Bounty hunt program (Monero option MUST)

[RustoMCSpit]

you could do a 'donate for issue priority' scheme where issues donated to get put first in queue and you could show this in the milestones. this is a win-win situation in my eyes as long as the issues are within scope

but you would need to say how much - some issues are hard, some are easy, some are important, some arent

https://bountysource.com/
From all Bounties platforms this one is the popular one.

[RustoMCSpit]

whats the best foss method of doing this?

[inson1]

I would like some with Monero option

[inson1]

@RustoMCSpit thanks! with the title :)

[naveensingh]

@RustoMCSpit I like the idea of prioritizing issues based on the amount donated. As per a quick look, it looks like bountysource.com is designed for open-source projects that are already funded and want to outsource tasks but I could be wrong. If you know more about this or have any experience with it, please share it with us. I'll do my research later.

whats the best foss method of doing this?

It would be good to find something that integrates with directly GitHub issues so we don't have to jump around. Expensify has such a setup but they fund and manage it themselves: https://github.com/Expensify/App/issues/.

you would need to say how much - some issues are hard, some are easy, some are important, some arent

That is true but to categorize issues based on the difficulty level, I or any active contributor would have to inspect them first. Some issues look easily solvable but aren't and easily lead to a regression, some look hard but are easily solved.

It'll take some time before we have that many issues so I think this won't help anytime soon. We'll keep this thread open for future discussion.

[Cwpute]

Bountysource is a very bad choice for hosting bounty hunts on issues: in short, it accepts bounty money, but hasn't given back any promised bounty money to hunters since this february.

Using bounty-hunting as a mean to prioritize issues is also very inneficient, as it gives much visibility to exciting features, but brings an even greater shadow over equally-important, if not essential but less flashy bug-fixes. (here is a thoughtful article on the matter).

[inson1]

@Cwpute
privacy/security bugs should have the biggest priority and the second biggest priority should have reproducible bugs I agree on that. And only after that FRs with bounties. We should add it to rules somewhere.

But please dont be against bounties. Bounties are great way for more donations. It doesnt cost normal users nothing.
Why wouldnt users give bounties for bigger or annoying bugs? For example I want to (not in this project) give big bounty for one big bug this year.

https://github.com/orgs/FossifyOrg/discussions/url

bad link

[Cwpute]

Yes @inson1 , i am against bounties in the open-source community. My reasoning goes a little bit like this:

Are we commited to the opensource and libre software philosophy? Do we want to support this software and its developers? then let's act, let's make a recurring or one-time donation right now, let's participate in the community, contribute to this project ect…
Or do we consider ourselves clients in a consumerist market ? then let's use the old carrot-and-stick method, and only promise money while being vocal about our discontent, let's patiently wait for the designated responsible to work for us while we watch and judge their every step.

This might be a bit polarizing, yes. But nothing prevents you from making a donation and then ask for a feature or bug request, weighting your opinion and explaining the context. This method suposedly changes the way the project is driven: not by money, which incentivizes quick and dirty fixes contributed by bounty-hunters that don't care about consequences and code legacy, but by best interest for the software and its userbase, carefully planned and thoughout.

[RustoMCSpit]

sorry but whats regression mean

[naveensingh]

Unintended side-effects (bugs) caused by some recent fix or code change.

[roelofr]

Isn't regression a reoccurrence of a previously solved problem?

Bugs by a fix or change are just bugs right?

[naveensingh]

As per wikipedia:

A software regression is a type of software bug where a feature that has worked before stops working. This may happen after changes are applied to the software's source code, including the addition of new features and bug fixes.

[roelofr]

Ah, I must've confused Sentry's "bug regression" with "software regression"

[telepath]

Do not use bountysource, it's broke.
bountysource/core#1586
QubesOS/qubes-issues#1806 (comment)

[naveensingh]

hmmm

[roelofr]

Furthermore, Bountysource is fully blockchain, whilst there are plenty of reputable alternatives that just payout cash.

One of which being Intigrity which seems to be trusted by the European Commission.
That should be an indication this is a more reliable bug-bounty partner than a failing bitcoin startup (that charges a 10% fee on a payout!)

[Cwpute]

I'll post this as a full-on answer since this is important to me:

Yes @inson1 , i am against bounties in the open-source community. My reasoning goes a little bit like this:

Are we commited to the opensource and libre software philosophy? Do we want to support this software and its developers? then let's act, let's make a recurring or one-time donation right now, let's participate in the community, contribute to this project ect…
Or do we consider ourselves clients in a consumerist market ? then let's use the old carrot-and-stick method, and only promise money while being vocal about our discontent, let's patiently wait for the designated responsible to work for us while we watch and judge their every step.

This might be a bit polarizing, yes. But nothing prevents you from making a donation, reccurent or not, and then ask for a feature or bug request, weighting your opinion and explaining the context. This method suposedly changes the way the project is driven: not by money, which incentivizes quick and dirty fixes contributed by bounty-hunters that don't care about consequences and code legacy, but by best interest for the software and its userbase, carefully planned and thoughout.

[inson1]

@Cwpute Imo everybody should do both. So we can get best out of both worlds.

[naveensingh]

I'm closing this. For now, one-time and recurring donations are the two ways to support the project. Issues will be prioritized based on how important they are to the users and the project overall.