4 ms·

I honestly think this is the price that people pay for using proprietary software. The license terms changed and boom now you're out of service. If such OSS p

by znpy 6y ago

I honestly think this is the price that people pay for using proprietary software. The license terms changed and boom now you're out of service. If such OSS projects were running on Gitlab (either gitlab.com or selfhosted) then any of the members could have donated spare computing resources by running a gitlab runner on their prem. Many people have PCs running 24/7 and could spare a vm to lend to their favourite projects.

koolba 6y ago
Running arbitrary code on a distributed network of end user PCs with network access is a recipe for a bot net. Yes it’s doable but it’s not a magic wand to claim that an open platform will solve it. The magic of Travis was that with a couple clicks of OAuth you were signed up and running builds for your own PRs. My first thought upon seeing this years ago was “How many people are using this to mine crypto?!“.
- znpy 6y ago
  > Running arbitrary code on a distributed network of end user PCs It's a bit more complicated than that. I run gitlab and gitlab runners for a living, I can tell. First thing first, you'd have to register a runner with a specific project. So no "arbitrary code". Second thing, unless you can push a branch to the project main repository, no pipeline is ran. So for your own personal forks you'd either rely on gitlab.com-provided free minutes or you run your own runner (and tbh, it's fairly easy). Last thing: you should not think of regular end-users. Think of middle to advanced users, that have a home server or something like that (homelabbers?).
  - nl 6y ago
    > First thing first, you'd have to register a runner with a specific project. So no "arbitrary code". This isn't what "arbitrary code" means.
- eins1234 6y ago
  > My first thought upon seeing this years ago was “How many people are using this to mine crypto?!“. Having worked at a Travis CI competitor that also offered open-source credits. The answer is "many" if you don't do anything about it...
  - floatboth 6y ago
    What is the state of the art in doing something about this? Has anyone tried using CPU perf counters to see if the workload looks like hashing?
  - jrochkind1 6y ago
    Indeed, that is why Travis said they were changing the way they handled open source, because people were using it to mine crypto. They just weren't clear that the "change" was basically "not anymore providing free services to open source".
- josteink 6y ago
  > The magic of Travis was that with a couple clicks of OAuth you were signed up and running builds for your own PRs. With GitHub Actions it's even simpler, and no OAuth required at all. I especially like the auto-suggested template-types based on what kind of project the repo hosts (Node, Python, etc).
nuritzi 6y ago
Saw the note about GitLab (I work there) and thought I'd chime in. For those who don't know, we have a GitLab for Open Source program which gives our top tiers and 50K CI minutes/month for free to OSS projects: https://about.gitlab.com/solutions/open-source/ https://about.gitlab.com/solutions/open-source/ Hope this helps!
- znpy 6y ago
  Thanks for chiming in! I like gitlab so much I couldn't miss this opportunity to recommend it. The nice thing about Gitlab is that you can mix on-prem and saas according to your need. For example I am now running my own gitlab instance at home but I'm thinking of switching to the gitlab.com offering while keeping runners at home. By pairing gitlab with Hashicorp Vault I could keep encrypted stuff in my repo and decrypt them when they are checked out on the (local on-prem) runner. Super cool, so much flexibility!

by znpy 6y ago

koolba 6y ago

Running arbitrary code on a distributed network of end user PCs with network access is a recipe for a bot net. Yes it’s doable but it’s not a magic wand to claim that an open platform will solve it. The magic of Travis was that with a couple clicks of OAuth you were signed up and running builds for your own PRs. My first thought upon seeing this years ago was “How many people are using this to mine crypto?!“.

znpy 6y ago
> Running arbitrary code on a distributed network of end user PCs It's a bit more complicated than that. I run gitlab and gitlab runners for a living, I can tell. First thing first, you'd have to register a runner with a specific project. So no "arbitrary code". Second thing, unless you can push a branch to the project main repository, no pipeline is ran. So for your own personal forks you'd either rely on gitlab.com-provided free minutes or you run your own runner (and tbh, it's fairly easy). Last thing: you should not think of regular end-users. Think of middle to advanced users, that have a home server or something like that (homelabbers?).
- nl 6y ago
  > First thing first, you'd have to register a runner with a specific project. So no "arbitrary code". This isn't what "arbitrary code" means.
eins1234 6y ago
> My first thought upon seeing this years ago was “How many people are using this to mine crypto?!“. Having worked at a Travis CI competitor that also offered open-source credits. The answer is "many" if you don't do anything about it...
- floatboth 6y ago
  What is the state of the art in doing something about this? Has anyone tried using CPU perf counters to see if the workload looks like hashing?
- jrochkind1 6y ago
  Indeed, that is why Travis said they were changing the way they handled open source, because people were using it to mine crypto. They just weren't clear that the "change" was basically "not anymore providing free services to open source".
josteink 6y ago
> The magic of Travis was that with a couple clicks of OAuth you were signed up and running builds for your own PRs. With GitHub Actions it's even simpler, and no OAuth required at all. I especially like the auto-suggested template-types based on what kind of project the repo hosts (Node, Python, etc).

nuritzi 6y ago

Saw the note about GitLab (I work there) and thought I'd chime in. For those who don't know, we have a GitLab for Open Source program which gives our top tiers and 50K CI minutes/month for free to OSS projects: https://about.gitlab.com/solutions/open-source/ https://about.gitlab.com/solutions/open-source/ Hope this helps!

znpy 6y ago
Thanks for chiming in! I like gitlab so much I couldn't miss this opportunity to recommend it. The nice thing about Gitlab is that you can mix on-prem and saas according to your need. For example I am now running my own gitlab instance at home but I'm thinking of switching to the gitlab.com offering while keeping runners at home. By pairing gitlab with Hashicorp Vault I could keep encrypted stuff in my repo and decrypt them when they are checked out on the (local on-prem) runner. Super cool, so much flexibility!