Updating username could lead to getting around being `denounced`

[R44VC0RP]

A good point was brought up when we were thinking through implementing the vouch system for the OpenCode repo (we see a lot of AI slop, especially in issues) and someone in anomalyco/opencode#12640 (comment) brought up the thought of if someone changes their username they would be able to get around being denounced.

A bad user (that wants to spam) might change their username to get around being "banned/denounced" from a repo.

I think a way to solve this would be to have in the .td file would be to include the userid of the user as well so that:

-github:slopmaster3000 Submitted endless amounts of AI slop

would become

-github:slopmaster3000:128301923810298 Submitted endless amounts of AI slop

The only caveat to this is since this isn't Github specific (and I don't have experience with other providers like Gitlab) I can't confirm if this is a reliable way to attain user-ids.

[suprstarrd]

• GitLab's user API does offer user IDs. https://docs.gitlab.com/api/users/
• I'm fairly certain Gitea does too (which will go, to some degree, downstream to Forgejo/Codeberg/etc.) but I couldn't find any docs for that besides that user IDs exist. I expect that they would be shown when you attempt to search up a user by their username.
• I have no idea about other places like SourceHut.

As an aside, this is a common type of problem. I've even seen it happen even in the official GitHub app! I used to go by @jbmagination but changed my name when I transitioned. I made an organization so I could keep redirects and such, but the app still attempts to take me to @jbmagination... which makes it a PITA to manage my profile.

[mitchellh]

I think it'd be cleanest to use a new platform key here, example:

github-id:1234

And the reason (trailing data) can contain whatever, such as usernames.

[mitchellh]

vouch

[mitchellh]

Vouched both of you by the way since you seem like thoughtful humans.

[mitchellh]

vouch @suprstarrd

[DitherDude]

For organisation purposes, #5

[Seldaek]

I got here as I wanted to say something similar but even more scary to me than someone evading a ban.

If you vouch for someone by username and they rename their account some time later, an attacker could create a new account with the old vouched for name and suddenly inherit these permissions.

This is a common attack vector with domain name resurrection, or github user resurrection leading to attacks on package managers for example.

So I believe very strongly that vouches should be stored by user id, but indeed having the username for human readability is a big plus.

[mitchellh]

It's not as scary as it sounds, since vouching gives you permission to merely participate, not to merge code or any of that. I'm still open to a user ID option as this issue is still open, but it's nothing to be overly worried about. Vouched people are the lowest bar amongst many other gates.

[R44VC0RP]

I got here as I wanted to say something similar but even more scary to me than someone evading a ban.

If you vouch for someone by username and they rename their account some time later, an attacker could create a new account with the old vouched for name and suddenly inherit these permissions.

This is a common attack vector with domain name resurrection, or github user resurrection leading to attacks on package managers for example.

So I believe very strongly that vouches should be stored by user id, but indeed having the username for human readability is a big plus.

I know he replied above but at opencode a vouched user doesn't give you any "extra" permissions it just allows/approves you as an actual human that is not someones OpenClaw bot.

[Seldaek]

I hear you in this case it's not so scary but what happens when someone builds vouch into a repo in a way where it grants you merge access? If you truly want to build this as an open system for others to reuse you should IMO avoid building in footguns :)

[DitherDude]

@Seldaek I think you are missing the purpose of vouch - it's meant to be a "filter" to instantly close AI PRs. It's not supposed to be fully-featured GH issue/PR moderation bot! AFAIK, vouchbot can only enable someone to open a PR(, not grant merge access to the repo; if you want control like this you may be looking for a different project).