Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vouch

github.com

Post reply on HN
Print view View original

331–340 of 507 posts

Re: Vouch

#331

Post by october8140 »

freakynit wrote: post #326
stavros wrote: post #290

Earlier quoted context omitted.

How is that different from what happens now, where someone who contributes regularly to a project faces less scrutiny than a new person?

The difference is that today this trust is local and organic to a specific project. A centralized reputation system shared across many repos turns that into delegated trust... meaning, maintainers start relying on an external signal instead of their own review/intuition. That's a meaningful shift, and it risks reducing scrutiny overall.

I don't think the intent is for trust to be delegated to infinity. It can just be shared easily. I could imagine a web of trust being shared between projects directly working together.

Re: Vouch

#332

Post by anon-3988 »

freakynit wrote: post #326
stavros wrote: post #290

Earlier quoted context omitted.

How is that different from what happens now, where someone who contributes regularly to a project faces less scrutiny than a new person?

The difference is that today this trust is local and organic to a specific project. A centralized reputation system shared across many repos turns that into delegated trust... meaning, maintainers start relying on an external signal instead of their own review/intuition. That's a meaningful shift, and it risks reducing scrutiny overall.

I am still not going to merge random code from a supposed trusted invdividual. As it is now, everyone is supposedly trusted enough to be able to contribute code. This vouching system will make me want to spend more time, not less, when contributing.

Re: Vouch

#333

Post by anon-3988 »

Goofy_Coyote wrote: post #314
freakynit wrote: post #284

The underlying idea is admirable, but in practice this could create a market for high-reputation accounts that people buy or trade at a premium. Once an account is already vouched, it will likely face far less scrutiny on future contributions — which could actually make it easier for bad actors to slip in malware or low-quality patches under the guise of trust.

Amazing idea - absolutely loving vouch. However, as a security person, this comment immediately caught my attention. A few things come to mind (it's late here, so apologies in advance if they're trivial and not thought through): - Threat Actors compromising an account and use it to Vouch for another account. I have a "hunch" it could fly under the radar, though admittedly I can't see how it would be different from an…

This is a strange comment because, this is literally the world that we live in now? We just assume that everyone is vouched by someone (perhaps Github/Gitlab). Adding this layer of vouching will basically cull all of that very cheap and meaningless vouches. Now you have to work to earn the trust. And if you lose that trust, you actually lose something.

Re: Vouch

#334

Post by freakynit »

anon-3988 wrote: post #332
freakynit wrote: post #326

Earlier quoted context omitted.

The difference is that today this trust is local and organic to a specific project. A centralized reputation system shared across many repos turns that into delegated trust... meaning, maintainers start relying on an external signal instead of their own review/intuition. That's a meaningful shift, and it risks reducing scrutiny overall.

I am still not going to merge random code from a supposed trusted invdividual. As it is now, everyone is supposedly trusted enough to be able to contribute code. This vouching system will make me want to spend more time, not less, when contributing.

Trust signals change behavior at scale, even if individuals believe they're immune.

You personally might stay careful, but the whole point of vouching systems is to reduce review effort in aggregate. If they don't change behavior, they add complexity without benefi.. and if they do, that's exactly where supply-chain risk comes from.

Re: Vouch

#335

Post by freakynit »

october8140 wrote: post #331
freakynit wrote: post #326

Earlier quoted context omitted.

The difference is that today this trust is local and organic to a specific project. A centralized reputation system shared across many repos turns that into delegated trust... meaning, maintainers start relying on an external signal instead of their own review/intuition. That's a meaningful shift, and it risks reducing scrutiny overall.

I don't think the intent is for trust to be delegated to infinity. It can just be shared easily. I could imagine a web of trust being shared between projects directly working together.

That could happen.. but then it would end up becoming a development model similar to the one followed by sqlite and ffmpeg ... i.e., open for read, but closed(almost?) for writes to external contributions.

I don't know whether that's good or bad for the overall open-source ecosystem.

Re: Vouch

#336

Post by freakynit »

stavros wrote: post #329
freakynit wrote: post #326

Earlier quoted context omitted.

The difference is that today this trust is local and organic to a specific project. A centralized reputation system shared across many repos turns that into delegated trust... meaning, maintainers start relying on an external signal instead of their own review/intuition. That's a meaningful shift, and it risks reducing scrutiny overall.

This isn't a centralised reputation system, though, is it? Each project keeps its own whitelist.

Thats's true.

Re: Vouch

#338

Post by ashton314 »

refulgentis wrote: post #149
ashton314 wrote: post #19

Earlier quoted context omitted.

> Then again, if this is the case, why would you risk your own reputation to vouch for anyone anyway. Good reason to be careful. Maybe there's a bit of an upside to: if you vouch for someone who does good work, then you get a little boost too. It's how personal relationships work anyway. ---------- I'm pretty skeptical of all things cryptocurrency, but I've wondered if something like this would be an actually good us…

I'm unconvinced, to my possibly-undercaffeinated mind, the string of 3 posts reads like this: - a problem already solved in TFA (you vouching for someone eventually denounced doesn't prevent you from being denounced, you can totally do it) - a per-repo, or worse, global, blockchain to solve incrementing and decrementing integers (vouch vs. denounce) - a lack of understanding that automated global scoring systems are…

Those are good arguments against. I want to make it clear that I think it’s a possibly interesting idea, but also probably a bad one too! :)

Re: Vouch

#339

Post by AnthonyMouse »

nl wrote: post #297
rifty wrote: post #256

Earlier quoted context omitted.

It feels like the problem here comes from the reluctance to utilize a negative sum outcome for rejection. Instead of introducing accidental perverse incentives, if rejected your stake shouldn't go to the repo, 50% could be returned, and 50% deleted. If it times out or gets approved you get 100% back. If a repo rejects too often or is seen doing so unfairly reputation would balance participation.

No, the perverse incentive is that there will be RepoCoin, and the people involved will be incentivized to make the price of that as high as possible.

> No, the perverse incentive is that there will be RepoCoin, and the people involved will be incentivized to make the price of that as high as possible.

Isn't this problem unrelated to cryptocurrency?

There will be the US dollar, and the people involved will be incentivized to keep its value high, e.g. by pressuring or invading other countries to prevent them from switching to other currencies. Or they'll be incentivized to adopt policies that cause consumer and government debt to become unreasonably excessive to create a large enough pool of debts denominated in that currency that they can create an inordinate amount of it without crashing its value.

Or on the other side of the coin, there will be countries with currencies they knowingly devalue, either because they can force the people in that country to accept them anyway or because devaluing their currency makes their exports more competitive and simultaneously allows them to spend the currency they printed.

If anything cryptocurrency could hypothetically be better at reducing these perverse incentives, because if good rules are chosen at the outset and get ossified into the protocol then it's harder for bad actors to corrupt something that requires broad consensus to change.

Re: Vouch

#340

Post by tayo42 »

sbr464 wrote: post #307

Unfortunately, the mob mentality, and gate keeping from the Reddit mod era, proves that these types of systems simply don’t work.

i think you can go earlier then that. reminds me kind of rep systems on message boards. which got abused.
Post reply on HN