Trust models under strain as volume stops meaning legitimacy

Open projects once treated sustained contribution volume as a rough proxy for legitimacy. That proxy is breaking. In the same stretch of weeks, Chromium replaced a ten-patch committer bar with a three-vouch trust gate, Linux kernel maintainers told a security-patch author to drop an alias for a real name, IETF participants floated web-of-trust and shepherd models against a flood of AI-generated Internet-Drafts, and an Ethereum Magicians thread on a tapered issuance burn filled with deletions and accusations of sock puppets. The shared question is not whether openness still matters. It is how anyone authenticates a stranger when patches, drafts, and forum posts have become cheap to generate and expensive to trust.

Chromium made the shift explicit. Nico Weber announced that the old requirement of ten or more landed changes is gone for new committers. “Committer status will be treated as a security and community trust mechanism rather than a measure of historical contribution.” Three vouches now suffice, and at least one must come from someone who is an OWNER somewhere in the tree. Vouching, Weber wrote, means personal accountability for mentoring on community standards and code-of-conduct compliance. Organizational coworkers can vouch on the basis of shared employment and aligned intent; others can vouch from personal relationships, often built at conferences or over repeated video calls. OWNERS review still guards code correctness. Committer status itself is being redefined as trusted access, not proven craft.

Not everyone was convinced the craft signal should disappear. Christian Biesinger argued the project should not grant committer status “without a single CL,” because landing work still shows that someone “understands the process, addressed review comments, and successfully landed a CL.” Dirk Pranke agreed that multiple changes demonstrate both technical fluency with tools and the commit queue and social fluency with feedback. “I worry a bit that relying just on personal connections gives you little insight into how well you'd work with team members you don't know,” he wrote, while conceding the project long ago outgrew the possibility of knowing more than a tiny subset of people. Weber restated the design intent: committer no longer means “knows how to write code and to work in Chromium.” A vouch can mean proximity and accountability (“I sit in trout throwing distance from them, and I have a trout”) or observed good work without supervision. Allan Felipe Murara welcomed the lowering of the gate in sharper terms, writing that “the war is on” and that a community should be “voices, participants, not symbols and ‘Meritocraticly earned badge.’” The tension inside Chromium is therefore not whether trust matters, but whether process competence can be fully outsourced to OWNERS while commit bits become pure social vouching.

The Linux kernel thread on trusted-keys TPM fixes showed a different face of the same demand. Patches addressed a missing bounds check before a memcpy of a TPM-derived blob size and the silent acceptance of unauthenticated TPM response tags that skipped HMAC verification. The technical substance was ordinary defensive hardening: reject oversized stored sizes, stop treating an unauthenticated response tag as success. Review turned quickly to identity. Greg Kroah-Hartman wrote, “And we need a real name please, not an alias.” Jarkko Sakkinen asked the same: “If by any means possible, use your real name here.” Sakkinen also pushed back on commit-message “threat scenario role play,” wanting the change described without speculative attacker narratives. The contributor complied under a legal name and kept asking about CVE assignment; maintainers pointed at process docs and continued to police format and framing. Here trust is not three vouches. It is a durable, attributable human identity attached to security-sensitive code, even when the diff itself is small and the reporter is also the author.

At the IETF the pressure is volume plus synthetic text. Independent Internet-Draft submissions have spiked. Ross Finlayson said “this is getting out of hand” and urged the community to treat the problem “as a problem akin to spam,” floating (then disclaiming) bonds and separate announce lists so people can mute the independent firehose. Lars Eggert argued the AI contribution wave is permanent and that tooling and rate limits are at best stopgaps. The deeper cost shift matches open source: generation is cheap, review is not. Eggert’s personal adaptation is revealing: he will be “quicker to ignore or disregard new contributions from folks I have not had a history with, unless maybe I see someone else I do have a history with meaningfully engage.” Andrew Yourtchenko sketched shaping a -00 rate limiter into “a web-of-trust form,” with one free independent draft per account and further drafts needing a shepherd already involved in IETF work. Carsten Bormann proposed datatracker support for weighted “commendations,” private per-viewer scores built from authorship and leadership history, so attention can be sorted without a single public reputation number. The risk, Eggert and others noted, is that genuine newcomers drown in noise precisely when the institution reaches for history-based filters.

Ethereum Magicians supplied the social-failure mode. Discussion of EIP-XXXX (Tapered Issuance Burn), a partial burn of validator rewards aimed at shaping the staking ratio and preserving a reserve of unstaked ETH as a neutrality counterweight, ran to hundreds of posts. Authors had to keep restating that the work was independent of the Ethereum Foundation. Technical arguments about coercion versus malicious self-destruction, operator concentration versus aggregate stake, and whether unstaked ETH really functions as recovery capital sat beside personal attacks and accounts removed as sock puppets. When identity is cheap to mint, even a policy debate about issuance and censorship resistance becomes a contest over which voices are real.

The through-line is consistent. Contribution counts, anonymous handles, and open submission queues once scaled community growth because faking sustained good work was hard. Model-assisted text, throwaway identities, and low-cost patches invert the economics: the scarce resource is reviewer attention and confidence that the human on the other side will still be answerable next month. Chromium answers with explicit vouching and personal accountability. Kernel maintainers answer with real names on security work. IETF participants reach for shepherds, commendation weights, and history-gated attention. Forum governance discovers that sock puppets can exhaust legitimacy faster than argument can restore it.

What remains unresolved is the admission price for the next stranger with a real fix or a real idea. Pure vouching and web-of-trust structures can close the door that volume-based merit left ajar, recreating the insider networks large projects already struggle to see past. Pure anonymity and metric gates invite floods that burn out the people who still do careful review. No project in this set has a stable synthesis, only local patches to a trust model that no longer matches the cost of appearing to contribute.