Hacker News new | ask | show | jobs
by psacawa 1119 days ago
Another possible outcome of "I gave commit rights to someone I didn't know": https://github.com/dominictarr/event-stream/issues/116
2 comments

"he emailed me and said he wanted to maintain the module, so I gave it to him. I don't get any thing from maintaining this module, and I don't even use it anymore, and havn't for years"

This is the risk of open source not figuring out funding.

Listening to https://podcast.sustainoss.org/157 yesterday a great point was made about two distinct roles - the "author" (original person creating the library) and the "maintainer" (person continuing updates, feature requests, etc) and sounds like in this case this is an author who was nudged into being a maintainer, and them being funded may still not have been beneficial
I think authors usually give admin access to active contributors that seem reliable, instead of some random guy who ask for permission without doing much previously...
> This is the risk of open source not figuring out funding.

Not necessarily. There is software I built for me, thought that it could be useful to others, used for some time and then went away. Sure, if it brought me 1M€/month I would work on it hard. But it was not the primary goal anyway.

Not really. Even if it was somehow funded, the original author may still want to stop maintaining it and hand it over to someone else.

So it's an entirely different issue.

I don't understand why he didn't tell them to fork. The risk of him making new changes was so low.
You can not compare an email asking for rights, to someone who has written a massive amount of work, which you can randomly pick a section and see it is correct.

This commentator puts it well - https://news.ycombinator.com/item?id=36121561

This is simple spammer entropy.

Now with GPT spammers can create entropy very easily, so it's tricker.

An attacker would be willing to write a 40 line commit like this guy in order to get the access needed