Show HN: A reputation index from mitchellh's Vouch trust files

https://vouchbook.dev/

by rosslazer • 5 months ago

18 3 5 months ago

I was inspired by mitchellh's Vouch project, an explicit trust system where maintainers vouch for contributors before they can interact with a repo. Ghostty uses it to filter out AI slop PRs.

Because Vouch exposes the vouch list as a plain text file (VOUCHED.td), I realized I could aggregate them across GitHub and build a reputation index. A crawler finds every VOUCHED.td file, pulls the entries, and computes a weighted score per user. Vouches from high-star repos count more than vouches from zero-star repos.

Next step is to wire up an API so that the vouch GH action can start to use this data to auto approve contributors.

rosslazer2• 5 months ago

Repo: https://github.com/rosslazer/vouch-book

chabad360• 5 months ago

I will admit that while I think the idea of Vouch is nice, I'm not a huge fan. But that is not really an issue here, the issue is that this seems to be very exploitable. There's nothing to counteract someone creating a bunch of repos just to farm some score (this gets worse once you add in star farming).

For the same price, what is a reasonable score to auto-accept? If I make a small contribution to a large project, I'd automatically get a much larger score out of the gate, vs. if I contribute to a much smaller project. That would incentivize contributions to larger projects, and disincentivize contributing to smaller projects, that doesn't seem good for the ecosystem either.

I'm not sure why a more page-rank style system wasn't used. Effectively, rank users based on the diversity of the projects they're vouched in. That would avoid the problem of people being able to farm, and encourage contributions across the OS ecosystem.

rosslazer2• 5 months ago

Love the idea of using page rank. Right now, there is so little adoption of vouch that I opted for the most basic thing.