Samuel
@samuel.fm
they put hacktoberfest on the blockchain
web3 is going just great@web3isgoinggreat.com· 27 Feb 2024tea.xyz causes a flood of spam pull requests to open source projects
February 26, 2024
https://www.web3isgoinggreat.com/?id=teaxyz-spam
![tea.xyz causes a flood of spam pull requests to open source projects
This crypto skeptic I've heard of once said "Show me the incentive and I will show you the outcome."
A project called tea.xyz promised people they could "get rewards for [their] open-source contributions", complete with a flashy website describing how it would "enhance the sustainability of open-source software". So far, it's achieved the exact opposite. Promising to reward open source contributors with crypto tokens, the project asked users to verify their access to open source projects by merging in a YAML file containing their crypto wallet address. This kicked off a flood of pull requests to prominent, often non-crypto-related open source projects by people who had never contributed to the project (or, often, any open source project), but who wished to merge in a file describing them as a "code owner".](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:ugyl6syayvsrvu5w4uxtlkz4/bafkreifvlhhljzleeftjriozwgfwjpjhjf5lwqv5qxlxiefdc4d7k7jthu "tea.xyz causes a flood of spam pull requests to open source projects
This crypto skeptic I've heard of once said \"Show me the incentive and I will show you the outcome.\"
A project called tea.xyz promised people they could \"get rewards for [their] open-source contributions\", complete with a flashy website describing how it would \"enhance the sustainability of open-source software\". So far, it's achieved the exact opposite. Promising to reward open source contributors with crypto tokens, the project asked users to verify their access to open source projects by merging in a YAML file containing their crypto wallet address. This kicked off a flood of pull requests to prominent, often non-crypto-related open source projects by people who had never contributed to the project (or, often, any open source project), but who wished to merge in a file describing them as a \"code owner\".")
![Particularly impacted by this project was the open source blogging platform Ghost, which was used as an example in the demo video released by tea.xyz, and which received several PRs of this kind. A somewhat flummoxed maintainer of the repository replied to one PR: "[I]n practice the TEA project is not helping to support the Ghost project, but is instead causing a rush of self-serving PRs to be submitted to cash-in on other people's work. ... This why people hate on crypto." A maintainer of another unrelated open source project called "ghost" also reported receiving an influx of spam PRs. This is not the first time crypto has generated massive Github spam, although another recent incident was (blessedly) mostly limited to open-source crypto projects and didn't waste the time of non-crypto-related projects as this one has.](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:ugyl6syayvsrvu5w4uxtlkz4/bafkreidyawvaxye75ujzfgro65zvcpslcfwhtrigy7jxilcnun7o6qicju "Particularly impacted by this project was the open source blogging platform Ghost, which was used as an example in the demo video released by tea.xyz, and which received several PRs of this kind. A somewhat flummoxed maintainer of the repository replied to one PR: \"[I]n practice the TEA project is not helping to support the Ghost project, but is instead causing a rush of self-serving PRs to be submitted to cash-in on other people's work. ... This why people hate on crypto.\" A maintainer of another unrelated open source project called \"ghost\" also reported receiving an influx of spam PRs. This is not the first time crypto has generated massive Github spam, although another recent incident was (blessedly) mostly limited to open-source crypto projects and didn't waste the time of non-crypto-related projects as this one has.")
