Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vouch

github.com

Post reply on HN
Print view View original

211–220 of 507 posts

Re: Vouch

#211

Post by Fnoord »

hermanb wrote: post #152
k8sToGo wrote: post #148

Earlier quoted context omitted.

If you want me to read your comment, please pay me $1 first... if I find your comment interesting I might refund.

I had this idea / pet project once where I did exactly this for email. Emails would immediately bounce with payment link and explanation. If you paid you get credit on a ledger per email address. Only then the mail goes through. You can also integrate it in clients by adding payment/reward claim headers.

Bill Gates already had this idea. All efforts to change email were already documented 25 years ago. The biggest changes are it is more centralized these days, SPF/DKIM/DMARC, JMAP innovation, oh... and one more thing! It is HUGE!! HTML email is the default...

Re: Vouch

#212

Post by mitchellh »

yencabulator wrote: post #207
mitchellh wrote: post #200

Earlier quoted context omitted.

Vouch is forge-agnostic. See the 2nd paragraph in the README: > The implementation is generic and can be used by any project on any code forge, but we provide GitHub integration out of the box via GitHub actions and the CLI. And then see the trust format which allows for a platform tag. There isn't even a default-GitHub approach, just the GitHub actions default to GitHub via `--default-platform` flag (which makes sen…

Define "platform". So I can choose from github, gitlab or maybe codeberg? What about self-hosters, with project-specific forges? What about the fact that I have an account on multiple forges, that are all me? This seems to be overly biased toward centralized services, which means it's just serving to further re-enforce Microsoft's dominance.

It's a text string, platform can be anything you want, then use the vouch CLI (or parse it yourself) to do whatever you want. We don't do identity mapping, because cross-forge projects are rare and maintaining that would centralize the system and its not what we're trying to do. The whole thing is explicitly decentralized with tiny, community specific networks that you build up.

Re: Vouch

#213

Post by pwdisswordfishs »

stavros wrote: post #187
pwdisswordfishs wrote: post #180

Earlier quoted context omitted.

Hatching a reputation-based scheme around a "Contributor Management System" and getting "the people you want as contributors" to go along with it is easier than getting them to fill in a 1/username 2/password 3/confirm-password form? Choosing to believe that is pure motivated reasoning.

People aren't on Github just to implement reputation-based management, though.

What does that observation have to do with the topic under the microscope?

Re: Vouch

#214

Post by Fnoord »

femto113 wrote: post #144

Users already proven to be trustworthy in one project can automatically be assumed trustworthy in another project, and so on. I get the spirit of this project is to increase safety, but if the above social contract actually becomes prevalent this seems like a net loss. It establishes an exploitable path for supply-chain attacks: attacker "proves" themselves trustworthy on any project by behaving in an entirely helpfu…

That is indeed a weakness of Web of Trust.

Thing is, this system isn't supposed to be perfect. It is supposed to be better, while worth the hassle.

I doubt I'll get vouched anywhere (tho IMO it depends on context), but I firmly believe humanity (including me) will benefit from this system. And if you aren't a bad actor with bad intentions, I believe you will, too.

Only side effect is genuine contributors who aren't popular / in the know need to put in a little bit more effort. But again, that is part of worth the hassle. I'll take it for granted.

Re: Vouch

#215

Post by kurtis_reed »

ramon156 wrote: post #186
andai wrote: post #139

It should just be $1 to submit PR. If PR is good, maintainer refunds you ;) I noticed the same thing in communication. Communication is now so frictionless, that almost all the communication I receive is low quality. If it cost more to communicate, the quality would increase. But the value of low quality communication is not zero: it is actively harmful, because it eats your time.

Sorry, but this seems like a privileged solution. Let's say you're a one-of-a-kind kid that already is making useful contributions, but $1 is a lot of money for you, then suddenly your work becomes useless? It feels weird to pay for providing work anyway. Even if its LLM gunk, you're paying to work (let alone pay for your LLM).

You get it refunded

Re: Vouch

#216

Post by mmooss »

otterley wrote: post #176

I'm reminded of the old Usenet responses to people claiming to solve the spam problem, so I can't help myself: Your solution advocates a ( ) technical (X) social ( ) policy-based ( ) forge-based approach to solving AI-generated pull requests to open source projects. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws.) ( ) PR…

> forge-based

?

Re: Vouch

#217

Post by sdenton4 »

ramon156 wrote: post #186
andai wrote: post #139

It should just be $1 to submit PR. If PR is good, maintainer refunds you ;) I noticed the same thing in communication. Communication is now so frictionless, that almost all the communication I receive is low quality. If it cost more to communicate, the quality would increase. But the value of low quality communication is not zero: it is actively harmful, because it eats your time.

Sorry, but this seems like a privileged solution. Let's say you're a one-of-a-kind kid that already is making useful contributions, but $1 is a lot of money for you, then suddenly your work becomes useless? It feels weird to pay for providing work anyway. Even if its LLM gunk, you're paying to work (let alone pay for your LLM).

Not that word, in the context of contributing to an open source project that you're likely already benefiting from.

ie, if you want to contribute code, you must also contribute financially.

Re: Vouch

#218

Post by mmooss »

1a527dd5 wrote: post #76

I think denouncing is an incredibly bad idea especially as the foundation of VOUCH seems to be web of trust. If you get denounced on a popular repo and everyone "inherits" that repo as a source of trust (e.g. think email providers - Google decides you are bad, good luck). Couple with the fact that usually new contributors take some time to find their feet. I've only been at this game (SWE) for ~10 years so not a long…

Denounce also creates liability: you are slandering someone, explicitly harming their reputation and possibly their career.

I'd hesitate to create the denounce function without speaking to an attorney; when someone's reputation and career are torpedoed by the chain reaction you created - with the intent of torpedoing reputations - they may name you in the lawsuit for damages and/or to compel you to undo the 'denounce'.

Not vouching for someone seems safe. No reason to get negative.

Re: Vouch

#219

Post by Fnoord »

ramon156 wrote: post #186
andai wrote: post #139

It should just be $1 to submit PR. If PR is good, maintainer refunds you ;) I noticed the same thing in communication. Communication is now so frictionless, that almost all the communication I receive is low quality. If it cost more to communicate, the quality would increase. But the value of low quality communication is not zero: it is actively harmful, because it eats your time.

Sorry, but this seems like a privileged solution. Let's say you're a one-of-a-kind kid that already is making useful contributions, but $1 is a lot of money for you, then suddenly your work becomes useless? It feels weird to pay for providing work anyway. Even if its LLM gunk, you're paying to work (let alone pay for your LLM).

It is a privileged solution. And a stupid one, too. Because $1 is worth a lot more for someone in India, than someone in USA. If you want to implement this more fairly, you'd be looking at something like GDP or BBP plus geolock. Streaming services perfected this mechanism already.

Re: Vouch

#220

Post by tmp10423288442 »

What's the plan to avoid a Bluesky-like bubble from forming around Vouch projects? Say what you want about wanting to avoid politically disagreeable people, but Bluesky has been shrinking gradually since the 2024 election, as people interested in political effectiveness or even avoiding a hugbox have drifted away. Or think about how new projects are generally not started as GPL anymore (except if they want to charge money by making their open source version AGPL), due to similar viral dynamics discouraging potential contributors.
Post reply on HN