~sircmpwn/sr.ht-discuss

8 2

Contributions without a sr.ht account

Details
Message ID
<CAMAFT9W-1izcS8H4YToE8Y4J_8Z-Y9aLn3zzQxk-iRyZ1Ts0nw@mail.gmail.com>
Sender timestamp
1552917989
DKIM signature
missing
Download raw message
Hello,

Drew is "considering doing away with anonymous users entirely."
(https://todo.sr.ht/~sircmpwn/todo.sr.ht/103). I ask instead: please make
accountless contribution a first class citizen on Sourcehut. Then sr.ht hosted
projects will have similar contributor friction as Github, and even more
important, much less friction for self-hosted or domain redirected projects.

Accountless contributions would be a unique and important feature that can't
be done by other platforms where the user is the product. With Sourcehut,
every project owner (eventually) pays for their hosting, relieving
Sourcehut from
VC-backed growth pressure to force people to create accounts.

I'm about to release a project I've been working on for quite a while,
and I'm considering Sourcehut because I like your philosophy and
because I want to avoid Github. I trust whatever features missing from
the bigger and older platforms will be implemented in time, perhaps
even by myself.

However, since Sourcehut is still very new and small, I worry about
the friction of forcing potential contributors to create a sr.ht account.

At some point my Sourcehut project should be on a subdomain to my
project, whether through self-hosting or a domain redirect feature provided
by Sourcehut. Then sr.ht accounts make even less sense.

I'm very much a fan of building on top of email, such that git send-email
is all you need to contribute a change. It seems to me that any
contribution could also be done with email or anonymous web form
without an sr.ht account.
(Is it true today that users can git send-email and post to mailing lists
without an sr.ht account? The documentation wasn't clear to me.)

Someone brought up spam, but I don't see why whatever spam protection
measures there is for account creation cannot be done for all contributions.
Heck, I would gladly moderate contributions just to avoid forcing accounts
on everyone. I expect moderation to scale with new email addresses,
because DKIM and similar measures block address spoofing.

 - elias
Details
Message ID
<8E1BD5DB-A20B-4EE8-A68F-1DB45E9F6FED@jacoscaz.com>
In-Reply-To
<CAMAFT9W-1izcS8H4YToE8Y4J_8Z-Y9aLn3zzQxk-iRyZ1Ts0nw@mail.gmail.com> (view parent)
Sender timestamp
1552934374
DKIM signature
missing
Download raw message
Hi.

This conversation is very interesting. I think there is quite a difference between anonymous web forms and email contributions. 

Accepting contributions via email would be not unlike using external identity providers for user authentication, such as allowed by OAuth and OpenID Connect, delegating the authentication process to trusted third-party systems. Therefore, supporting email contributions would still allow contributions to be associated to their submitters’ externally-managed identities, identified by their email addresses. The combination of DKIM + PGP would even offer a reasonable 2FA-compatible security framework.

With anonymous web forms, however, there would be no identities to tie contributions to. It would be impossibile to filter contributions based on anything else other than the contributions themselves, which I believe would represent a huge obstacle to the formation of chains of trust and successful delegation models.

Best regards,
Jacopo.

---

Jacopo Scazzosi
https://keybase.io/jacoscaz



> On 18 Mar 2019, at 14:06, Elias Naur <mail@eliasnaur.com> wrote:
> 
> Hello,
> 
> Drew is "considering doing away with anonymous users entirely."
> (https://todo.sr.ht/~sircmpwn/todo.sr.ht/103). I ask instead: please make
> accountless contribution a first class citizen on Sourcehut. Then sr.ht hosted
> projects will have similar contributor friction as Github, and even more
> important, much less friction for self-hosted or domain redirected projects.
> 
> Accountless contributions would be a unique and important feature that can't
> be done by other platforms where the user is the product. With Sourcehut,
> every project owner (eventually) pays for their hosting, relieving
> Sourcehut from
> VC-backed growth pressure to force people to create accounts.
> 
> I'm about to release a project I've been working on for quite a while,
> and I'm considering Sourcehut because I like your philosophy and
> because I want to avoid Github. I trust whatever features missing from
> the bigger and older platforms will be implemented in time, perhaps
> even by myself.
> 
> However, since Sourcehut is still very new and small, I worry about
> the friction of forcing potential contributors to create a sr.ht account.
> 
> At some point my Sourcehut project should be on a subdomain to my
> project, whether through self-hosting or a domain redirect feature provided
> by Sourcehut. Then sr.ht accounts make even less sense.
> 
> I'm very much a fan of building on top of email, such that git send-email
> is all you need to contribute a change. It seems to me that any
> contribution could also be done with email or anonymous web form
> without an sr.ht account.
> (Is it true today that users can git send-email and post to mailing lists
> without an sr.ht account? The documentation wasn't clear to me.)
> 
> Someone brought up spam, but I don't see why whatever spam protection
> measures there is for account creation cannot be done for all contributions.
> Heck, I would gladly moderate contributions just to avoid forcing accounts
> on everyone. I expect moderation to scale with new email addresses,
> because DKIM and similar measures block address spoofing.
> 
> - elias
Details
Message ID
<D850D4CE-0995-463C-810F-7F6EFC5822D3@birl.org>
In-Reply-To
<CAMAFT9W-1izcS8H4YToE8Y4J_8Z-Y9aLn3zzQxk-iRyZ1Ts0nw@mail.gmail.com> (view parent)
Sender timestamp
1552937388
DKIM signature
missing
Download raw message
> 
> I'm very much a fan of building on top of email, such that git send-email
> is all you need to contribute a change. It seems to me that any
> contribution could also be done with email or anonymous web form
> without an sr.ht account.
> (Is it true today that users can git send-email and post to mailing lists
> without an sr.ht account? The documentation wasn't clear to me.)


Anyone with git send-email can send patches to public sr.ht mailing lists.  No sr.ht account required. 

I think a web form that accepts patches/diffs is a good idea, but unauthenticated.. that sounds like a world of trouble.  Maybe make them verify an email address via a link to get to the form, so one can tie their patch/diff to an email address at the least.  Also that would help discourage spam against the form and would be better than captchas and stuff.  But I’m not sure ddevault is very interested in it, based on his past writings.  He might accept a patch, but I don’t think it’s something he would want to bother to write himself, he is very much a git send-email fan.
Details
Message ID
<CAMAFT9UDPHt6sjcqudM7BxxW=WK8b29u3Swqbbu7na=2D6iAfA@mail.gmail.com>
In-Reply-To
<D850D4CE-0995-463C-810F-7F6EFC5822D3@birl.org> (view parent)
Sender timestamp
1552938533
DKIM signature
missing
Download raw message
On Mon, Mar 18, 2019 at 8:29 PM zie <zie@birl.org> wrote:
>
> >
> > I'm very much a fan of building on top of email, such that git send-email
> > is all you need to contribute a change. It seems to me that any
> > contribution could also be done with email or anonymous web form
> > without an sr.ht account.
> > (Is it true today that users can git send-email and post to mailing lists
> > without an sr.ht account? The documentation wasn't clear to me.)
>
>
> Anyone with git send-email can send patches to public sr.ht mailing lists.  No sr.ht account required.
>

Good to hear, that alleviates most of my concerns. I hope that will
extend to whatever code
review tool sourcehut will have.

> I think a web form that accepts patches/diffs is a good idea, but unauthenticated.. that sounds like a world of trouble.  Maybe make them verify an email address via a link to get to the form, so one can tie their patch/diff to an email address at the least.  Also that would help discourage spam against the form and would be better than captchas and stuff.  But I’m not sure ddevault is very interested in it, based on his past writings.  He might accept a patch, but I don’t think it’s something he would want to bother to write himself, he is very much a git send-email fan.

Good points.

The other way around is a git send-email-like interface for bug
reporting and feature requests. Perhaps
emails formatted in a special way ("BUG: ..." or "RFE:...", prefilled
in a mailto: link?) will turn into tickets.
Or a special mailing list address could turn all emails into tickets
more or less automatically, just like Zendesk
and the like.

But I digress; with no accounts required for patches and mailing lists
in general, I believe sourcehut fullfills
my needs and that any further development for accountless contributors
can be done by myself if necessary.

Thank you for your replies,

 - elias
Details
Message ID
<258a8ac1-835f-66e4-a33b-b388e41dd810@takaneshijou.club>
In-Reply-To
<8E1BD5DB-A20B-4EE8-A68F-1DB45E9F6FED@jacoscaz.com> (view parent)
Sender timestamp
1552940807
DKIM signature
missing
Download raw message
On 2019-03-18 2:39 p.m., Jacopo Scazzosi wrote:
> With anonymous web forms, however, there would be no identities to tie contributions to. It would be impossibile to filter contributions based on anything else other than the contributions themselves, which I believe would represent a huge obstacle to the formation of chains of trust and successful delegation models.

I think what Zie suggested in another part of the thread would help with
tying non-registered users to their contributions.

You do make a good point though, it's kinda hard to accept contributions
from someone nameless.
Details
Message ID
<a47d42fd-54d4-e53a-b36b-a1063263a444@metacode.biz>
In-Reply-To
<CAMAFT9UDPHt6sjcqudM7BxxW=WK8b29u3Swqbbu7na=2D6iAfA@mail.gmail.com> (view parent)
Sender timestamp
1552942478
DKIM signature
missing
Download raw message
Hi Elias,

> Or a special mailing list address could turn all emails into tickets
> more or less automatically, just like Zendesk
> and the like.

I like that idea.

I'm actually wondering why it wasn't pursued as on first sight a bug 
tracker could be easily modelled using a mailing list where for each 
thread there is a little bit of metadata stored (status, label) that 
could be changed via e-mail interface. I guess that would be similar to 
Debbugs in some aspects.

Then one could accept tickets via e-mail as easily as patches.

Kind regards,
Wiktor

-- 
https://metacode.biz/@wiktor
Details
Message ID
<20190319233400.GJ1602@homura.localdomain>
In-Reply-To
<CAMAFT9W-1izcS8H4YToE8Y4J_8Z-Y9aLn3zzQxk-iRyZ1Ts0nw@mail.gmail.com> (view parent)
Sender timestamp
1553038440
DKIM signature
missing
Download raw message
Reporting bugs to todo.sr.ht via email is planned. This will likely
replace anonymous bug submission via the web. As already mentioned later
in the thread, lists.sr.ht also already allows users to send emails in
without an account.
Details
Message ID
<CAMAFT9VM+5ZSbAd1tV4FMWu0mJ8EG3ydft3LFuUY17iFMVvVAQ@mail.gmail.com>
In-Reply-To
<CAMAFT9W-1izcS8H4YToE8Y4J_8Z-Y9aLn3zzQxk-iRyZ1Ts0nw@mail.gmail.com> (view parent)
Sender timestamp
1554038830
DKIM signature
missing
Download raw message
On Mon, Mar 18, 2019 at 3:06 PM Elias Naur <mail@eliasnaur.com> wrote:
>
> I'm about to release a project I've been working on for quite a while,
> and I'm considering Sourcehut because I like your philosophy and
> because I want to avoid Github. I trust whatever features missing from
> the bigger and older platforms will be implemented in time, perhaps
> even by myself.
>

My project, for creating portable immediate mode GUI programs in Go,
is now released on Sourcehut:

    https://git.sr.ht/~eliasnaur/gio

The project was announced on the golang-nuts mailing list:

https://groups.google.com/forum/#!topic/golang-nuts/H4us4194WQ4

I look forward to using the Sourcehut service!

 - elias
Details
Message ID
<31567b1c-2a92-e0cc-4bca-f81d6d4d6c5c@biribiri.dev>
In-Reply-To
<CAMAFT9VM+5ZSbAd1tV4FMWu0mJ8EG3ydft3LFuUY17iFMVvVAQ@mail.gmail.com> (view parent)
Sender timestamp
1554048338
DKIM signature
missing
Download raw message
On 2019-03-31 9:27 a.m., Elias Naur wrote:

> My project, for creating portable immediate mode GUI programs in Go,
> is now released on Sourcehut:
>
>      https://git.sr.ht/~eliasnaur/gio

That looks pretty cool.
Reply to thread Export thread (mbox)