My thoughts on sponge's package/plugin approval process.

APPROVAL.md

Package Approval Process:

The package approval process, or otherwise known as the plugin approval process describes the process in which a package/plugin is submitted, reviewed, and released (aka- available for download).

My Proposal:

I see the best approach to be a mixed approach.

We must ensure we have a number of things cleared in order to have a successful approval process.

1. Protect against malicious code first and foremost
2. Protect against bots/spam
3. Find a way to be able to keep the approval team small but lighten the load on them
4. Find a way for the community to pitch in and help whenever they can
5. Find a medium between fast approval times and security

So let's run through this real quick in a couple of scenarios, shall we?

First Time Submission:

1. Submit my package/plugin
2. My request is shot into the bottom of the current queue in which the approval team is monitoring
3. An approval team member takes my 'ticket' (if you will), and reviews the code and determines whether it's safe or not
4. If it's safe, my package/plugin will be available for download and it will be permanently marked as officially safe and will not be open for ratings by other members and therefore this download is 100% guaranteed to be safe for anyone downloading.
5. Done!

Post-First Time Submission:

1. Submit my package/plugin
2. It is now instantly available for download and is open to peer review via the rating and comment system
3. Done!

Downloading:

1. Navigate to the package/plugin I wish to download
2. Choose the file I wish to download (whether it be a JAR/ZIP)
3. Click the link, and a notification will pop-up informing me that all downloads should be done at my discretion and that sponge and it's affiliates are not liable yada yada- link to details somewhere. If the download is not the users first, and it hasn't been marked as malicious or permanently malicious, it can be downloaded at your discretion. Although, if it is the users first download it must be approved (and if it is, security is guaranteed).
4. If downloadable, click "download" and you're done!

Package/Plugin Peer Review:

States:

• Officially Safe (An approval team member has reviewed this download and can guarantee it's security- it is not open to peer review as it's security has already been officially determined. This prevents users from trying to lock another's download for no reason)
• Safe (This means community members have rated this download as safe and is most likely okay to download, but be sure to see how many users have rated it as safe and compare that to how many said malicious- be smart!)
• Unrated
• Malicious (This means community members have rated it as malicious, at this point the download is auto-locked and put in a queue in which the approval team will have to review it. During this period, no one can review it ie: rate the download. Once reviewed there are only 2 out-comes: officially safe, or officially malicious)
• Officially Malicious (An approval team member has marked it as malicious and the download will be locked along with any submissions from the project, preventing users from downloading the package/plugin and the author(s) from submitting new versions).

PROS:

• Faster approval times
• Higher rate of community interaction and involvement (meaning more man-power to pull from in tandem with the official team)
• Lessen the load on those that are part of the official approval team
• Frequent uploaders can build their own trust with those who download simply via a peer rating system

CONS:

• Still involves manual labour
• Contains a window in which malicious code can actually effect unaware users (although a warning can/should combat this)