@mitchellh@hachyderm.io #AI eliminated the natural barrier to entry that let OSS projects trust by default.
To me, this reads:
Corporate automation eliminated the natural barrier to entry that let #OSS projects trust by default.
I'm not much sure what you meant with "trust by default", but for sure
#opensource projects never let unreviewed code in from strangers.
That what
forks were for.
Now, since your automation won't prevent forks, it looks either pointless or just divisive.
I mean, forks are good!
But are you sure that automated contributor managenent can solve automated theft and regurgitation by corporations?
Who and how someone is vouched or denounced is up to the project. I'm not the value police for the world.
If it's your code that executes the "flat text file" in the repository,
you are in control.
If your project spreads,
you would be in the position to execute a wide variety of
#SupplyChain and
#DDoS attacks.
Even if you wouldn't, anybody taking control of your repo could, turning such repo into a high-value target.
You should really take effective
#security measure to avoid this outcome.
For example you could force downstream project to fork and adapt your scripts by only ever pushing on your repo slightly broken code.
Eg, you could apply before each push an easy to invert
find vouch/|grep nu|xargs -n 1 sed -i 's/use/!!!BrOkEN!!!/g'
This way no one coukd directly use your GitHub actions without reviewing them and nobody would need to
#trust you or your security practices.
____
Also,
#GitHub?
The reign of
#CopyALot?
I guess projects still there face no trust collapse in AI contributions and in contributing to AI.
@driggy@mastodon.gamedev.place
