Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vouch

github.com

Post reply on HN
Print view View original

451–460 of 507 posts

Re: Vouch

#451

Post by geodel »

eightnoteight wrote: post #138
moogly wrote: post #39

So you're screwed if you don't have any connections. In that way it's just like meat space.

exactly this, verification should always been on the code if someone fresh wants to contribute, now they will have to network before they can write code honestly i don't see my self networking just so that i can push my code I think there are valid ways to increase the outcome, like open source projects codifying the focus areas during each month, or verifying the PRs, or making PRs show proof of working etc,... many…

> honestly i don't see my self networking just so that i can push my code

But that's good outcome. You would rather spend time on projects where you agree with the project policies.

Re: Vouch

#452

Post by cortesoft »

miki123211 wrote: post #381
nl wrote: post #223

Earlier quoted context omitted.

This thought pattern leads to crypto. In that world there's a process called "staking" where you lock some tokens with a default lock expiry action and a method to unlock based on the signature from both participants. It would work like this: Repo has a public key. Submitted uses a smart contract to sign the commit with along with the submission of a crypto. If the repo merges it then the smart contract returns the t…

The "money goes to the repo part" is the problem here, as it incentivizes maintainers to refuse legitimate pull requests. Crypto has a perfect way to burn money, just send it to a nonexistent address from where it can never be recovered. I guess the trad fi equivalent are charitable donations. The real problem here is the amount of work necessary to make this viable. I bet Visa and Mastercard would look at you funny…

> I bet Visa and Mastercard would look at you funny if your business had such a high rate of voluntary transaction reversals

Plenty of businesses do the “your credit card will be charged $1 and then reversed” as a verification method that I don’t think it would be a major issue. I do wonder how much those companies are paying for that, though… I am guessing they lose some of that $1.

Re: Vouch

#453

Post by wongarsu »

account42 wrote: post #425
chairmansteve wrote: post #423

Earlier quoted context omitted.

"It's made me realize that the love of money corrupts". Yep. How about $1 per PR. The submitter gets to choose from a list of charities. No refund if the PR is accepted. The goal is to get rid of junk PR's. This would work. There could be a central payment system, which any open source project can integrate with. It could accept payment in say India, of the Indian PPP of $1, so you aren't shutting out poorer develope…

I would not pay any amount of money, even a trivial one, for the privilege of being able to do free work for a project - and I don't think I'm an outlier here.

Most of my PRs are drive-by PRs: I have an problem, maybe a bug or missing feature, that annoyed me enough to fix it. And because I want to use future versions without the work of maintaining a fork I instead invest the work to upstream the fix. A step that is sometimes more work than the fix itself. At that point I wouldn't mind paying $1 to get that PR looked at and merged.

But that is not the only type of PR. We clearly need escape hatches for people who engage with a project on a deeper level.

Re: Vouch

#454

Post by bootsmann »

theredbeard wrote: post #411

OSS was already brutal for new contributors before AI. You'd spend hours on a good-faith PR and get ignored for months, or get torn apart in review because you didn't know the unwritten conventions. The signal-to-noise ratio sucked but at least maintainers would eventually look at your stuff. Now with AI-generated spam everywhere, maintainers have even more reason to be suspicious of unknown names. Vouch solves their…

Maybe it is because I mostly contribute to projects that have corporate backers but this has not been my experience at all. Usually opening an issue with “I would be willing to fix this” gets good and quick responses from maintainers. Maybe linux kernel devs are different but I doubt many of us have to interact with that as part of our day-to-day business.

Re: Vouch

#455

Post by KawaiiCyborg »

anonymousab wrote: post #434
account42 wrote: post #425

Earlier quoted context omitted.

I would not pay any amount of money, even a trivial one, for the privilege of being able to do free work for a project - and I don't think I'm an outlier here.

Another way to think of it is: paying $1 to have your pr and concerns elevated above the supermajority sea (that which will be ai driven contributions). For that cost, it's a steal of the deal. Then, from the perspective of "it's a donation to a project you care about" it becomes even more rational. But the project itself getting the money has all the problems others have outlined already, so that idea's a bit bust.

> "it's a donation to a project you care about"

But I'm already donating my time by creating a PR, it definitely would disincentivize me to make PRs if I had to also pay in addition to already doing the actual work. Just always such a shame that the good people have to suffer because of the actions of the shitty people...

Re: Vouch

#456

Post by OkayPhysicist »

theredbeard wrote: post #411

OSS was already brutal for new contributors before AI. You'd spend hours on a good-faith PR and get ignored for months, or get torn apart in review because you didn't know the unwritten conventions. The signal-to-noise ratio sucked but at least maintainers would eventually look at your stuff. Now with AI-generated spam everywhere, maintainers have even more reason to be suspicious of unknown names. Vouch solves their…

Good filters make good communities. Back in the good ol' days of the internet, access to the internet in of itself was a decent filter: you had to want to be online, you needed to be somewhat technical, or at least willing to grapple with technical problems, and you needed to actively seek out communities online which aligned with your interests, and there was little financial motivation to do so in bad faith. As the barrier to entry to the internet writ large dropped to near zero, communities that were built around the bygone era's natural filtering suffered. Communities must now establish filters proactively.

Ultimately, you need to choose: does your community prioritize its short-term health, or ease of access? If a community never lets anyone in, then it withers and dies eventually, but in the meantime the community can be extremely high-trust. That's what happened to fraternal orders like the Oddfellows and the Free Masons post-Vietnam. If the community has zero barrier to entry, you end up with Twitter: a teeming mass of low-trust members screaming into the void.

The happy medium is allowing in new members just as fast as you can build trust and community cohesion. University clubs are a good example of this: at a massive turnover rate of 25% per year, they need to form processes to not just recruit that many people, but integrate that big of a chunk of their community without destroying the high-trust environment. That's how you end up with the ritualized "rushing" process.

Re: Vouch

#457

Post by OkayPhysicist »

ashton314 wrote: post #19
stephantul wrote: post #15

IMO: trust-based systems only work if they carry risk. Your own score should be linked to the people you "vouch for" or "denounce". This is similar to real life: if you vouch for someone (in business for example), and they scam them, your own reputation suffers. So vouching carries risk. Similarly, if you going around someone is unreliable, but people find out they actually aren't, your reputation also suffers. If vo…

> Then again, if this is the case, why would you risk your own reputation to vouch for anyone anyway. Good reason to be careful. Maybe there's a bit of an upside to: if you vouch for someone who does good work, then you get a little boost too. It's how personal relationships work anyway. ---------- I'm pretty skeptical of all things cryptocurrency, but I've wondered if something like this would be an actually good us…

A 100% useful heuristic for "is blockchain useful here" is to understand that blockchains can be completely replaced, at much lower cost, with a database hosted by a trusted party.

If there is literally anyone that can be (or at least must be) trusted by all potential users of a system, then it's better to just use a database controlled by that person/entity. That's why blockchain-based solutions never pan out when it comes to interacting with the real world: In real life, there is a ton of trust required to do anything.

Re: Vouch

#458

Post by mring33621 »

KawaiiCyborg wrote: post #455
anonymousab wrote: post #434

Earlier quoted context omitted.

Another way to think of it is: paying $1 to have your pr and concerns elevated above the supermajority sea (that which will be ai driven contributions). For that cost, it's a steal of the deal. Then, from the perspective of "it's a donation to a project you care about" it becomes even more rational. But the project itself getting the money has all the problems others have outlined already, so that idea's a bit bust.

> "it's a donation to a project you care about" But I'm already donating my time by creating a PR, it definitely would disincentivize me to make PRs if I had to also pay in addition to already doing the actual work. Just always such a shame that the good people have to suffer because of the actions of the shitty people...

Nope. From the POV of the maintainer, you are creating extra, and probably unnecessary, work for them.

Re: Vouch

#459

Post by Dylan16807 »

SJC_Hacker wrote: post #433
nobody9999 wrote: post #408

Earlier quoted context omitted.

>First you have to make it low-friction. If I want Joe Average to send me $1 in cryptocurrency, how is he getting $1 in cryptocurrency to send me? Absolutely. You're 1000% correct. Cryptocurrency is way too high friction for stuff like that. When I wish to spend crypto, I need to: [If you don't have an exchange account already, you'll need the 0.x steps too!] 0.0 Create an account on an exchange which is legally allo…

All the setup is no worse than setting up a bank account And technically it can be avoided through back channels if you know someone who already has it - can just pay them cash or whatever and they can send crypto to you Crypto is very easy to transfer once you have a wallet Its the exchange to/from real world currency where the friction is.

> All the setup is no worse than setting up a bank account

Which is a huge pain in the butt. If someone invented a new lower-spam email ecosystem that required everyone to make a new bank account, very few people would join.

I would say something about a combined account but many countries have already figured out free bank transfers without needing crypto so maybe do that?

Re: Vouch

#460

Post by OkayPhysicist »

Goofy_Coyote wrote: post #314
freakynit wrote: post #284

The underlying idea is admirable, but in practice this could create a market for high-reputation accounts that people buy or trade at a premium. Once an account is already vouched, it will likely face far less scrutiny on future contributions — which could actually make it easier for bad actors to slip in malware or low-quality patches under the guise of trust.

Amazing idea - absolutely loving vouch. However, as a security person, this comment immediately caught my attention. A few things come to mind (it's late here, so apologies in advance if they're trivial and not thought through): - Threat Actors compromising an account and use it to Vouch for another account. I have a "hunch" it could fly under the radar, though admittedly I can't see how it would be different from an…

I belong to a community that uses a chain of trust like this with regards to inviting new people. The process for avoiding the bad actor chain problem is pretty trivial: If someone catches a ban, everyone downstream of them loses access pending review, and everyone upstream of them loses invite permissions, pending review. Typically, some or most of the downstream people end up quickly getting vouched for by existing members of the community, and it tends to be pretty easy to find who messed up with a poorly-vetted invite (most often, it was the person who got banned's inviter). Person with poor judgement loses their invite permissions for a bit, everyone upstream from them gets their invite permissions back.
Post reply on HN