Who trusts people who still use X?
Exactly. Poor judgement on the author’s part.
Vouch
321–330 of 507 posts
Re: Vouch
#322I'm sick of the fact that every techno-nerd (including me) can create a new level of abstraction, the integrity of which will be proven with foam at the mouth by other people.
Re: Vouch
#323The underlying idea is admirable, but in practice this could create a market for high-reputation accounts that people buy or trade at a premium. Once an account is already vouched, it will likely face far less scrutiny on future contributions — which could actually make it easier for bad actors to slip in malware or low-quality patches under the guise of trust.
Amazing idea - absolutely loving vouch. However, as a security person, this comment immediately caught my attention. A few things come to mind (it's late here, so apologies in advance if they're trivial and not thought through): - Threat Actors compromising an account and use it to Vouch for another account. I have a "hunch" it could fly under the radar, though admittedly I can't see how it would be different from an…
The idea is sound, and we definitely need something to address the surge in low-effort PRs, especially in the post-LLM era.
Regarding your points:
"Threat Actors compromising an account..." You're spot on. A vouch-based system inevitably puts a huge target on high-reputation accounts. They become high-value assets for account takeovers.
"Threat actors creating fake chains of trust..." This is already prevalent in the crypto landscape... we saw similar dynamics play out recently with OpenClaw. If there is a metric for trust, it will be gamed.
From my experience, you cannot successfully layer a centralized reputation system over a decentralized (open contribution) ecosystem. The reputation mechanism itself needs to be decentralized, evolving, and heuristics-based rather than static.
I actually proposed a similar heuristic approach (on a smaller scale) for the expressjs repo a few months back when they were the first to get hit by mass low-quality PRs: https://gist.github.com/freakynit/c351872e4e8f2d73e3f21c4678... (sorry, couldn;t link to original comment due to some github UI issue.. was not showing me the link)
Re: Vouch
#324Earlier quoted context omitted.
Scammers (and spammers) always got $1! That's why there's a lot of the scam ads on google, fb, apple. So the paywall email firewall will not work as desired.
Not many email attacks are worth an entire dollar. It would be very very effective at reducing spam. And too effective at reducing everything else.
Emails to CEOs they do worth.
Re: Vouch
#325This is an excellent step in the direction of a web-of-trust that the present moment demands, facing an increasingly mistrustful web in the face of LLMs.
Major congratulations to the creator, you're doing god's work. And even if this particular project struggles or outright fails, I hope that it provides valuable insight for any follow-up web-of-trust projects on how to establish trust online.
Re: Vouch
#326The underlying idea is admirable, but in practice this could create a market for high-reputation accounts that people buy or trade at a premium. Once an account is already vouched, it will likely face far less scrutiny on future contributions — which could actually make it easier for bad actors to slip in malware or low-quality patches under the guise of trust.
How is that different from what happens now, where someone who contributes regularly to a project faces less scrutiny than a new person?
The difference is that today this trust is local and organic to a specific project. A centralized reputation system shared across many repos turns that into delegated trust... meaning, maintainers start relying on an external signal instead of their own review/intuition. That's a meaningful shift, and it risks reducing scrutiny overall.
Re: Vouch
#327Earlier quoted context omitted.
Not many email attacks are worth an entire dollar. It would be very very effective at reducing spam. And too effective at reducing everything else.
Emails to CEOs they do worth.
So only CEOs will get spam, and it's effective for 99.9% of people? I would not describe that as "will not work as desired".
Re: Vouch
#328Ah, we have converted a technical problem into a social problem. Historically those are vastly easier to solve, right? Spam filters exist. Why do we need to bring politics into it? Reminds me of the whole CoC mess a few years back. Every time somebody talks about a new AI thing the lament here goes: > BUT THINK OF THE JUNIORS! How do you expect this system to treat juniors? How do your juniors ever gain experience co…
> Ah, we have converted a technical problem into a social problem. Surely you mean this the other way around? Mitchell is trying to address a social problem with a technical solution.
Nope, I meant what I originally said.
The problem is technical: too many low-quality PRs hitting an endpoint. Vouch's solution is social: maintain trust graphs of humans.
But the PRs are increasingly from autonomous agents. Agents don't have reputations. They don't care about denounce lists. They make new accounts.
We solved unwanted automated input for email with technical tools (spam filters, DKIM, rate limiting), not by maintaining curated lists of Trusted Emailers. That's the correct solution category. Vouch is a social answer to a traffic-filtering problem.
This may solve a real problem today, but it's being built as permanent infrastructure, and permanent social gatekeeping outlasts the conditions that justified it.
Re: Vouch
#329Earlier quoted context omitted.
How is that different from what happens now, where someone who contributes regularly to a project faces less scrutiny than a new person?
The difference is that today this trust is local and organic to a specific project. A centralized reputation system shared across many repos turns that into delegated trust... meaning, maintainers start relying on an external signal instead of their own review/intuition. That's a meaningful shift, and it risks reducing scrutiny overall.
This isn't a centralised reputation system, though, is it? Each project keeps its own whitelist.
Re: Vouch
#330It should just be $1 to submit PR. If PR is good, maintainer refunds you ;) I noticed the same thing in communication. Communication is now so frictionless, that almost all the communication I receive is low quality. If it cost more to communicate, the quality would increase. But the value of low quality communication is not zero: it is actively harmful, because it eats your time.
This thought pattern leads to crypto. In that world there's a process called "staking" where you lock some tokens with a default lock expiry action and a method to unlock based on the signature from both participants. It would work like this: Repo has a public key. Submitted uses a smart contract to sign the commit with along with the submission of a crypto. If the repo merges it then the smart contract returns the t…
No. Just because you can use crypto for something doesn’t mean you should. In fact you almost never should.