Live data from Hacker News

I gave commit rights to someone I didn't know

jakewins.com

91–100 of 106 posts

Re: I gave commit rights to someone I didn't know

#91
post #67

Earlier quoted context omitted.

What do you think the risk is? That some sociopath gains access to the perl6 repo and replaces all the code with a shellscript that "sudo rm -rf /"'s? Sure, that's possible, but good contributors will vastly outnumber bad contributors, and such a person's commit access would be revoked instantly. There's still code review for everything, and such a change would not go unnoticed. Just look at Wikipedia. That's the equ…

> That some sociopath gains access to the perl6 repo and replaces all the code with a shellscript that "sudo rm -rf /"'s? No, that some sociopath gains access to the perl6 repo and introduces subtle, plausibly deniable backdoors. I have looked at Wikipedia. I saw that obvious vandalism, like inserting "HAHA PENIS" in the middle of an article about — I don't know — US presidential candidates, is detected quickly; some…

The thing that your post misses and that most people who criticize Wikipedia miss, is that all stuff written everywhere could be wrong or malicious.

Any book, any blog, anything could be wrong by accident or on purpose. Wikipedia is open enough we can investigate it and readily determine who the malicious or incorrect actors are. Which is far more than any book from antiquity, most blogs and even much professional journalism provides.

Should we trust wikipedia implicitly? Of course not.

Should we trust any single source simplicity? Of course not.

Re: I gave commit rights to someone I didn't know

#94

Let me tell you the story of how I got involved in the Perl 6 community. I was trying to find out how Perl 6 was progressing, and found a broken link on a related website (pugscode.org, now defunct). So I went into the #perl6 IRC channel to report it. Within three minutes, Audrey Tang (to become minister without portfolio in Taiwan in October) had committed a fix, somehow found an email address of mine, and sent me a…

Similar here: At Nextcloud we are also radically inclusive and have never seen a case of vandalism.

Granted, there were few occurences of accidental pushes to master here and there. But that’s where git itself helps and also the recent addition of protected branches on Github is very useful. :)

If the community is open and these artificial barriers to entry are removed, then people are way more likely to get involved.

Re: I gave commit rights to someone I didn't know

#98
post #91

Earlier quoted context omitted.

> That some sociopath gains access to the perl6 repo and replaces all the code with a shellscript that "sudo rm -rf /"'s? No, that some sociopath gains access to the perl6 repo and introduces subtle, plausibly deniable backdoors. I have looked at Wikipedia. I saw that obvious vandalism, like inserting "HAHA PENIS" in the middle of an article about — I don't know — US presidential candidates, is detected quickly; some…

The thing that your post misses and that most people who criticize Wikipedia miss, is that all stuff written everywhere could be wrong or malicious. Any book, any blog, anything could be wrong by accident or on purpose. Wikipedia is open enough we can investigate it and readily determine who the malicious or incorrect actors are. Which is far more than any book from antiquity, most blogs and even much professional jo…

When you view any page's history, all you get is a list of pseudonyms and IP addresses. Sure, you can probably get the country of origin and sometimes maybe even the employer from the latter, but that's basically it. I don't think that's very much, given that nobody on Wikipedia is required to disclose who they are in real life (there's even a policy specifically against posting such information about others[1]). Well, okay, in theory users with a financial conflict of interest in a topic are required to disclose it, but in practice PR agencies can often get away doing anything to articles about their clients.

And openness in itself doesn't guarantee reliability anyway. OpenSSL being open-source didn't prevent Heartbleed from happening. The so-called "Linus's law" is often a mere vacuous truth; there's rarely enough eyeballs to make even the most obvious bugs shallow. And eyeballs themselves don't help if they keep looking in the wrong places.

The problem with Wikipedia isn't merely that it may be sometimes inaccurate. It is that its sources of inaccuracies are much more numerous, most rather predictable, and yet next to nothing is done to address that. A book written by a single author may also be inaccurate; but I'd be more inclined to believe a book written by someone 0) whose good reputation is at stake and who therefore has an disincentive to actively misinform (sometimes at least), and 1) who has an editor above them watching out for inconsistencies; rather than a bunch of pseudonyms and numbers that can immediately publish anything they think up with basically no oversight. Trustworthiness is a spectrum, and Wikipedia does significantly worse on it than many other sources. Review processes on Wikipedia are overworked and even those focus mostly on style rather than substance. There are some relatively sensible policies enacted, but they are quite vague (and therefore bendable to ever-changing whims of particular users) and selectively enforced. And don't get me started with the dispute resolution processes...

There is no systematic, consistently applied process to ensure Wikipedia's accuracy. It is addressed just like the gun problem is in the US; it proceeds from one outrageous incident to another[2], with everyone barely applying ad-hoc measures after the fact, while the people who do have the power to make a real difference are either in complete denial that this is a problem at all or are too attached to the idea that the foundational laws can never ever be wrong to actually enact meaningful reforms.

[1] https://en.wikipedia.org/wiki/Wikipedia:OUTING

[2] https://en.wikipedia.org/wiki/Wikipedia:List_of_Wikipedia_ho...

Re: I gave commit rights to someone I didn't know

#99
I've been involved in the Plone community for a number of years. All you need to do to get commit rights is to sign the copyright assignment and ask. We currently have 400 people with rights, I suspect we lost a few when we migrated from self-hosted SVN to GitHub.

In over ten years of this policy, we've only had one committer act in bad faith.

Post reply on HN