From: Giles Bowkett <gilesb@...>
Date: 2006-04-29T03:14:57+09:00
Subject: Re: Ruby Drops

I'm working on something similar also, although it's hardly even
started, and it isn't optimized for code sharing.

Also, somebody mentioned they were working on techniques to identify
similar strings. I think what you're looking for may be Levenstein
distance.

--
Giles Bowkett
http://www.gilesgoatboy.org

On 4/28/06, Jake McArthur <jake.mcarthur@gmail.com> wrote:
> You have a point. This would not be caught. I see only a few
> potential solutions, but they are kind of a hassle:
>
> a) No world editing. The creator of a branch can give access to other
> people at will, but only explicitly.
> b) No automatic running of tests. Updating to recent revisions of
> dependencies prompts the developer to review the changes to the code
> before running tests, and then gives an option to run the tests and/
> or revert to an older version that works.
> c) Both of the above.
> d) A sort of karma system in which a dependency update will update
> and test code automatically that is edited by "trusted" developers,
> but uses method B for any code that has been edited ("tainted") by
> untrusted developers. A developer gains karma in the network whenever
> somebody decides to keep their revisions in their own projects. A
> developer loses karma whenever somebody updates a dependency,
> examines their code, and decides not to use it. You can define the
> karma threshold at which an update is automatically tested and
> integrated. A dependency itself may also be marked as editable only
> to those with a high enough karma. This is my favorite idea here, but
> also the most difficult to implement.
> e) Some programmatic way of checking for or eliminating the
> possibility of malicious code. (???)
>
> - Jake McArthur
>
>
> On Apr 28, 2006, at 11:12 AM, Elliot Temple wrote:
>
> > What if the code functioned exactly the same plus some nasty side
> > effects like a root kit? Could that get through tests?
>
>