439
700+ self-hosted Git instances battered in 0-day attacks with no fix imminent (www.theregister.com)
submitted 11 months ago by to c/selfhosted@lemmy.world
86 comments fedilink hide all child comments
 

By 'Git instances' they mean Gogs instances that allow open registration. I know most of the community moved from Gogs to Gitea, and then to Forgejo, but thought this was still worth noting.

you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 11 months ago (3 children)

I keep mine accessible from the internet, its just more useful to me like that. I do have registration disabled though and SSO is handled by Authentik so it could be worse (my personal goal has just been to not be the easiest target, perfect security is a myth in my mind).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 11 months ago

    Theres a HUGE difference between hosting it essentially read-only to the world, vs allowing account creation, uploading, and processing unknown files by the server.

    I have thought of blocking access to the commit history pages at the reverse proxy to cut off 99% of the traffic from bots. If anyone wants to look at the history, its just a git clone away.

  • permalink
  • fedilink
  • source
  • parent