Maybe we should cut out the middle-man and make it easy for people to donate token credits to open-source projects, and let the maintainers decide how to use them.
Maybe we should cut out the middle man and make it easy for people to donate money to open-source projects, and let the maintainers decide whether to use them on tokens or hosting or developer salaries or something else.
PR spam today looks like email spam in the early 2000s
91–100 of 167 posts
Re: PR spam today looks like email spam in the early 2000s
#92I see one big difference: with email it was always about sender reputation based on email servers (IPs), maybe about domains. But never about individual users. It's the organizations running the email server, who make sure users behave. So they don't get blacklisted and lose sending privileges for hundreds or thousands of users. For PRs/issues this is not applicable.
Not necessarily. Orgs exist in GitHub, and it seems reasonable that if the $BIGCORP org limits membership to employees, you can automatically trust all members of that org. Because this way, if one steps out of line, you have both an escalation path (contact admins) and a stick (revoke trust in entire org).
Re: PR spam today looks like email spam in the early 2000s
#93GitHub just recently added configurable PR limits for maintainers to help partially address this problem: https://github.blog/open-source/maintainers/how-pull-request...
I would not be at all surprised if Github adds a first party reputation system. It would be a clever way to increase network effects - imagine if you host on Codeberg you're inundated by AI PRs but on Github you can easily filter them out. I can't see those pull request limits working very well. It's like trying to filter email spam by just rate limiting people. It's going to be annoying for the people you actually w…
If we want to keep it objective, one metric can already be calculated based on the user history of the submitter. The spammers profile will be full of unmerged or abandoned prs. Just based on those statistics beginners might be close to zero rating but spammers would be negative.
Unless I totally missed that people are also making new accounts of each PR.
Re: PR spam today looks like email spam in the early 2000s
#94GitHub just recently added configurable PR limits for maintainers to help partially address this problem: https://github.blog/open-source/maintainers/how-pull-request...
> Draft pull requests will not count towards your limit. Disappointing, it seems that those also need limits too, although the limit could be higher. I could easily see the limit for PRs be at 1 for untrusted contributors, and drafts at 3-5.
I'd just limit the total. Otherwise people will use it to game the system.
Re: PR spam today looks like email spam in the early 2000s
#95I see one big difference: with email it was always about sender reputation based on email servers (IPs), maybe about domains. But never about individual users. It's the organizations running the email server, who make sure users behave. So they don't get blacklisted and lose sending privileges for hundreds or thousands of users. For PRs/issues this is not applicable.
Not necessarily. Orgs exist in GitHub, and it seems reasonable that if the $BIGCORP org limits membership to employees, you can automatically trust all members of that org. Because this way, if one steps out of line, you have both an escalation path (contact admins) and a stick (revoke trust in entire org).
Allowing contributions only from big tech companies sounds ideologically questionable from free/libre software movement perspective, and it emboldens decisions which go against the user's interests, such as removing manifestv2 in Chromium.
Re: PR spam today looks like email spam in the early 2000s
#96Earlier quoted context omitted.
Not necessarily. Orgs exist in GitHub, and it seems reasonable that if the $BIGCORP org limits membership to employees, you can automatically trust all members of that org. Because this way, if one steps out of line, you have both an escalation path (contact admins) and a stick (revoke trust in entire org).
Allowing contributions only from big tech companies sounds ideologically questionable from free/libre software movement perspective, and it emboldens decisions which go against the user's interests, such as removing manifestv2 in Chromium.
Op said nothing about only allowing corporations. Simply stated that one path to allowing large swaths of users without having to approve every single individual user is to trust all users of certain orgs by default.
Presumably you would still allow individual contributions but with restrictions unless someone has vouched for them or some other gating factor.
Re: PR spam today looks like email spam in the early 2000s
#97Earlier quoted context omitted.
I would not be at all surprised if Github adds a first party reputation system. It would be a clever way to increase network effects - imagine if you host on Codeberg you're inundated by AI PRs but on Github you can easily filter them out. I can't see those pull request limits working very well. It's like trying to filter email spam by just rate limiting people. It's going to be annoying for the people you actually w…
If we want to keep it objective, one metric can already be calculated based on the user history of the submitter. The spammers profile will be full of unmerged or abandoned prs. Just based on those statistics beginners might be close to zero rating but spammers would be negative. Unless I totally missed that people are also making new accounts of each PR.
Prs are too pad cv's or novice users wanting something and vibe coding it themselves. Jellyfin player repos see a lot these kinds of prs so unlikely to be new users
Re: PR spam today looks like email spam in the early 2000s
#98Earlier quoted context omitted.
I would not be at all surprised if Github adds a first party reputation system. It would be a clever way to increase network effects - imagine if you host on Codeberg you're inundated by AI PRs but on Github you can easily filter them out. I can't see those pull request limits working very well. It's like trying to filter email spam by just rate limiting people. It's going to be annoying for the people you actually w…
If we want to keep it objective, one metric can already be calculated based on the user history of the submitter. The spammers profile will be full of unmerged or abandoned prs. Just based on those statistics beginners might be close to zero rating but spammers would be negative. Unless I totally missed that people are also making new accounts of each PR.
Or creating repos that will merge their PR(s).
Re: PR spam today looks like email spam in the early 2000s
#99I see one big difference: with email it was always about sender reputation based on email servers (IPs), maybe about domains. But never about individual users. It's the organizations running the email server, who make sure users behave. So they don't get blacklisted and lose sending privileges for hundreds or thousands of users. For PRs/issues this is not applicable.
[dead]
Re: PR spam today looks like email spam in the early 2000s
#100What are the best solutions to this issue?
As controversial as zig's contribution policy is, I respect it and think they made the right move.