From: Jake McArthur <jake.mcarthur@...>
Date: 2006-04-29T03:03:05+09:00
Subject: Re: Ruby Drops

You have a point. This would not be caught. I see only a few  
potential solutions, but they are kind of a hassle:

a) No world editing. The creator of a branch can give access to other  
people at will, but only explicitly.
b) No automatic running of tests. Updating to recent revisions of  
dependencies prompts the developer to review the changes to the code  
before running tests, and then gives an option to run the tests and/ 
or revert to an older version that works.
c) Both of the above.
d) A sort of karma system in which a dependency update will update  
and test code automatically that is edited by "trusted" developers,  
but uses method B for any code that has been edited ("tainted") by  
untrusted developers. A developer gains karma in the network whenever  
somebody decides to keep their revisions in their own projects. A  
developer loses karma whenever somebody updates a dependency,   
examines their code, and decides not to use it. You can define the  
karma threshold at which an update is automatically tested and  
integrated. A dependency itself may also be marked as editable only  
to those with a high enough karma. This is my favorite idea here, but  
also the most difficult to implement.
e) Some programmatic way of checking for or eliminating the  
possibility of malicious code. (???)

- Jake McArthur


On Apr 28, 2006, at 11:12 AM, Elliot Temple wrote:

> What if the code functioned exactly the same plus some nasty side  
> effects like a root kit? Could that get through tests?