I keep basically all of my shit on Gitlab, so depending on who they sell it to, that might be a goodbye. I've really enjoyed the platform, but if it goes into hands of either some clueless business people, data aggregator, or "AI-first" bullshit, i'm migrating to something else.
I'm in the same boat. I migrated all my stuff to Gitlab the day it was announced that Github was being acquired by Microsoft. I hadn't even really heard of Codeberg at the time. So I migrated to Gitlab.
And it sounds now like there's a high likelikhood I'll need to move it all again.
I hadn’t even really heard of Codeberg at the time.
I've had my stuff on Gitlab way before that ever even happened, just because I've already had issues with the platform before, and knew it would eventually change hands. Shame it'll likely happen again with this too
Come to Codeberg! I'm a member of the co-op and we're not for sale.
I've been casually taking a look at it for a bit, so it's definitely on the radar
Edit: Overall i’m happy, at first proper glance, but not having access to even barebones CI is kind of a pain. I can’t really deploy my own at the moment, and having to request access to their own Woodpecker instance is something that seems unlikely to be approved
Codeberg is where I will be next. A nonprofit ownership created because they didn't like the commercialization of other providers that's getting more and more popular. Seems like they likely won't go down this rabbit hole.
You shouldn't wait because it's going to happen. I moved all of my projects off of Github and Gitlab, and now self-hosting my own gitea instance. It's been great and never looked back!
Btw gitea has been involved in some shit, most of the Devs quit and created Forgejo. AFAIK you can seamlessly switch from gitea without needing to completely reset it.
Oh wow, I didn't know that! Is there any official statement? Search didn't turn up anything. I guess I don't necessarily need to know exactly how it went down, but I wanna be nosy. :D
I actually have an account on there with almost nothing, just my nix configuration, plus a repo I cloned to commit a bug fix on software I used. But it seemed like the most responsible solution as in the price is reasonable, plus I actually like the interface. Codeberg also looks good and claims to be better in some regards, but these are the only choices nowadays.
Anyhow, I'm still waiting for Pijul to have a final 1.0 release and independent hosting solutions to appear.
Same here. Gitlab CI was a game-changer for me, too. Any thoughts on where else you’d consider going? Aside from GitHub, that is.
I suspect that in the worst case scenario, i'll be moving stuff to Codeberg and hosting my own CI to support it
It's funny because despite all the fearmongering about Microsoft's Github acquisition it feels like it only improved since then, while Gitlab has done a shitton of questionable and shitty decisions, a ton of critical security issues and in general feels like (at best) they don't know what they are doing.
The only thing Gitlab has going for itself is that it's self-hostable, but they still retain a large amount of control.
GitLab has been working on support for ActivityPub/ForgeFed federation as well, currently only implemented for releases though.
Absolutely.
I'll self host my own forgejo instance soon.
It’s also what codeberg uses under the hood for those that don’t self host.
For code hosting, doesn't that just mean you're self-hosting + others can utilize you space for a backup?
I think the benefits of federation is discoverability. I can spin up my gitea or forgejo (or something else!) Instance, but when people look for code in their instances, they can still discover my public repositories, and if they want to contribute, they can fork and open PRs from their instances.
So yeah, it means mostly you can selfhost and provide space to others, but with the same benefits that right now github offers (I.e., everything is there).
No, it means people can contribute issues and pull requests to projects on other servers. Repositories would only be created on the server your account is on if I'm not mistaken. I believe it uses activitypub internally, so should work the same as Lemmy/mastodon.
Yes, it uses ActivityPub with the ForgeFed extension.
Maybe you would be able to disable other users from creating repos.
The chances of a deal are said to be weeks away, if not non-existent.
What kind of non-sentence is that?
It's an existing sentence if it's not non-exisent.
Big if true and big.
Seems like a perfectly cromulent English sentence to me.
Looked up "cromulent" in the dictionary. Wasn't disappointed!!
The fact it's now in the dictionary proper is bizarre... but I mean... so is "okay." And that's almost the same ascended joke.
It's what they most not the least
The kind of sentence you write when you're still 20 words from the target your editor set for the article
The chances of the coin flip yielding heads are roughly 50%, if coins don't not exist.
It means when the author was waiting for his order at Popeyes, the guy in front who did small talk with him introduced himself as a Gitlab employee and told the author "Gitlab might sell in weeks. It is a deal or no deal"
It feels like it's saying "if rumors are true, the deal is weeks away." A reminder that it might not be the case.
Fuck
I literally made an account the day before and transferred from GitHub, then wake up and see this. FFS just my luck.
Wait, this is YOUR fault?!! 😋
Codeberg!
Does Codeberg have anything like Gitlab CI, or does it need to be paired with other build tools like Jenkins, TeamCity, etc?
In summary, it needs to be a public repo with FOSS code and the README must match the project's intended goal.
You should all incorporate and buy it.
I feel like sourcehut really ought to be mentioned more. It federates issue and PRs by email and has a wonderful interface while not having any ads—which is why hosting one's own repo (and their CI and IRC but nothing else) requires $2 a month, unfortunately.
I don't think it makes any sense to mention source hut because none of the features you mentioned are killer features (or relevant. Why should I care about implementation details of feature tracking?) and it completely fails to address GitLab's main value proposition: it's CICD system.
Anyone can put up any ticketing system. They are a dime a dozen. Some version control systems even ship with their own. CICD is a whole different ballgame. It's very hard to put together a CICD system that's easy to manage and has a great developer experience. Not even GitHub managed to pull that off. GitLab is perhaps the only one who pulled this off. A yams file with a dozen or so lines is all it takes to get a pipeline that builds, tests, and delivers packages, and it's easy to read and understand what happens. On top of that, it's trivial to add your own task runners hosted anywhere in the world, in any way you'd like. GitLab basically solved this problem. That's why people use it.
I use gitlab ci mainly and dabble in github actions. Can you clarify how “Not even Github managed to pull that off”? IIRC, actions is quite featureful and it’s open-source, so I assume that can be run with self-hosted runners as well.
Yep, at my previous job I moved a pretty complex build system from Jenkins to github actions. It worked fine and was much simpler to maintain.
And yes there are ways to run github actions on your own machine, but I haven't tried it.
Can you clarify how “Not even Github managed to pull that off”?
GitHub actions has an atrocious user experience, to the point that even a year or so ago people where doubting it was production-ready.
Sure, you can put together a pipeline. But I challenge anyone to try it out with GitHub actions and then just try to do the same with GitLab or even CircleCI or Travis.
The fact that people compare GitHub Actions go Jenkins of all things is everything anyone needs to know about it's user experience.
Using email for anything is a non-feature for me. I want nothing to do with that outdated, confusing piece of tech that has been shoved in all sorts of places it doesn't belong
FYI you can self-host GitLab, for example in a Docker container.
Or you could make your life a lot easier and use Forgejo
You can also just make bare got repositories on any server you can ssh into.
make bare got repositories
got it
Coincidentally, this is what git is short for.
Source: "git" can mean anything, depending on your mood.
Gitlab is very complex and a heavy resource hog. You probably don't need it. Most small to medium enterprises can comfortably host their projects on lightweight forgejo or gitea (speaking from experience). They even have functionality similar to github actions. If you need anything more complex, you are better off integrating another self hosted external service to the mix.
In my experience the other alternatives tend to lack solid CI integration. I have yet to find an open source alternative as good as Gitlab's.
GitLab still doesn't even support leaving comments on a commit message. Like, what? GitLab and GitHub have all these fancy shiny features but still suck at offering basic code review functionality.
I never understood the appeal.
I mean, I get it, but that's also not a thing of git, right? Just because GitHub does something doesn't mean every other hosting provider needs to. If your code review process is to comment upon specific commits, maybe it's the code review process that's wrong?
GitHub doesn't let you comment on the commit message either. The only one I've seen do this properly this is Gerrit. And of course regular old mailing list reviews.
There are so many blogs and posts about writing good commit messages, using Conventional Commits, etc, and the two most popular forges don't even let you comment in-line on the commit message during a review.
Ohhhhh you can't comment on a specific line of a commit message. I see. I mean... yeah I guess not. That seems like a super niche feature though. How long are your commit messages? I've never even tried to do that. Commit messages are short enough you can pretty much just write a normal message not tied to a specific line.
There are waaaaay bigger issues with Gitlab. Here's one I ran into recently, you can't search for pipelines. It's got a search box and everything but you literally can't search; only filter. So stupid.
Still, overall it's the best self-hostable option out there at the moment IMO. I guess Forgejo (truly abysmal name) may overtake it at some point.
Ive been meaning to move to codeberg, self hosted forgejo, or sourcehut so this will only accelerate that if things get worse.
I just flipped my home git to forgejo from gitlab, gitlab just had a bunch of features I wasn't using, forgejo was easy to setup and it has a nice interface. I'm just using it for source control right now, still probably huge overkill but eh
How did you set it up? I've been wanting to setup forgejo in a docker container but wasn't sure how easy the process is.
I was originally going to to go the docker route but honestly just ended up going the binary route and leaving it using sqlite as it's good enough for now. It's pretty well documented and a chunk of the prereqs I already had, like the git user creation.
Did have SSH auth issues though, probably becauae I didn't fully cleanup after uninstalling gitlab (oops), had them in parallel for a bit to migrate the repos, gitlab had it trying to use gitlab-shell which didn't exist anymore. Probably a better/proper solution but what worked was changing the git user's home directory back to /home/git as gitlab had it using a gitlab config directory. I welcome anyone giving me a better/cleaner solution for this, on my to do list to do some more cleanup.
I preemptively moved to codeberg, very nice and pro IMO.
The only "downside" about Codeberg is that (for the most part) you're only allowed to host projects that as FOSS or projects you intend to make FOSS. (Stuff like personal notes and config files are fine too.)
Love me some codeberg.
An other one bites the dust :'(
Don’t worry everyone! It’ll get bought by some investment firm or by a large company (Microsoft [to shutter it], Google, etc) and everything will be just fine.
Right?
sigh
GitLab is a security nightmare, good luck to whoever purchases that.
Could you elaborate? I use Gitlab bit i'm not a security expert.
As if that isn't bad enough, I am pretty sure they have had other incidents.
I used to host a Gitlab instance at work. It was dog slow so I started digging into it and discovered they had a serious memory leak in some of their "unicorns," aka Ruby tasks. Instead of fixing the source of the leak they tacked on a "unicorn killer" that periodically killed tasks. The tasks were supposed to be atomic anyway, so this is technically fine (and maybe a good thing in the long run for correctness a la Netflix's Chaos Monkey) but I found myself kind of disgusted by the solution. I dropped it and went for a much sparser Git repo web server.
lmao! Man that's hilarious!
"We have a memory leak that could lead to a security issue.We should do something about it."
"I made a process that periodically kills those tasks. No one will notice the problem now."
The unicorn killer will have a memory leak as well. 💀
I don't think memory leaks could ever amount to a security vulnerability, but it just feels yucky. I guess I shouldn't cast stones, I write C++ at work.
I don’t think memory leaks could ever amount to a security vulnerability
In theory it could, after all there are technically denial-of-service vulnerabilities (not DoS/DDoS attacks, that is something different) according to CVE Numbering Athorities.
Maybe I'm misunderstanding you, but DoS is exactly the same thing as "denial of service".
My point is that memory leaks can only degrade availability; they are categorically distinct from security vulnerabilities.
I think you might be misunderstanding me.
According to the CVE Numbering Athorities, there can be vulnerabilities that result in service being denied, and they refer to them as a denial-of-service vulnerability. For example, there can be a bug in a program that causes it to crash if you perform a certain set of steps/actions, thus resulting in the service being denied. Whereas traditionally, a DoS/DDoS attack is simply flooding a target with more bandwidth than they have available downstream bandwidth. Sending massive amounts of data to overwhelm a service is not the same thing as finding a unique set of actions to cause the program to crash.
So in theory, yes, a memory leak could amount to and result in a security vulnerability, like if the memory leak is reproducible and so severe it causes a service to crash.
Aha, I didn't realize compromising availability was sufficient for the CVE definition of security vulnerability. Projects I've worked on have typically excluded availability, though that may not be the norm.
And I see your point about some exploits being highly asymmetric in the attacker's favor, compared to classic [D]DoS.
That's disappointing. They are pretty consistently choosing the wrong thing. I don't think they know what they're doing.
Unicorn killer does sound great for testing. If they wrote tests around anything I'd be surprised, though. LOL.
If you don't need all the user management and whatever else it definitely doesn't make sense to run their junk.
They do have a ton of tests actually. In their defence, if this task is doing Git things then just killing it when it goes badly is probably the best you can do. Git itself is quite buggy if you stray from the most basic setup. I've had it almost completely destroy my .git directory in the past when using submodules.
On the other hand, Gitlab itself is an enormous entirely untyped Ruby monster, with extremely difficult to follow code. Not in terms of individual functions - except for the lack of types mean you can't really know what they do, they are quite clear and well written. The issue is the control flow between parts of the system. It's difficult to know what calls what, so I'm not surprised they occasionally have to give up.
I had a play with Deno's Fresh web framework recently (Typescript/TSX but mainly server rendered). IMO it's light years ahead of other solutions.
You get full amazing Typescript typing, including in templates (unlike Go for example), but unlike React you don't have to deal with JavaScript tooling or complex client side state management. It's a real breath of fresh air. (Ha that wasn't even intentional.)
Elon has entered the chat....how many labs of this git kind can you make for him within 3 months? Can git be somehow monetized?
I thought github is worse than gitlab in terms of security
Could be! But that doesn't excuse a massive security failure like sending password reset emails to attacker-supplied addresses. I am pretty sure they have had other large failures.
They are writing code with zero/negative regard for security and that makes me want to use any alternative FOSS git host.
Gitea
Fuck. No other source forge supports groups or orgs with hierarchical projects 🫤 Gitea and Forgejo went hard on being github clones, so they're off the list. Are there any other alternatives? I don't want to have to bash together scripts to make something...
It’s not a dealbreaker for me but I feel your pain. Getting everything organized in Gitlab is a pleasure.
I looked into it after this year's massive price hike... There's no meaningful alternative. We're on the FOSS version of GitLab now (GitLab-CE), but the lack of code ownership / multiple reviewers / etc. is a real pain and poses problems with accountability.
Honestly there are not that many features in Gitlab EE that are truly necessary for a corporate environment, so a GitLab-CE fork may be able to set itself apart by providing those. To me there are two hurdles:
Legal uncertainties (do we need a clean room implementation to make sure Gitlab Inc doesn't sue for re-implementing the EE-only features into a Gitlab fork?)
The enormous complexity of the GitLab codebase will make any fork, to put it mildly, a major PITA to maintain. 2,264 people work for GitLab FFS (with hundreds in dev/ops), it's indecent.
Honestly I think I'd be happy if forgejo supported gitlab-runner, that seems like a much more reasonable ask given the clean interface between runner and server. Maybe I should experiment with that...
I would like to say I'm not too concerned by this personally, as long as all their data remains public to all.
So.. just to repeat myself for the 300th time
This is a good example of why people use GitHub
Because it's an advantage that it's hosted by a large company like Microsoft. There's very little chance it's going to be shut down or sold off. So developers don't need to worry about their infrastructure as much
One of our projects failed because we got caught up in infrastructure.
It's funny though how the people who are the most vocal against GitHub aren't responding to this post. But they're happy to make the biggest deal about every little button on it....
Just cause something is owned by a big company doesn't mean it'll last forever, example Google and their dead list of products.
Host gitea or forjeo if you really care about your infrastructure and data. If you can't, make some compromises and pick the next best thing. But owned by big company doesn't mean lasts forever.
Github is probably the biggest code hosting platform. There is literally no evidence that Microsoft will discontinue it.. And they've spent a huge amount of time integrating it. It also generates 1 billion in revenue, so why would Microsoft sell it? Furthermore, its free for open source..
Self hosting is part of the reason our project failed.. We wasted a lot of time with that stuff. We used Mercurial, whatever the Canonical one was, and git, and we wasted a lot of time.
Github works, and is well integrated to everything
Just pointing out that just cause its owned by a big company doesn't mean it'll last forever.
Also the FOSS community is by in large sus of Microsoft cause of their history practice of embrace, extend, extinguish. Which one would argue they embraced FOSS to gain easy access to their projects, the issues, the code, etc to train their models. Which would be OK if all code it generates has to be GPL to agree with the licenses of the collective pool of training data. Either way that's the topic of debate.
It sounds like you looked into your constraints and github works for you. That's great! And that's what's important.
And Microsoft wouldn't fuck up with GitHub? Or sell it to god.onows who? You sure about that?
Gitlab is at least open source, I can host it myself
I keep basically all of my shit on Gitlab, so depending on who they sell it to, that might be a goodbye. I've really enjoyed the platform, but if it goes into hands of either some clueless business people, data aggregator, or "AI-first" bullshit, i'm migrating to something else.
I'm in the same boat. I migrated all my stuff to Gitlab the day it was announced that Github was being acquired by Microsoft. I hadn't even really heard of Codeberg at the time. So I migrated to Gitlab.
And it sounds now like there's a high likelikhood I'll need to move it all again.
Codeberg didn't exist back then yet.
That would explain it.
I've had my stuff on Gitlab way before that ever even happened, just because I've already had issues with the platform before, and knew it would eventually change hands. Shame it'll likely happen again with this too
Come to Codeberg! I'm a member of the co-op and we're not for sale.
I've been casually taking a look at it for a bit, so it's definitely on the radar
Edit: Overall i’m happy, at first proper glance, but not having access to even barebones CI is kind of a pain. I can’t really deploy my own at the moment, and having to request access to their own Woodpecker instance is something that seems unlikely to be approved
Codeberg is where I will be next. A nonprofit ownership created because they didn't like the commercialization of other providers that's getting more and more popular. Seems like they likely won't go down this rabbit hole.
You shouldn't wait because it's going to happen. I moved all of my projects off of Github and Gitlab, and now self-hosting my own gitea instance. It's been great and never looked back!
Btw gitea has been involved in some shit, most of the Devs quit and created Forgejo. AFAIK you can seamlessly switch from gitea without needing to completely reset it.
Oh wow, I didn't know that! Is there any official statement? Search didn't turn up anything. I guess I don't necessarily need to know exactly how it went down, but I wanna be nosy. :D
From their FAQ
For now; Forgejo is hard forking, which may break things soon.
come to https://sr.ht/
I actually have an account on there with almost nothing, just my nix configuration, plus a repo I cloned to commit a bug fix on software I used. But it seemed like the most responsible solution as in the price is reasonable, plus I actually like the interface. Codeberg also looks good and claims to be better in some regards, but these are the only choices nowadays.
Anyhow, I'm still waiting for Pijul to have a final 1.0 release and independent hosting solutions to appear.
Same here. Gitlab CI was a game-changer for me, too. Any thoughts on where else you’d consider going? Aside from GitHub, that is.
I suspect that in the worst case scenario, i'll be moving stuff to Codeberg and hosting my own CI to support it
It's funny because despite all the fearmongering about Microsoft's Github acquisition it feels like it only improved since then, while Gitlab has done a shitton of questionable and shitty decisions, a ton of critical security issues and in general feels like (at best) they don't know what they are doing.
The only thing Gitlab has going for itself is that it's self-hostable, but they still retain a large amount of control.
Time to federate repos?
https://forgejo.org/
I hope they get true federation up running soon.
GitLab has been working on support for ActivityPub/ForgeFed federation as well, currently only implemented for releases though.
Absolutely.
I'll self host my own forgejo instance soon.
It’s also what codeberg uses under the hood for those that don’t self host.
For code hosting, doesn't that just mean you're self-hosting + others can utilize you space for a backup?
I think the benefits of federation is discoverability. I can spin up my gitea or forgejo (or something else!) Instance, but when people look for code in their instances, they can still discover my public repositories, and if they want to contribute, they can fork and open PRs from their instances.
So yeah, it means mostly you can selfhost and provide space to others, but with the same benefits that right now github offers (I.e., everything is there).
No, it means people can contribute issues and pull requests to projects on other servers. Repositories would only be created on the server your account is on if I'm not mistaken. I believe it uses activitypub internally, so should work the same as Lemmy/mastodon.
Yes, it uses ActivityPub with the ForgeFed extension.
Maybe you would be able to disable other users from creating repos.
What kind of non-sentence is that?
It's an existing sentence if it's not non-exisent.
Big if true and big.
Seems like a perfectly cromulent English sentence to me.
Looked up "cromulent" in the dictionary. Wasn't disappointed!!
The fact it's now in the dictionary proper is bizarre... but I mean... so is "okay." And that's almost the same ascended joke.
It's what they most not the least
The kind of sentence you write when you're still 20 words from the target your editor set for the article
The chances of the coin flip yielding heads are roughly 50%, if coins don't not exist.
It means when the author was waiting for his order at Popeyes, the guy in front who did small talk with him introduced himself as a Gitlab employee and told the author "Gitlab might sell in weeks. It is a deal or no deal"
It feels like it's saying "if rumors are true, the deal is weeks away." A reminder that it might not be the case.
Fuck
I literally made an account the day before and transferred from GitHub, then wake up and see this. FFS just my luck.
Wait, this is YOUR fault?!! 😋
Codeberg!
Does Codeberg have anything like Gitlab CI, or does it need to be paired with other build tools like Jenkins, TeamCity, etc?
Yes, but you need to manually request it and there are a handful of things that need to be true. See here for them all: https://codeberg.org/Codeberg-e.V./requests#woodpecker-ci
In summary, it needs to be a public repo with FOSS code and the README must match the project's intended goal.
You should all incorporate and buy it.
I feel like sourcehut really ought to be mentioned more. It federates issue and PRs by email and has a wonderful interface while not having any ads—which is why hosting one's own repo (and their CI and IRC but nothing else) requires $2 a month, unfortunately.
I don't think it makes any sense to mention source hut because none of the features you mentioned are killer features (or relevant. Why should I care about implementation details of feature tracking?) and it completely fails to address GitLab's main value proposition: it's CICD system.
Anyone can put up any ticketing system. They are a dime a dozen. Some version control systems even ship with their own. CICD is a whole different ballgame. It's very hard to put together a CICD system that's easy to manage and has a great developer experience. Not even GitHub managed to pull that off. GitLab is perhaps the only one who pulled this off. A yams file with a dozen or so lines is all it takes to get a pipeline that builds, tests, and delivers packages, and it's easy to read and understand what happens. On top of that, it's trivial to add your own task runners hosted anywhere in the world, in any way you'd like. GitLab basically solved this problem. That's why people use it.
I use gitlab ci mainly and dabble in github actions. Can you clarify how “Not even Github managed to pull that off”? IIRC, actions is quite featureful and it’s open-source, so I assume that can be run with self-hosted runners as well.
Yep, at my previous job I moved a pretty complex build system from Jenkins to github actions. It worked fine and was much simpler to maintain.
And yes there are ways to run github actions on your own machine, but I haven't tried it.
GitHub actions has an atrocious user experience, to the point that even a year or so ago people where doubting it was production-ready.
Sure, you can put together a pipeline. But I challenge anyone to try it out with GitHub actions and then just try to do the same with GitLab or even CircleCI or Travis.
The fact that people compare GitHub Actions go Jenkins of all things is everything anyone needs to know about it's user experience.
Using email for anything is a non-feature for me. I want nothing to do with that outdated, confusing piece of tech that has been shoved in all sorts of places it doesn't belong
FYI you can self-host GitLab, for example in a Docker container.
Or you could make your life a lot easier and use Forgejo
You can also just make bare got repositories on any server you can ssh into.
got it
Coincidentally, this is what git is short for.
Source: "git" can mean anything, depending on your mood.
https://github.com/git/git/commit/e83c5163316f89bfbde7d9ab23ca2e25604af290
It's the worst example, but it's an example, sure.
Much like that comment. Can you give a better example, or express why it's a bad example? That would bring some quality in.
https://forgejo.org/ here's a little better example, though you did a great job doing some proposal, gotta love those who do at least some initiative
Forgejo is a gitea fork, it's got nothing to do with gitlab
Gitlab is very complex and a heavy resource hog. You probably don't need it. Most small to medium enterprises can comfortably host their projects on lightweight forgejo or gitea (speaking from experience). They even have functionality similar to github actions. If you need anything more complex, you are better off integrating another self hosted external service to the mix.
In my experience the other alternatives tend to lack solid CI integration. I have yet to find an open source alternative as good as Gitlab's.
GitLab still doesn't even support leaving comments on a commit message. Like, what? GitLab and GitHub have all these fancy shiny features but still suck at offering basic code review functionality.
I never understood the appeal.
I mean, I get it, but that's also not a thing of git, right? Just because GitHub does something doesn't mean every other hosting provider needs to. If your code review process is to comment upon specific commits, maybe it's the code review process that's wrong?
GitHub doesn't let you comment on the commit message either. The only one I've seen do this properly this is Gerrit. And of course regular old mailing list reviews.
There are so many blogs and posts about writing good commit messages, using Conventional Commits, etc, and the two most popular forges don't even let you comment in-line on the commit message during a review.
Git kinda has it? Have you seen git notes? https://git-scm.com/docs/git-notes
You can leave comments on a commit message. What do you mean exactly?
You can not highlight text in a commit message and leave an in-line comment in the same way you can for code changes in the diff.
Edit: https://gitlab.com/gitlab-org/gitlab/-/issues/19691
Ohhhhh you can't comment on a specific line of a commit message. I see. I mean... yeah I guess not. That seems like a super niche feature though. How long are your commit messages? I've never even tried to do that. Commit messages are short enough you can pretty much just write a normal message not tied to a specific line.
There are waaaaay bigger issues with Gitlab. Here's one I ran into recently, you can't search for pipelines. It's got a search box and everything but you literally can't search; only filter. So stupid.
I actually just went to take a look at Gitlab issues I have commented on to see what my worst ones are. Guess what.... you can't even search for issues you have commented on!!!
Still, overall it's the best self-hostable option out there at the moment IMO. I guess Forgejo (truly abysmal name) may overtake it at some point.
Ive been meaning to move to codeberg, self hosted forgejo, or sourcehut so this will only accelerate that if things get worse.
I just flipped my home git to forgejo from gitlab, gitlab just had a bunch of features I wasn't using, forgejo was easy to setup and it has a nice interface. I'm just using it for source control right now, still probably huge overkill but eh
How did you set it up? I've been wanting to setup forgejo in a docker container but wasn't sure how easy the process is.
I was originally going to to go the docker route but honestly just ended up going the binary route and leaving it using sqlite as it's good enough for now. It's pretty well documented and a chunk of the prereqs I already had, like the git user creation.
Did have SSH auth issues though, probably becauae I didn't fully cleanup after uninstalling gitlab (oops), had them in parallel for a bit to migrate the repos, gitlab had it trying to use gitlab-shell which didn't exist anymore. Probably a better/proper solution but what worked was changing the git user's home directory back to /home/git as gitlab had it using a gitlab config directory. I welcome anyone giving me a better/cleaner solution for this, on my to do list to do some more cleanup.
I preemptively moved to codeberg, very nice and pro IMO.
The only "downside" about Codeberg is that (for the most part) you're only allowed to host projects that as FOSS or projects you intend to make FOSS. (Stuff like personal notes and config files are fine too.)
Love me some codeberg.
An other one bites the dust :'(
Don’t worry everyone! It’ll get bought by some investment firm or by a large company (Microsoft [to shutter it], Google, etc) and everything will be just fine.
Right?
sigh
GitLab is a security nightmare, good luck to whoever purchases that.
Could you elaborate? I use Gitlab bit i'm not a security expert.
Here is the one where I decided to never trust their code: https://arstechnica.com/security/2024/05/0-click-gitlab-hijacking-flaw-under-active-exploit-with-thousands-still-unpatched/
As if that isn't bad enough, I am pretty sure they have had other incidents.
I used to host a Gitlab instance at work. It was dog slow so I started digging into it and discovered they had a serious memory leak in some of their "unicorns," aka Ruby tasks. Instead of fixing the source of the leak they tacked on a "unicorn killer" that periodically killed tasks. The tasks were supposed to be atomic anyway, so this is technically fine (and maybe a good thing in the long run for correctness a la Netflix's Chaos Monkey) but I found myself kind of disgusted by the solution. I dropped it and went for a much sparser Git repo web server.
lmao! Man that's hilarious!
"We have a memory leak that could lead to a security issue.We should do something about it."
"I made a process that periodically kills those tasks. No one will notice the problem now."
The unicorn killer will have a memory leak as well. 💀
I had to look it up to check my memory. Yup! https://about.gitlab.com/blog/2015/06/05/how-gitlab-uses-unicorn-and-unicorn-worker-killer/
I don't think memory leaks could ever amount to a security vulnerability, but it just feels yucky. I guess I shouldn't cast stones, I write C++ at work.
In theory it could, after all there are technically denial-of-service vulnerabilities (not DoS/DDoS attacks, that is something different) according to CVE Numbering Athorities.
Maybe I'm misunderstanding you, but DoS is exactly the same thing as "denial of service".
My point is that memory leaks can only degrade availability; they are categorically distinct from security vulnerabilities.
I think you might be misunderstanding me.
According to the CVE Numbering Athorities, there can be vulnerabilities that result in service being denied, and they refer to them as a denial-of-service vulnerability. For example, there can be a bug in a program that causes it to crash if you perform a certain set of steps/actions, thus resulting in the service being denied. Whereas traditionally, a DoS/DDoS attack is simply flooding a target with more bandwidth than they have available downstream bandwidth. Sending massive amounts of data to overwhelm a service is not the same thing as finding a unique set of actions to cause the program to crash.
So in theory, yes, a memory leak could amount to and result in a security vulnerability, like if the memory leak is reproducible and so severe it causes a service to crash.
Aha, I didn't realize compromising availability was sufficient for the CVE definition of security vulnerability. Projects I've worked on have typically excluded availability, though that may not be the norm.
And I see your point about some exploits being highly asymmetric in the attacker's favor, compared to classic [D]DoS.
That's disappointing. They are pretty consistently choosing the wrong thing. I don't think they know what they're doing.
Unicorn killer does sound great for testing. If they wrote tests around anything I'd be surprised, though. LOL.
If you don't need all the user management and whatever else it definitely doesn't make sense to run their junk.
They do have a ton of tests actually. In their defence, if this task is doing Git things then just killing it when it goes badly is probably the best you can do. Git itself is quite buggy if you stray from the most basic setup. I've had it almost completely destroy my .git directory in the past when using submodules.
On the other hand, Gitlab itself is an enormous entirely untyped Ruby monster, with extremely difficult to follow code. Not in terms of individual functions - except for the lack of types mean you can't really know what they do, they are quite clear and well written. The issue is the control flow between parts of the system. It's difficult to know what calls what, so I'm not surprised they occasionally have to give up.
I had a play with Deno's Fresh web framework recently (Typescript/TSX but mainly server rendered). IMO it's light years ahead of other solutions.
You get full amazing Typescript typing, including in templates (unlike Go for example), but unlike React you don't have to deal with JavaScript tooling or complex client side state management. It's a real breath of fresh air. (Ha that wasn't even intentional.)
Elon has entered the chat....how many labs of this git kind can you make for him within 3 months? Can git be somehow monetized?
I thought github is worse than gitlab in terms of security
Could be! But that doesn't excuse a massive security failure like sending password reset emails to attacker-supplied addresses. I am pretty sure they have had other large failures.
They are writing code with zero/negative regard for security and that makes me want to use any alternative FOSS git host.
Gitea
Fuck. No other source forge supports groups or orgs with hierarchical projects 🫤 Gitea and Forgejo went hard on being github clones, so they're off the list. Are there any other alternatives? I don't want to have to bash together scripts to make something...
Anti Commercial-AI license
It’s not a dealbreaker for me but I feel your pain. Getting everything organized in Gitlab is a pleasure.
I looked into it after this year's massive price hike... There's no meaningful alternative. We're on the FOSS version of GitLab now (GitLab-CE), but the lack of code ownership / multiple reviewers / etc. is a real pain and poses problems with accountability.
Honestly there are not that many features in Gitlab EE that are truly necessary for a corporate environment, so a GitLab-CE fork may be able to set itself apart by providing those. To me there are two hurdles:
Honestly I think I'd be happy if forgejo supported gitlab-runner, that seems like a much more reasonable ask given the clean interface between runner and server. Maybe I should experiment with that...
:(
GGs
@obbeel Oh that's not a good sign
I would like to say I'm not too concerned by this personally, as long as all their data remains public to all.
So.. just to repeat myself for the 300th time
This is a good example of why people use GitHub
Because it's an advantage that it's hosted by a large company like Microsoft. There's very little chance it's going to be shut down or sold off. So developers don't need to worry about their infrastructure as much
One of our projects failed because we got caught up in infrastructure.
It's funny though how the people who are the most vocal against GitHub aren't responding to this post. But they're happy to make the biggest deal about every little button on it....
Just cause something is owned by a big company doesn't mean it'll last forever, example Google and their dead list of products.
Host gitea or forjeo if you really care about your infrastructure and data. If you can't, make some compromises and pick the next best thing. But owned by big company doesn't mean lasts forever.
Github is probably the biggest code hosting platform. There is literally no evidence that Microsoft will discontinue it.. And they've spent a huge amount of time integrating it. It also generates 1 billion in revenue, so why would Microsoft sell it? Furthermore, its free for open source..
Self hosting is part of the reason our project failed.. We wasted a lot of time with that stuff. We used Mercurial, whatever the Canonical one was, and git, and we wasted a lot of time.
Github works, and is well integrated to everything
Just pointing out that just cause its owned by a big company doesn't mean it'll last forever.
Also the FOSS community is by in large sus of Microsoft cause of their history practice of embrace, extend, extinguish. Which one would argue they embraced FOSS to gain easy access to their projects, the issues, the code, etc to train their models. Which would be OK if all code it generates has to be GPL to agree with the licenses of the collective pool of training data. Either way that's the topic of debate.
It sounds like you looked into your constraints and github works for you. That's great! And that's what's important.
And Microsoft wouldn't fuck up with GitHub? Or sell it to god.onows who? You sure about that?
Gitlab is at least open source, I can host it myself