• 4 Posts
  • 553 Comments
Joined 4 years ago
cake
Cake day: June 28th, 2020

help-circle
  • If ForgeFed gets up & running you should be able to self-host your own compatible VCS repository & send pull/merge requests from it instead of needing to create an account then for & use up space on another’s forge. The Forgejo lineage has a strong interest in this technology. Currently the only decentralized+popular way to send patches is via email so this will help put the D back in distributed version control system (DVCS). This would not only be great for users getting to keep their private data, but the distributed nature adds a layer of resilience for downed Microsoft servers (happens often) or censorship/sancations as with even a little momentum, your project will have mirrors in multiple jurisdictions.

    GitLab is open core, which is a step up from fully-closed, but isn’t fully open (nothing inherently wrong with that, but it is of note). The bigger issues with GitLab to me are twofold: 1) it’s slow built on Ruby & React (I think) where it can’t run on a potato requiring both excessive CPU as well as data usage while also requiring JavaScript & 2) GitLab is publicly traded which means there are shareholder requirements for them that can easily get in the way of what is good for users (or even what will be or continue to be licensed with a free software license).

    Codeberg is ran by a German nonprofit which means they aren’t trying to put profits in the way of users, but also being in the EU, they will have strict requirements for user data which means it’s safer. As far as I can tell, there are no ads & it runs fast & works well enough without JavaScript. I would rather see more self-hosting personally, but if it isn’t practical for you, this is a good option. With it being built with Forgejo, it should in theory introduce a lot less friction migrating from Codeberg to self-hosted Forgejo in the future.

    Forgejo isn’t without flaws tho. One of the goals of Gitea (forked from Gogs) vs. Forgejo (forked from Gitea) is trying to be more compatible with Microsoft GitHub even moving its continuous integration (CI) to Forgejo Action to be compatible with all the bugs & YAML spaghetti that MS GitHub uses. They copy the generally-bad pull request model too which only is optimal in certain uses cases, bottlenecking review & having a UI that leads maintainers more to commenting on how to fix something rather than saying “thanks”, merging, then fixing small nits themselves to not waste the contributor’s time in review if they just want a small bugfix, not to learn your entire codebase + style + process. By copying MS GitHub too closely, you can up being a clone that is just FOSS while risking having something that is technically differentiating which is ironically counter to inspiriting migration since while it might be easier, the benefits seem moot (maybe even just philosophical) instead of providing something users want to leave for (which is what I think you might be getting at). Additionally being Git-based as well means Forgejo (& others) are stuck with snapshots that factor in time & patch order causing unnecessary merge conflicts with multiple users which is solved by choosing a better version control system (VCS).


  • Using free software to create free software is already a good reason.

    But if you need more:

    • owned by Microsoft, it is a US-based megacorporate product with value to deliver to shareholders first
    • never forget EEE as we see a new form of it with Microsoft trying to control the entire developer experience from the server hosting to the editor/AI on folks’ machines; under-litigation Copilot is a straight exploitation of the Commons selling our hardwork back to us
    • proprietary means you can’t fork or fix the numerous bugs in the platform nor is there a real issue tracker so you beg on their forums for fixes (anti-free software mentality)
    • lock-in issues since aside from specifically the Git part, every one of those proprietary features you buy into will dig a further trench to make it hard to migrate elsewhere
    • yes, privacy benefits of not just you but all potential contributors as well since it is a locked ecosystem that requires an account
    • not everyone thinks software forges should double as a social media platform with upvotes, FOMO, commit anxiety with employers imploring you have metrics on a closed platform with knock-on issues like star-hacking where projects try to inflate their star numbers in this popularity contest instead of judging projects on merit
    • related, the README used to be a file you could read without rendering but now instead they are full of trash markup, emoji, & the repository is filled with binary blobs of images or worse videos for your demo ballooing cloning all wrapped in a Microsoft UI not your own; setting up a separate site isn’t hard (nor is it easy either) but at least you get to own your look & keep assets out of your repository
    • there are literally ads & upsells all over the platform
    • you can’t use search or see the collapsed comments without authentication
    • censorship is not uncommon–especially when it mess with the corporate status quo (see Nintendo Switch emulator dev, youtube-dl, etc.)
    • being US-based & big enough for scrutiny, MS GitHub is required to follow US sanctions which prohibit some of your potential users/contributors from even accessing your code (and/or issue tracker and/or forum and/or wiki and/or donations if using MS GitHub)
    • …& there already is a host of good alternatives out there for code forges with better performance & features, some of them aren’t locked to Git either; ‘network effect’ be damned










  • You are supposed to do feature detection, not user agent detection since it is easily spoofed, isn’t realiable, & doesn’t account for literally all the alternative UAs that can support it. This is bad/lazy practice.

    Fx doesn’t always have all the features you need, but often it usually does & where I have seen this as being deployed is management saying it isn’t worth the effort to support. Just having one person on the team running Fx is usually enough to catch the game-breaking bugs.









  • I think the parent is distinguishing between messages & the attachments as they are stored differently & often in different places in many systems. But I agree with you in assuming that the goal would ultimately be to then start scanning messages too.

    Imagine governments used something like SHA1 that has conflicts & now you have collision potential–you could even fabricate attachments that could cause a collision to get someone throw in jail since all you have to rely on is the file hashes. If you can’t scan the actually content & you are just using hashes, then you also don’t prevent new content that those in power deem ‘bad’ from being flagged either which doesn’t really stop the proliferation of the ‘bad thing’ just specific known ‘bad things’. If I were implementing clients, I would start adding random bits to the metadata so the hashes always change.

    The only way this system even works is if there are centralized points the governments/corporations can control. Chalk this up as another point for supporting decentralization & lightweight self-hosting since it would be impossible to have oversight over such a system if anyone can spin up a personal server in their bedroom.