141–150 of 154 posts
Earlier quoted context omitted.
Is having a publicly reachable email address consent to receiving unsolicited emails? Is having a public postal address consent to receiving mailed advertisements? Legally, yeah; morally, less so.
Technically they are forms of abuse, a PR for a valid bug less so.
Earlier quoted context omitted.
> Actually, now that I think of it, it’s better comparable to someone bringing in a handheld scanner with a company name on it, scanning the artwork and then pointing out the tear. No, it's more like somebody sending to your lab, uninvited, an impersonal inspection bot with another company's branding on it, which doesn't only disclose potential issues to you but advertises them across the whole cyberspace. And in cas…
> No, it's more like somebody sending to your lab, uninvited, an impersonal inspection bot with another company's branding on it, which doesn't only disclose potential issues to you but advertises them across the whole cyberspace. GitHub isn't your lab. It's Microsoft's lab. (They just rent out space free of charge.)
My point is, we should cherish the culture that enables progress and learning by routinely opening works of passion to free use and contribution. We could cherish it by employing a sense of ethics and adherence to certain protocols of behavior, these don't need to be spelled out but those of us who know better can lead by example. Putting OSS maintainers under undue stress has come under fire before, and this looks like one of those cases.
Earlier quoted context omitted.
klyrs was right about the reply from me (a dev behdind Code Review Doctor) being dismissive in the issue. I apologise for that. FWIW my reaction was classic "expectations not meeting reality": weeks of work to do (what I thought) was a mutually beneficial helpful thing. I was naively not expecting non-positive responses and was ill prepared when you raised valid concerns I had not considered. Again, I am working on t…
No good deed goes unpunished.
Earlier quoted context omitted.
Automated checking of potential bugs in f-strings is hard. There are lots of false positives. You can see some discussion around this kind of rule in pylint [0]. At the end of the day, the choice to run automated linting tools on a repo is up to the maintainers. Autogenerating PRs like this is incredibly noisy and comes off to me as a blatant advertisement for their "code review doctor" product. [0] https://github.co…
> Autogenerating PRs like this The article specifically mentions that they were not auto-generated, "It was also interesting to see the reaction from open source developers to unsolicited pull requests from what looks like a bot (really a bot found the problem and made the PR, but really a human developer at Code Review Doctor did triage the issue before the PR was raised)"
Earlier quoted context omitted.
Automated checking of potential bugs in f-strings is hard. There are lots of false positives. You can see some discussion around this kind of rule in pylint [0]. At the end of the day, the choice to run automated linting tools on a repo is up to the maintainers. Autogenerating PRs like this is incredibly noisy and comes off to me as a blatant advertisement for their "code review doctor" product. [0] https://github.co…
> Autogenerating PRs like this The article specifically mentions that they were not auto-generated, "It was also interesting to see the reaction from open source developers to unsolicited pull requests from what looks like a bot (really a bot found the problem and made the PR, but really a human developer at Code Review Doctor did triage the issue before the PR was raised)"
Earlier quoted context omitted.
Ask yourself: would you treat a PR differently if it came from a regular, trusted contributor, or some random person (or bot)?
Sure you would probably treat it differently but isn't it being elitist and harmful to the open source community in general to outright shoot down or discourage any PR from a lesser known or unknown source if it is a good PR? I think we should encourage novices to contribute and we shouldn't be hostile to them so that they can get past the novice phase and become trusted contributors. If a bot produces valid helpful…
Maybe catenation of an fString and a string should yield an fString by type promotion? String is morally "any" so it feels to me like a contextual narrowing of type.
What if you wanted to append a string with braces, could you? (I don’t know Python!) Plus it would lead to subtle security vulns and other bugs. A contrived example : f”{bot} spammed my repo saying” + “touch(‘{path}’) was wrong lol.” Now my path var has been disclosed.
Ex:
n = "hn"
print(f"hello {n} your path is {{path}}")
Out: hello hn your path is {path}
Earlier quoted context omitted.
> I feel the same way about those bots that tell you about insignificant security vulnerabilities in some project you abandoned. It's basically spam. If you "archive" your repos, dependabot and friends won’t bother you. Or, you could just disable security alerts in your repo's settings.
Dependabot isn’t the only source of vulnerability fatigue, there are plenty of “researchers” who would spam your active projects about pointless “vulnerabilities”. For instance, I recently got one about a parsing issue in gmp from a human user, who probably found it by scanning PyPI. I’m not touching anything adjacent to the supposedly vulnerable codepath, and the fix isn’t even in a gmp release, meaning I would have…
Earlier quoted context omitted.
> Only if you establish your lab in a tent on the street and put a sign that says "for public display" on it. I don't get how your flawed analogy has evolved now. Care to expound? Edit: I see your edit, thanks. Yes, if we leave garage doors open we still don't welcome these bots, sorry.
But that is not up to you to decide in the case of OSS. Public websites get crawled and indexed hundreds of times per day and sometimes linked to even with criticism. Would you not say this is the same concept?
Earlier quoted context omitted.
Black doesn't split strings, and I doubt they'd choose to use concatenation if they did.
Black does split strings if configured and it does use implicit concatenation of Python string literals.