They're saying not yet - https://floss.social/@forgejo/117450533397721524
Attention: We currently advise against upgrading to Forgejo 17.0.0. An issue is currently being investigated that prevents pushing, merging, or other code operations in some cases.
If you haven't updated yet, please wait until the issue has been investigated more thoroughly, if possible.
Nice share. I'll look into it more and try it out. Thanks.
Finally found this post after a few minutes of searching:
I came across this: https://github.com/cloudbase/garm , which is gitea (probably compatible with forgejo) actions using Incus containers/virtual machines, or on kubernetes directly.
It looks like it's possible to create an alternate implementation of the forgejo actions runner, which doesn't uses different methods of execution.
I hadn't heard about the carrot disclosure stuff, but I hope this doesn't become a common thing. Just saying "I can hack you" with some purported output from a script is pretty useless feedback.
No AI allowed at all? Good to know. 😎
@Kissaki @Eezyville #iocaine by @algernon?
There's a tool for that too - I don't have the link or name at hand though
Imagine never learning through trying things. Also, you're on Lemmy arguing against self-hosting.
Leaving the "know how" part for last, I see.
Why do you need a self hosted instance open to the World?
Because I can and I want to?
Why do you need a self hosted instance open to the World? Mine is behind a CloudFlare rule that allows connections only from a list of IPs, like my self hosted WireGuard instance.
If you think it's AI then maybe you can get another AI to write bad code and poison their training data.
Well, at least it doesn't seem targeted, then. Did you do anything to remedy the situation?
[...] crazy bot traffic trying everything from MySQL connections, ssh, Wordpress sniffing, xss attacks, you name it.
oh yeah, I see that on everything. I'm not so worried about those vuln scanners than this overwhelming nonsense traffic that I'm seeing now. This is different, and seemingly pointless.
Possibly AI company crawlers. When they came up there was a lot of bad publicity and reports of actively malicious and toxic crawling behavior, including ban evasion.
That was kind of what I was thinking, but if that's true, they're wasting so much bandwidth and compute. Going through every combination of issue label combinations does not get them any useful code to hoover up. They could've just cloned my repos and be done with it.
You can think about locking some url paths behind valid login sessions, or use a proof of work proxy guard.
Anubis is the popular tool for that. I’ve seen maybe three alternatives, one of which from Cloudflare.
Really don't want to Cloudflare, but Anubis is interesting. If I can't shake these bots, maybe I'll consider this. Thanks.
Having a private instance isn't exactly indicative to open source software, so I don't think that's the way I want to take it. I'd probably move to Codeberg or even GitHub before hosting the entire thing on a private net.
I also don't think monitoring and blocking are going to help here. This traffic came from so many different IPs that it would be almost impossible to detect and block them all without blocking legitimate traffic. I also really don't want to hook up a Cloudflare-like centralized challenge system to deal with this if I can avoid it.
Possibly AI company crawlers. When they came up there was a lot of bad publicity and reports of actively malicious and toxic crawling behavior, including ban evasion.
You can think about locking some url paths behind valid login sessions, or use a proof of work proxy guard.
Anubis is the popular tool for that. I've seen maybe three alternatives, one of which from Cloudflare.
See also related Codeberg ticket (Forgejo instance) https://codeberg.org/forgejo/discussions/issues/319
If you search, you can find various blog posts about these issues. Not just when Forgejo.
For Android users, there's GitNex https://f-droid.org/packages/org.mian.gitnex by the way.
Was iforge or iforgejo already taken?
Just 2 hours ago I was trying to find a way to get notifications from Codeberg via RSS (I failed) and now this drops 💀💀
Six months ago, distributed crawling hit code.forgejo.org, and the mitigation measures put in place then held until a few weeks ago. The mitigation measures relied on JavaScript-based proof-of-work, but the crawling software learned to resolve the measures, allowing the attack to return.
Since November 24, a new blocking strategy has been implemented and successfully blocked around one million unique IPs daily. Only 5,000 unique IP addresses reach code.forgejo.org daily, and no reports of legitimate traffic being blocked have been received.
Crazy. A 1M to 5k ratio.
The linked to 'new strategy' information is interesting too. They're blocking a specific user agent.
TL;DR: 26 November ~900,000 unique IPs sent requests to code.forgejo.org and blocking one user agent effectively blocks over 90% of them. At the moment ~50,000 unique IP hit code.forgejo.org per hour, ~5,000 of them are not using the suspicious user agent and are sent to Anubis, ~1,000 of them pass the challenge and reach code.forgejo.org.
&& Header(`user-agent`, `Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36`)
Dutch government shows interest in Forgejo
The Dutch government has expressed interest in using Forgejo for its national code platform. Currently, they rely on GitHub, but they are looking for alternatives for storing, collaborating and building government code. This is part of the Open Source Program Office (OSPo)‘s efforts to regain digital sovereignty. Throughout the month, a call also took place between a representative from the office and some Forgejo contributors.
Moreover, it is pleasing to hear that the office expressed interest in exploring ways to contribute back to the project.
Now this, this I like. If the dutch government also invests in federation, that would be amazing. First they have to tie the knot of course...