439
700+ self-hosted Git instances battered in 0-day attacks with no fix imminent (www.theregister.com)
submitted 11 months ago by to c/selfhosted@lemmy.world
86 comments fedilink hide all child comments
 

By 'Git instances' they mean Gogs instances that allow open registration. I know most of the community moved from Gogs to Gitea, and then to Forgejo, but thought this was still worth noting.

you are viewing a single comment's thread
view the rest of the comments
[–] 69 points 11 months ago* (34 children)

People have open registration on those things... Thats.. Brave...

I have my own gitea instance in my homelab but of course its not accessable from the internet.

  • permalink
  • fedilink
  • source
  • hideshow 34 child comments
    •
  • [–] 12 points 11 months ago (13 children)

    Well that kinda kills collaboration

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 13 child comments
    •
  • [–] 19 points 11 months ago (2 children)

    Yeah. If I needed collaboration, I would just whitelist their ips or require everyone involved to use Wireguard vpn, Tailscale or other solutions that allows access without being publically exposed.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 5 points 11 months ago (8 children)

    I do the same thing. Anything I put on there isn't something that I would share with the Internet anyway. If it was a serious project, sure. It's just nice to have a personal git you can access over a VPN sometimes.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [+] -10 points 11 months ago (7 children)

    I can't understand why anyone would waste time writing code that won't be shared

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 8 points 11 months ago (2 children)

    Personal projects. Not everything has to be FOSS. My tiny little script to automate my lights turning green and my smart speaker playing All-Star by Smash Mouth at full volume, so I can jork it in peace? That shit doesn’t need to be public.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 11 months ago*

    Home Assistant hs communities to share exactly that

    My similar script has a very different goal: at midnight if someone is still up, it dims the family room light and announces on speaker”hey kids, it’s time for bed”

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 11 months ago*

    For personal use. As someone who has all my non-trivial creations, including dot-files and scripts I replicate between machines, in repos since CVS has a thing it’s a habit. Version control. This stuff is mostly private but not secret, why should I have it public?

    Edit after spell check.

  • permalink
  • fedilink
  • source
  • parent
    • load more comments (1 reply)
  • [–] 2 points 11 months ago

    You can git pull a repo to your machine, make your changes and then use git to submit a patch via email. Its not pretty, but it works. Hopefully federation is built soon and you will be able to submit a pull request from your own forge.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 7 points 11 months ago (13 children)

    I wonder if it'd be feasible to make a fediverse github

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 13 child comments
    •
  • [–] 6 points 11 months ago (9 children)

    Git is already a distributed version control system.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] 1 point 11 months ago* (8 children)

    But it doesn't have any built-in concept of users, write permissions, or authentication (except for commit signing)

    Hosting an unauthenticated git repo would be the equivalent to an open ssh port with no password required

    Not to mention collaborative things like issue tracking, PRs, forums, etc

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 2 points 11 months ago (7 children)

    Forgejo has all that, and then you can achieve "federation" by virtue of pushing to whatever remote. I wasn't suggesting people use git itself (which is possible). I just meant that it's distributed as opposed to centralized like Subverison is.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 1 point 11 months ago (5 children)

    no, forgejo doesnt have "all that". you are totally missing the point. git is federated, of course, but the added features of forgejo or any other known git forge is not (yet).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 0 points 11 months ago* (last edited 11 months ago) (4 children)

    concept of users, write permissions, or authentication

    collaborative things like issue tracking, PRs, forums, etc

    Forgejo has those, yes.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 0 points 11 months ago (3 children)

    and where does forgejo support federation for issues, PRs?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 0 points 11 months ago (2 children)

    Never said it did, and the comment replying to didn't say it did either.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 0 points 11 months ago (1 child)

    seems right. actually you were just not responding to the questions of anyone in this chain, but always responding with irrelevant things. and thanks for the downvotes! please bring some more.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 11 months ago (3 children)

    I keep mine accessible from the internet, its just more useful to me like that. I do have registration disabled though and SSO is handled by Authentik so it could be worse (my personal goal has just been to not be the easiest target, perfect security is a myth in my mind).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 11 months ago

    Theres a HUGE difference between hosting it essentially read-only to the world, vs allowing account creation, uploading, and processing unknown files by the server.

    I have thought of blocking access to the commit history pages at the reverse proxy to cut off 99% of the traffic from bots. If anyone wants to look at the history, its just a git clone away.

  • permalink
  • fedilink
  • source
  • parent