this post was submitted on 24 Jul 2024
225 points (95.5% liked)

Open Source

31129 readers
404 users here now

All about open source! Feel free to ask questions, and share news, and interesting stuff!

Useful Links

Rules

Related Communities

Community icon from opensource.org, but we are not affiliated with them.

founded 5 years ago
MODERATORS
Cloak@lemmy.ml
kevincox@lemmy.ml
CrypticCoffee@lemmy.ml
Lettuceeatlettuce@lemmy.ml
225
Anyone can Access Deleted and Private Repository Data on GitHub (trufflesecurity.com)
submitted 3 months ago by communism@lemmy.ml to c/opensource@lemmy.ml
41 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] Asudox@lemmy.world 15 points 3 months ago (3 children)

Im thinking of self hosting Forgejo one day.

[–] Deckweiss@lemmy.world 13 points 3 months ago

I do and it is pretty easy with docker compose.

[–] explore_broaden@midwest.social 5 points 3 months ago

Does it treat forks differently?

[–] Aatube@kbin.melroy.org -1 points 3 months ago* (last edited 3 months ago) (2 children)

sourcehut is much better if you can pay

Edit: Only repo hosters need to pay. Everything else is free.

[–] Asudox@lemmy.world 15 points 3 months ago* (last edited 3 months ago) (1 children)

I want forgejo for its upcoming federation feature tbh.

[–] Slotos@feddit.nl -1 points 3 months ago (1 children)

Considering that git doesn’t need federation, and email is the grandfather of federation, sourcehut has a working version of it this very moment.

[–] Aatube@kbin.melroy.org 3 points 3 months ago (2 children)

Why the downvotes?

[–] nekusoul@lemmy.nekusoul.de 6 points 3 months ago (1 children)

I'd guess because the same argument could be made for the website you're on right now. Why use that when we could just use mailing lists instead?

More specifically: Sure, Git is decentral at its core, but all the tooling that has been built around it, like issue tracking, is not. Suggesting to go back to email, even if some projects still use it, isn't the way to go forward.

[–] Aatube@kbin.melroy.org 3 points 3 months ago (1 children)
  1. Git has bundled tooling to support pushing MRs to mailing lists.
  2. Email is existing infrastructure. I’m the kind of guy who hates the powerbanks solar route and prefer selling excess solar power to the grid instead. This also has the benefit on allowing you to customize your notifications from subscribed repositories however you like.
  3. The reason we’re not on a mailing list is because we have an extra feature mailing lists can’t offer: reacting, be that upvoting, downvoting, or bookmarking/boosting. Meanwhile, you don’t need that on a development forum. You do have editing, though. Hopefully everyone’s using a client that supports undo.
  4. IMO, the slower speed of email makes people think more before they send.
[–] nekusoul@lemmy.nekusoul.de 3 points 3 months ago* (last edited 3 months ago) (1 children)

I'm sorry to be blunt, but mailing lists just suck for group conversations and are a crutch that only gained popularity due to the lack of better alternatives at the time. While the current solutions also come with their own unique set of drawbacks, it's undeniable that the majority clearly prefers them and wouldn't want to go back. There's a reason why almost everyone switched over.

[–] Aatube@kbin.melroy.org 2 points 3 months ago* (last edited 3 months ago) (1 children)

Mailing lists offer everything needed for a discussion: sending words, threading discussion (that’s already better than every competitor!), and receiving words. All of this is done fast with modern email’s push syncing. Sure, it’s not instant messaging, but development discussions shouldn’t be chatty. Sure, it’s not good for voting, but one can and should just link to one of these online polling services that guarantee integrity instead.

[–] nekusoul@lemmy.nekusoul.de 3 points 3 months ago* (last edited 3 months ago) (2 children)

Technically you can do everything through email, because everything online can be represented as text. Doesn't mean you should.

PRs also aren't just a simple back and forth anymore: Tagging, Assignees, inline reviews, CI with checks, progress tracking, and yes, reactions. Sure, you can kinda hack all of that into a mailing list but at that point it's becoming really clunky and abuses email even more for something it was never meant to handle. Having a purpose-built interface for that is just so much nicer.

[–] Aatube@kbin.melroy.org 1 points 3 months ago

Why would you need to control these through a mailing list? The maintainers should have accounts (I don't see the point in federating maintainers instead of just discussion, especially when this is self-hostable), and only those with permissions should be setting up labels, assignees, inline reviews, and CI. And yes, sourcehut has a UI for this, though alternatives through email commands are also available.

And no, I do not see the point of reactions. If you really need a vote, use a voting service.

[–] Aatube@kbin.melroy.org 1 points 3 months ago

If you meant receive CI results... just send these via email? Every major platform (Gerrit, GitLab, GitHub, Gitea...) already does that for notifications IIRC.

[–] Slotos@feddit.nl 4 points 3 months ago

In the beginning the Universe was created. This has made a lot of people very angry and been widely regarded as a bad move.

[–] hedgehog@ttrpg.network 6 points 3 months ago (2 children)

What makes sourcehut better?

From a self-hosting perspective, it looks like much more of a pain to get it set up and to keep it updated. There aren’t even official Docker images or builds. (There’s this and the forks of it, but it’s unofficial and explicitly says it’s not recommended for prod use.)

[–] Aatube@kbin.melroy.org 3 points 3 months ago

It also supports browsing without JavaScript, if that's your thing.

[–] Aatube@kbin.melroy.org 2 points 3 months ago* (last edited 3 months ago)

Sourcehut has straightforward much better UI, UX, and features (more than gitea/forgejo but less than GitLab ig). I really dig the subdomain design.

Issues and PRs are conducted through email, essentially making that part federated and signup-less.

I’ve seen many pieces of software that claim to be beta/not used for prod but are actually bedrock solid.