Re:We lost 54k GitHub stars
by JadoJodo on Thursday April 14, 2022 @06:56PM
(#31034491)
I don’t know for certain but I feel like this could allow something like 1. Takeover/inherit public repo with lots of stars 2. Take repo private (retaining stars) 3. Replace repo code with some malicious/offensive code. 4. Take repo public again 5. Inherit the trust/prestige of the old repo.
[ Parent
| on HN ]
But couldn't the same be achieved without taking it private?
You can do that without the “making it private and public again” part anyway.
Re:We lost 54k GitHub stars
by notreallyserio on Thursday April 14, 2022 @07:01PM
(#31034547)
Yeah, that's a risk. They could mitigate it by allowing you to revert all branches/tags back to the pre-private state, but we're getting more and more complicated here.
Yeah but it's not like stars are seen as some amazing endorsement on the part of the individual starring. It's more like a favorites list if anything
Re:We lost 54k GitHub stars
by freedomben on Thursday April 14, 2022 @07:14PM
(#31034680)
stars absolutely are seen as an endorsement. I'm guilty of that for sure, and I've been in a ton of conversations about adopting some thing and the "number of stars" is often a consideration unless it's a project like React or Vue, etc.
Would you really not look at two repos that do the same thing, with similar ages and recent commits but one has zero stars and the other has hundreds, and not at least initially trust the latter more?