by mjr00 »

zbentley wrote: post #110
mjr00 wrote: post #68

Earlier quoted context omitted.

> Leave it to us nerds to try and solve a human problem with a technical solution... Honestly, my view is that this is a technical solution for a cultural problem. Particularly in the last ~10 years, open source has really been pushed into a "corporate dress rehearsal" culture. All communication is expected to be highly professional. Talk to everyone who opens an issue or PR with the respect you would a coworker. Say…

What on earth makes you think that denouncing a bot PR with stronger language would deter it? The bot does not and cannot care. If that worked, then there would be an epidemic of phone scammers or email phishers having epiphanies and changing careers when their victims reply with (well deserved) angry screeds.

I didn't mean the "fuck off" part to be quite verbatim... this ghostty PR[0] is a good example of how this stuff should be handled. Notably: there's no attempt to review or provide feedback--it's instantly recognized as a slop PR--and it's an instant ban from repo.

This is the level of response these PRs deserve. What people shouldn't be doing is treating these as good-faith requests and trying to provide feedback or asking them to refactor, like they're mentoring a junior dev. It'll just fall on deaf ears.

[0] https://github.com/ghostty-org/ghostty/pull/10588

Re: Vouch

#132

Post by dzink »

skeptic_ai wrote: post #34
stephantul wrote: post #15

IMO: trust-based systems only work if they carry risk. Your own score should be linked to the people you "vouch for" or "denounce". This is similar to real life: if you vouch for someone (in business for example), and they scam them, your own reputation suffers. So vouching carries risk. Similarly, if you going around someone is unreliable, but people find out they actually aren't, your reputation also suffers. If vo…

Think Epstein but in code. Everyone would vouch for him as he’s hyper connected. So he’d get a free pass all the way. Until all blows in our faces and all that vouched for him now gets flagged. The main issue is that can take 10-20 years for it to blow up. Then you have introverts that can be good but have no connections and won’t be able to get in. So you’re kind of selecting for connected and good people.

Excellent point. Currently HN accounts get much higher scores if they contribute content, than if they make valuable comments. Those should be two separate scores. Instead, accounts with really good advice have lower scores than accounts that have just automated re-posting of content from elsewhere to HN.

Re: Vouch

#133

Post by pphysch »

skeptic_ai wrote: post #34
stephantul wrote: post #15

IMO: trust-based systems only work if they carry risk. Your own score should be linked to the people you "vouch for" or "denounce". This is similar to real life: if you vouch for someone (in business for example), and they scam them, your own reputation suffers. So vouching carries risk. Similarly, if you going around someone is unreliable, but people find out they actually aren't, your reputation also suffers. If vo…

Think Epstein but in code. Everyone would vouch for him as he’s hyper connected. So he’d get a free pass all the way. Until all blows in our faces and all that vouched for him now gets flagged. The main issue is that can take 10-20 years for it to blow up. Then you have introverts that can be good but have no connections and won’t be able to get in. So you’re kind of selecting for connected and good people.

But the blowback is still there. The Epstein saga has and will continue to fragment and discipline the elite. Most people probably do genuinely regret associating with him. Noam Chomsky's credibility and legacy is permanently marred, for example.

Re: Vouch

#134

Post by buovjaga »

Halan wrote: post #86

How does a potential positive contributor pierce through? If they are not contributing to something already and are not in the network with other contributors? They might be a SME on the subject and legit have something to bring to the table but only operated on private source. I get that AI is creating a ton of toil to maintainers but this is not the solution.

One solution is to have a screensharing call with the contributor and have them explain their patch. We have already caught a couple of scammers who were applying for a FOSS internship this way. If they have not yet submitted anything non-trivial, they could showcase personal projects in the same way.

FOSS has turned into an exercise in scammer hunting.

Re: Vouch

#136

Post by zozbot234 »

mjr00 wrote: post #131
zbentley wrote: post #110

Earlier quoted context omitted.

What on earth makes you think that denouncing a bot PR with stronger language would deter it? The bot does not and cannot care. If that worked, then there would be an epidemic of phone scammers or email phishers having epiphanies and changing careers when their victims reply with (well deserved) angry screeds.

I didn't mean the "fuck off" part to be quite verbatim... this ghostty PR[0] is a good example of how this stuff should be handled. Notably: there's no attempt to review or provide feedback--it's instantly recognized as a slop PR--and it's an instant ban from repo. This is the level of response these PRs deserve. What people shouldn't be doing is treating these as good-faith requests and trying to provide feedback or…

Sure, but that pull request is blatantly unreviewable because of how it bundles dozens of entirely unrelated commits together. Just say that and move on: it only takes a one-line comment and it informs potential contributors about what to avoid if any of them is lurking the repo.

Re: Vouch

#138

Post by eightnoteight »

moogly wrote: post #39

So you're screwed if you don't have any connections. In that way it's just like meat space.

exactly this, verification should always been on the code

if someone fresh wants to contribute, now they will have to network before they can write code

honestly i don't see my self networking just so that i can push my code

I think there are valid ways to increase the outcome, like open source projects codifying the focus areas during each month, or verifying the PRs, or making PRs show proof of working etc,... many ways to deter folks who don't want to meaningfully contribute and simply ai generate and push the effort down the real contributors

Re: Vouch

#139

Post by andai »

It should just be $1 to submit PR.

If PR is good, maintainer refunds you ;)

I noticed the same thing in communication. Communication is now so frictionless, that almost all the communication I receive is low quality. If it cost more to communicate, the quality would increase.

But the value of low quality communication is not zero: it is actively harmful, because it eats your time.

Re: Vouch

#140

Post by jen20 »

DJBunnies wrote: post #114
mjr00 wrote: post #51

Earlier quoted context omitted.

> Indeed, it's relatively impossible without ties to real world identity. I don't think that's true? The goal of vouch isn't to say "@linus_torvalds is Linus Torvalds" it's to say "@linus_torvalds is a legitimate contributor an not an AI slopper/spammer". It's not vouching for their real world identity, or that they're a good person, or that they'll never add malware to their repositories. It's just vouching for the…

That’s not the point. Point is: when @lt100, @lt101, … , @lt999 all vouch for something, it’s worthless.

But surely then a maintainer notices what has happened, and resolves the problem?
Post reply on HN