vouch

We should have agents to triage PRs. Their "smarter bypass signals" is already implemented by Mitchell Hashimoto's Vouch system: https://github.com/mitchellh/vouch

One popular solution lately has been instead of banning too much, because of the danger of false positives, to use vouch [0]. Trusted people get vouched and you prioritize their actions. Unknown people (or agents) need to gain trust to be vouched and bad actors can still be banned. [0]: https://github.com/mitchellh/vouch

mitchell hashimoto https://github.com/mitchellh/vouch implemented this idea

Sounds a bit like Mitchell Hashimoto’s Vouch: https://github.com/mitchellh/vouch

I think I saw this on here yesterday: https://github.com/mitchellh/vouch Not great for privacy or ad-hoc contributions, but I don't see a way out of the muck without some kind of trust net.

On a general note, I like vouch by mitchellh. > People must be vouched for before interacting with certain parts of a project (the exact parts are configurable to the project to enforce). https://github.com/mitchellh/vouch I think many projects will adopt this instead of allowing everyone / blocking everyone Many projects have "ai slop" check in place to directly close and ban user if it is "ai slop". Else, it will be hard to handle the velocity of PRs

Mitchel Hashimoto started a tool for this, https://github.com/mitchellh/vouch.

It was pretty well received when mitchellh copied the idea and formalized it into vouch. - https://news.ycombinator.com/item?id=46930961 - https://github.com/mitchellh/vouch

This vouch system? https://github.com/mitchellh/vouch

I like Mitchell's Vouch idea. At the end of the day, it's all about trust. Anything else is an abstraction attempting to replicate some spectrum of trust. https://news.ycombinator.com/item?id=46930961 https://github.com/mitchellh/vouch

5000+ open PRs is pretty insane, that's the highest I've seen. How do you even keep track of this? We'll really need trust management systems like vouch (https://github.com/mitchellh/vouch/tree/main) for open source projects in the future to help with reducing noise.

The curl guy is one of OSE founding donors, together with the terraform guy who recently released an open source trust management system to help with AI-generated crap: https://github.com/mitchellh/vouch I think that AI eventually will solve technical maintenance problems, but not human-related ones: limited attention, trust, motivation issues. And we are going to support mostly "old" projects everybody relies on, not some new AI-gen stuff.

I've thought about making such a system before, but never considered making it a single flat file¹. How are you going to identify who keeps inviting these bad actors? Assuming the list is under source control, the commit history can answer this question but it's manual work whereas a tree/graph system shows you directly who is making the bad judgement calls (may be intentional or not, so this person can keep contributing so long as those contribs are good, but not invite further people). I don't understand the added value of a bunch of software around what is essentially an allowlist where the commit history already shows why someone was added or removed ¹ https://github.com/mitchellh/vouch?tab=readme-ov-file#vouche...