frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Open in hackernews

Vouch

https://github.com/mitchellh/vouch
144•dboon•1h ago
https://x.com/mitchellh/status/2020252149117313349

https://nitter.net/mitchellh/status/2020252149117313349

https://github.com/ghostty-org/ghostty/pull/10559

Comments

quantumwoke•1h ago
Previous discussion: https://news.ycombinator.com/item?id=46930961
toomim•55m ago
From just 14 hours ago!?
dboon•49m ago
Oops! Usually, I just post good stuff I find and the dupe detector catches it and does the thing where it redirects you to the existing post. Apologies!
abracos•58m ago
Isn't it extremely difficult problem? It's very easy to game, vouch 1 entity that will invite lots of bad actors
DJBunnies•56m ago
Indeed, it's relatively impossible without ties to real world identity.
mjr00•43m ago
> Indeed, it's relatively impossible without ties to real world identity.

I don't think that's true? The goal of vouch isn't to say "@linus_torvalds is Linus Torvalds" it's to say "@linus_torvalds is a legitimate contributor an not an AI slopper/spammer". It's not vouching for their real world identity, or that they're a good person, or that they'll never add malware to their repositories. It's just vouching for the most basic level of "when this person puts out a PR it's not AI slop".

smotched•55m ago
you can't really build a perfect system, the goal would be to limit bad actors as much as possible.
dboon•48m ago
You can't get perfection. The constraints / stakes are softer with what Mitchell is trying to solve i.e. it's not a big deal if one slips through. That being said, it's not hard to denounce the tree of folks rooted at the original bad actor.
anupamchugh•11m ago
> The interesting failure mode isn’t just “one bad actor slips through”, it’s provenance: if you want to > “denounce the tree rooted at a bad actor”, you need to record where a vouch came from (maintainer X, > imported list Y, date, reason), otherwise revocation turns into manual whack-a-mole. > > Keeping the file format minimal is good, but I’d want at least optional provenance in the details field > (or a sidecar) so you can do bulk revocations and audits.
hobofan•48m ago
Then you would just un-vouch them? I don't see how its easy to game on that front.
speps•42m ago
The usual way of solving this is to make the voucher responsible as well if any bad actor is banned. That adds a layer of stake in the game.
supriyo-biswas•13m ago
A practical example of this can be seen in lobsters invite system, where if too many of the invitee accounts post spam, the inviter is also banned.
mjr00•35m ago
At a technical level it's straightforward. Repo maintainers maintain their own vouch/denouncelists. Your maintainers are assumed to be good actors who can vouch for new contributors. If your maintainers aren't good actors, that's a whole other problem. From reading the docs, you can delegate vouching to newly vouched users, as well, but this isn't a requirement.

The problem is at the social level. People will not want to maintain their own vouch/denounce lists because they're lazy. Which means if this takes off, there will be centrally maintained vouchlists. Which, if you've been on the internet for any amount of time, you can instantly imagine will lead to the formation of cliques and vouchlist drama.

IshKebab•49m ago
> Who and how someone is vouched or denounced is left entirely up to the project integrating the system.

Feels like making a messaging app but "how messages are delivered and to whom is left to the user to implement".

I think "who and how someone is vouched" is like 99.99% of the problem and they haven't tried to solve it so it's hard to see how much value there is here. (And tbh I doubt you really can solve this problem in a way that doesn't suck.)

skeeter2020•14m ago
Agree! Real people are not static sets of characteristics, and without a immutable real-world identity this is even harder. It feels like we've just moved the problem from "evaluate code one time" to "continually evaluate a persona that could change owners"
vips7L•44m ago
Love seeing some nushell usage!
aatd86•27m ago
Does is overlap with Contributor License Agreement?
throwaway150•24m ago
[dupe] https://news.ycombinator.com/item?id=46930961
quotemstr•22m ago
Fortunately, as long as software is open sourced, forking will remain a viable way to escape overzealous gatekeeping.
skeeter2020•17m ago
Doesn't this just shift the same hard problem from code to people? It may seem easier to assess the "quality" of a person, but I think there are all sorts of complex social dynamics at play, plus far more change over time. Leave it to us nerds to try and solve a human problem with a technical solution...
dom96•16m ago
Initially I liked the idea, but the more I think about it the more this feels like it just boils down to: only allow contributions from a list of trusted people.
3371•9m ago
Well a lot of useful things are not useful because they are innovative, but well designed an executed.
jprosevear•15m ago
Prior art? https://en.wikipedia.org/wiki/Advogato
thenaturalist•9m ago
Dupe of https://news.ycombinator.com/item?id=46930961
HiPhish•6m ago
Not sure about this one. I understand the need and the idea behind it is well-intentioned, but I can easily see denouncelists turn into a weapon against wrongthinkers. Said something double-plus-ungood on Twitter? Denounced. Accepted contribution from someone on a prominent denouncelist? Denouced. Not that it was not possible to create such lists before, but it was all informal.

The real problem are reputation-farmers. They open hundreds of low-effort PRs on GitHub in the hope that some of them get merged. This will increase the reputation of their accounts, which they hope will help them stand out when applying for a job. So the solution would be for GitHub to implement a system to punish bad PRs. Here is my idea:

- The owner of a repo can close a PR either neutrally (e.g. an earnest but misguided effort was made), positively (a valuable contribution was made) or negatively (worthless slop)

- Depending on how the PR was closed the reputation rises or drops

- Reputation can only be raised or lowered when interacting with another repo

The last point should prevent brigading, I have to make contact with someone before he can judge me, and he can only judge me once per interaction. People could still farm reputation by making lots of quality PRs, but that's actually a good thing. The only bad way I can see this being gamed is if a bunch of buddies get together and merge each other's garbage PRs, but people can already do that sort of thing. Maybe the reputation should not be a total sum, but per project? Anyway, the idea is for there to be some negative consequences for people opening junk PRs.

Prankster launches Super Bowl party for AI agents

https://entertainment.slashdot.org/story/26/02/08/1827216/prankster-launches-super-bowl-party-for...
1•MilnerRoute•2m ago•0 comments

Show HN: A local-first documentation tool for AI agents (MCP)

https://github.com/neuledge/context
2•moshest•5m ago•1 comments

Federal statement on Jeffrey Epstein's death dated day before he was found dead

https://www.standard.co.uk/news/world/statement-jeffrey-epstein-death-day-before-b1270109.html
7•saubeidl•6m ago•0 comments

Preserving the Open Web: Inside the New Wayback Machine Plugin for WordPress

https://blog.archive.org/2026/02/04/inside-the-new-wayback-machine-plugin-for-wordpress/
2•Tomte•8m ago•0 comments

Updates and Bot Wars

https://marisabel.nl/public/blog/Updates_and_Bot_Wars
3•todsacerdoti•13m ago•0 comments

Seven Pages of a Sealed Watergate File Sat Undiscovered. Until Now.

https://www.nytimes.com/2026/02/08/opinion/trump-nixon-watergate-radford.html
2•themgt•14m ago•0 comments

Roundcube Webmail: SVG feImage bypasses image blocking to track email opens

https://nullcathedral.com/posts/2026-02-08-roundcube-svg-feimage-remote-image-bypass/
10•nullcathedral•17m ago•0 comments

Latest Epstein files reveal disgraced financier's Silicon Valley connections

https://www.france24.com/en/latest-epstein-files-reveal-disgraced-financier-s-silicon-valley-conn...
6•mgh2•17m ago•1 comments

Hackers arrested after being hired by Iowa to pentest courthouse win case [video

https://www.youtube.com/watch?v=x1txcEPPhrw
5•hajile•22m ago•0 comments

Google is killing authentic websites and I made it worse [video]

https://www.youtube.com/watch?v=II2QF9JwtLc
5•basilikum•23m ago•0 comments

Specification Driven Development

https://www.joshuapurtell.com/posts/spec_eng/
1•JoshPurtell•23m ago•0 comments

A header-only C allocator library

https://github.com/abdimoallim/alloc
2•abdimoalim•25m ago•1 comments

Experts Have World Models. LLMs Have Word Models

https://www.latent.space/p/adversarial-reasoning
5•aaronng91•27m ago•1 comments

Prepare your OSS repo for AI coding assistants

https://angiejones.tech/stop-closing-the-door-fix-the-house/
2•hashim-warren•28m ago•0 comments

Hud: Runtime Code Sensor for Production-Safe AI Code

https://marketplace.visualstudio.com/items?itemName=Hud.hud
2•aanthonymax•34m ago•0 comments

Beyond WaPo angst: Why journalists need to abandon hubris and look within

https://thejaggi.blogspot.com/2026/02/beyond-wapo-angst-why-journalists-need.html
2•porridgeraisin•35m ago•0 comments

Show HN: Launchpick – Native macOS launcher and window switcher

https://github.com/scorredoira/launchpick
2•dawkins•37m ago•0 comments

The Little Bool of Doom

https://blog.svgames.pl/article/the-little-bool-of-doom
8•pocksuppet•38m ago•0 comments

Discovery of Goethe's amber ant: its phylogenetic and evolutionary implications

https://www.nature.com/articles/s41598-026-36004-4
2•PaulHoule•40m ago•0 comments

Isledb: Database Built on Object Storage

https://isledb.com/
1•ankuranand•40m ago•0 comments

Algorithmic Wage Discrimination

https://www.columbialawreview.org/content/on-algorithmic-wage-discrimination/
2•softwaredoug•41m ago•0 comments

GitButler

https://gitbutler.com/
1•tosh•41m ago•0 comments

Canadian startups need to stop playing slow

https://bcbusiness.ca/industries/general/canadian-startups-stop-playing-slow/
2•ClearwayLaw•41m ago•0 comments

Simple tool to check SSL, HTTPS, TLS, Security headers and HTTP/3 support

https://httpsornot.com/
1•hackerbo•44m ago•2 comments

Web design without design software

https://goodinternetmagazine.com/web-design-without-design-software/
2•ovidem•45m ago•0 comments

Show HN: Plexsonic, a Plex Music to Subsonic Bridge

https://github.com/ClassicOldSong/Plexsonic
1•ClassicOldSong•48m ago•0 comments

EU to delay anti-deforestation law. Again

https://www.politico.eu/article/council-and-parliament-agree-to-delay-and-review-eu-deforestation...
2•aa_is_op•48m ago•0 comments

Show HN: Deploy to AWS in minutes – no DevOps required

https://obelis.ai/
1•fedepochat•49m ago•0 comments

How do you manage context window?

2•picklepixel•49m ago•0 comments

Show HN: Surge – A TUI download manager written in Go that beats ara2 by ~1.4x

https://github.com/surge-downloader/surge
1•SuperCoolPencil•50m ago•1 comments