Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vouch

github.com

Post reply on HN
Print view View original

191–200 of 507 posts

Re: Vouch

#191

Post by yencabulator »

a-dub wrote: post #172

this highlights the saddest thing about this whole generative ai thing. beforehand, there was opportunity to learn, deliver and prove oneself outside of classical social organization. now that's all going to go away and everyone is going to fall back on credentials and social standing. what an incredible shame for social mobility and those who for one reason or another don't fit in with traditional structures.

.. all revolving around a proprietary Microsoft service.

Support Microsoft or be socially shunned?

Re: Vouch

#192

Post by _puk »

andai wrote: post #139

It should just be $1 to submit PR. If PR is good, maintainer refunds you ;) I noticed the same thing in communication. Communication is now so frictionless, that almost all the communication I receive is low quality. If it cost more to communicate, the quality would increase. But the value of low quality communication is not zero: it is actively harmful, because it eats your time.

It's externalisation of cost.

We've seen it everywhere, in communication, in globalised manufacturing, now in code generation.

It takes nothing to throw something out there now; we're at a scale that there's no longer even a cost to personal reputation - everyone does it.

Re: Vouch

#194

Post by theshrike79 »

femto113 wrote: post #144

Users already proven to be trustworthy in one project can automatically be assumed trustworthy in another project, and so on. I get the spirit of this project is to increase safety, but if the above social contract actually becomes prevalent this seems like a net loss. It establishes an exploitable path for supply-chain attacks: attacker "proves" themselves trustworthy on any project by behaving in an entirely helpfu…

And then they become distrusted and BOOM trust goes away from every project that subscribed to the same source.

Think of this like a spam filter, not a "I met this person live and we signed each other's PGP keys" -level of trust.

It's not there to prevent long-con supply chain attacks by state level actors, it's there to keep Mr Slopinator 9000 from creating thousands of overly verbose useless pull requests on projects.

Re: Vouch

#195

Post by tristan957 »

mehdibl wrote: post #125

Why in nushell? Not in go? But I like the idea and principle. OSS need this and it's traded very lightly.

Mitchell has really enjoyed Nu essentially. If it is implemented in a shell script, it probably also means that general shell tooling can work with the format.

Re: Vouch

#196

Post by lelandbatey »

Halan wrote: post #86

How does a potential positive contributor pierce through? If they are not contributing to something already and are not in the network with other contributors? They might be a SME on the subject and legit have something to bring to the table but only operated on private source. I get that AI is creating a ton of toil to maintainers but this is not the solution.

It seems like it depends on how the authors have configured Vouch. They might completely close the project except to those on the vouch list (other than viewing the repo, which seems always implied).

Alternatively they might keep some things open (issues, discussions) while requiring a vouch for PRs. Then, if folks want to get vouched, they can ask for that in discussions. Or maybe you need to ask via email. Or contact maintainers via Discord. It could be anything. Linux isn't developed on GitHub, so how do you submit changes there? Well you do so by following the norms and channels which the project makes visible. Same with Vouch.

Re: Vouch

#197

Post by brikym »

It seems like dating apps to me. You have a large population of highly motivated undesirables to filter out. I think we'll see the same patterns: pay to play, location filtering, identity verification, social credit score (ELO etc).

I even see people hopping on chat servers begging to 'contribute' just to get github clout. It's really annoying.

Re: Vouch

#198

Post by theshrike79 »

8n4vidtmkvmk wrote: post #108
BowBun wrote: post #96

Earlier quoted context omitted.

Why? I don't appreciate comments that cast doubt on decent technical contributors without any substance to back it up. It's a cheap shot from anonymity.

I'm not the parent but if you know you want to merge a PR "within a few seconds" then you're likely to be merging in bad changes. If you had left it at know you want to reject a PR within a few seconds, that'd be fine. Although with safety critical systems I'd probably want each contributor to have some experience in the field too.

"*WANT* to close or *WANT* to merge". Not WILL close or WILL merge.

You look at the PR and you know just by looking at it for a few seconds if it looks off or not.

Looks off -> "Want to close"

Write a polite response and close the issue.

Doesn't look off -> "Want to merge"

If we want to merge it, then of course you look at it more closely. Or label it and move on with the triage.

Re: Vouch

#199

Post by yencabulator »

mijoharas wrote: post #171

Oh and one other thing I was curious about. Did Mitchell comment on why he wrote it in nushell? I've not really messed around with that myself yet. Would people recommend it? I feel like I have such huge inertia for changing shells at this point that I've rarely seriously considered it.

Nushell has great sugar coating but mishandles basics like it will eat errors and get into impossible code paths on control-C. I have given up on it.

Re: Vouch

#200

Post by mitchellh »

yencabulator wrote: post #191
a-dub wrote: post #172

this highlights the saddest thing about this whole generative ai thing. beforehand, there was opportunity to learn, deliver and prove oneself outside of classical social organization. now that's all going to go away and everyone is going to fall back on credentials and social standing. what an incredible shame for social mobility and those who for one reason or another don't fit in with traditional structures.

.. all revolving around a proprietary Microsoft service. Support Microsoft or be socially shunned?

Vouch is forge-agnostic. See the 2nd paragraph in the README:

> The implementation is generic and can be used by any project on any code forge, but we provide GitHub integration out of the box via GitHub actions and the CLI.

And then see the trust format which allows for a platform tag. There isn't even a default-GitHub approach, just the GitHub actions default to GitHub via `--default-platform` flag (which makes sense cause they're being invoked ON GITHUB).

Post reply on HN