5 ms·

It takes about 30 minutes to set up your own git server. You can easily create your own git hooks to send email notifications on "git push", or to trigger CI or

by jdvh 5y ago

It takes about 30 minutes to set up your own git server. You can easily create your own git hooks to send email notifications on "git push", or to trigger CI or deployment. I get that gitlab is tremendously valuable for bigger teams, but smaller groups can easily do without. This isn't the first time gitlab has security issues, and it won't be the last. It's just not worth it for us. https://git-scm.com/book/en/v2/Git-on-the-Server-Setting-Up-the-Server https://git-scm.com/book/en/v2/Git-on-the-Server-Setting-Up-...

gizmo385 5y ago
You could make this argument about basically any service and it comes up on HN without fail anytime something like this happen: "Just self host, it isn't hard." And sure - self hosting might not be terribly complicated but that's one more thing that now you've got to worry about and keep track of. One more thing that you've got manage and keep up to date. There is a lot of value in convenience, ease of access, and simple scalability.
- mmsbdjjkvjj 5y ago
  In this case though, gitlab is a self hosted product
- detaro 5y ago
  You're in a thread about an update to the self-hosted Gitlab offering. They aren't saying "use this instead of the service", but "if you self-host you can also self-host a simpler thing", so your response really doesn't fit the topic at hand.
  - isbvhodnvemrwvn 5y ago
    There is a point where "simpler" is so laughably inadequate when compared to the alternative that dismissing the comment makes sense. You lose code review, integrated CI, and will need quite a lot of time to manage this entire solution anyway.
    - detaro 5y ago
      If you want to make a different argument agains the comment, feel free to do so, but I'm not sure how that's relevant to my comment or the comment I replied to?
- jdvh 5y ago
  This service update only applies to people who self-host. Servers managed by gitlab are patched by gitlab staff. If you're going to self-host I think you should at least --consider-- self-hosting something with a tiny attack surface instead of a complicated product with many dependencies and "casual" security practices.
- indymike 5y ago
  I'd love to see the same effort that is going into avoiding managing a service go into contributing better tooling to that service or to the OS package/configuration so it's not 30 minutes of work. I'd love it if it worked more like this: apt install myservice and maybe one or two tweaks/decisions to configure for use. A lot of the issues here are that dynamic language based services (python/ruby/js) don't play nice with OS provided interpreters. This is a problem that really needs to be solved, if we'd like to continue to have nice things.
  - programd 5y ago
    The tooling is already there. All the "not playing nice" issues are largely solved by using Docker. Installing a local Docker instance of Gitlab is literally four commands. Mkdir three directories and docker run to get it started. See https://docs.gitlab.com/ee/install/docker.html https://docs.gitlab.com/ee/install/docker.html
    - indymike 5y ago
      > All the "not playing nice" issues are largely solved by using Docker Not really. Now any integration has to be done inside the container or with other containers... which adds lots of extra steps. I do agree using Docker makes a simple deployment easier, though.
acidburnNSA 5y ago
Oh geez I've been hand wringing about which self-hosted git thing to put on my personal VPS to replace Phabricator and this is such an obvious answer. Thanks! EDIT: replace isn't the right word for most phab features (code review, issue track, wiki), but I just mean replace for repo sharing with push and pull
- djbusby 5y ago
  My team went to gitLab after phabricator maybe 2 years ago. Works great here
  - dnsmichi 5y ago
    Thanks for sharing :) GitLab team member here. Phabricator has many great features which inspired GitLab. I've shared some of them in this blog post: https://about.gitlab.com/blog/2021/08/13/five-great-phabricator-features-inspired-gitlab/ https://about.gitlab.com/blog/2021/08/13/five-great-phabrica...
- Lammy 5y ago
  Personally I hope Phorge gets enough momentum to live on as a community project https://we.phorge.it/source/phorge/ https://we.phorge.it/source/phorge/
88913527 5y ago
What about the cost of maintaining the server? I've had poor experiences with maintaining my own VPS in the past. Basic advice is setup fail2ban and I'm unable to ascertain if that's adequate. We're not all walking around with that knowledge, nor do I know how to easily acquire it.
- jdvh 5y ago
  Either go with a hosted solution or take the time to learn linux server admin. Linux hasn't changed much in the past 15 years, and I don't think it will change much in the coming years either. With web stuff you have to keep up with new developments, but linux is very stable and boring by comparison. There's a learning curve, but taking the time to understand how linux really works is totally worth it. You'll want to follow some linux hardening guides, set up a firewall, set up fail2ban, set up full disk encryption, backups, and some other things.
- EnigmaCurry 5y ago
  The parent suggestion of just running git over SSH has a small attack surface, its not like HTTP accepting anyone through the front door. Set `PasswordAuthentication no` in `/etc/ssh/sshd_config` and I don't think you even need fail2ban. But you could put a rate limit on new connections to port 22, or leave the fail2ban setup as an additional guard, and of course you want to block all the other ports you don't need.
orf 5y ago
This comment drastically undervalues the features that both Gitlab and GitHub provide, even for very small teams.
mattl 5y ago
For a Linux user, you can already build such a system yourself quite trivially by getting an FTP account, mounting it locally with curlftpfs, and then using SVN or CVS on the mounted filesystem. From Windows or Mac, this FTP account could be accessed through built-in software.
- Datagenerator 5y ago
  Exposé without encryption, at least use SFTP and rclone mounts in this theoretical use case scenario
  - Sebb767 5y ago
    I'm pretty sure this is a reference to the famous Dropbox comment[0], not an actual proposal. [0] https://news.ycombinator.com/item?id=9224 https://news.ycombinator.com/item?id=9224
ec109685 5y ago
Your setup could also have a security issue.
- jdvh 5y ago
  What's the attack surface of a git linux account that doesn't have a shell and can only log on through ssh with a key from whitelisted IPs in a firewall? Compare that attack surface with that of a complicated web app like gitlab.
  - gmfawcett 5y ago
    Sure, but you could control access to the Web app, too? E.g. allow only certain VPN accounts to access it? There are lots of ways to manage attack surfaces.
bushbaba 5y ago
It takes just 30 minutes to clean your office. You can go to Home Depot and buy all the supplies for cheaper than what it costs for a janitor in a month. Accept your time is limited and valuable. You might drive a higher roi focusing your time on the core business than doing ancillary tasks
- devoutsalsa 5y ago
  It only takes 15 minutes to order a new prefabricated office!
- saurik 5y ago
  Sure... and yet I would happily spend an entire day learning about git to avoid 30 minutes cleaning: the premise that time is fungible is simply incorrect. (Regardless: this "30 minutes" is of course an estimate, and isn't "30 minutes longer". I do demos in college classes on how to set up personal git servers--given your existing ssh and web server setup--with nothing more than a git init --bare and renaming a single default hook, and so setting up GitLab to me is definitely going to take way more time as it probably is going to require learning some new config file format and figuring out if it has some kind of database dependency and the such. But the reality is that time is NOT fungible so GitLab might be worth setting up no matter how hard it is vs. using git as intended.)
UncleMeat 5y ago
Gitlab and Github do way way way more than just run git.
0xbadcafebee 5y ago
There are 100 different features in Gitlab, and only one of those is keeping your code in version control. It's valuable for any size team. Why would you want to waste a small team's time trying to DIY everything when they can just install one solution that does everything for them for free?
oauea 5y ago
How are you going to do code review and manage that discussion?
IshKebab 5y ago
Smaller groups can do without code review, CI/CD and issue tracking? I mean I guess if your "smaller group" is literally 1 or 2 people.
jahewson 5y ago
It doesn’t though. I need a secure, maintainable, audited, backed-up solution which would pass a SOC2 audit.
- hedora 5y ago
  Any soc2 auditor (or other security auditor) that will sign off on self-hosted gitlab, but not self-hosted git should have their accreditation pulled! Git's attack surface and trusted computing base are a subset of gitlab's. Even if gitlab security were perfect, it would still be no better than git.
programd 5y ago
> It takes about 30 minutes to set up your own git server. It takes about 50 seconds to setup and run a local Docker instance of Gitlab-ce. The value for time and money (it's free) is insane. You don't just get git, but a fully featured issue management system, a nice UI, CI/CD integration, Kubernetes hooks...etc,etc. If you want to run your own repo I can't think of anything which is even remotely as valuable. You can even throw it on a Raspberry Pi and have a home lab code repository setup which would make major corporations envious just a few years ago. If you're using just plain command line git to manage your code projects you're lingering in the past, which is perfectly fine, but these days you can do way better for less work. It's as if you were using bvi (binary vi) to edit your photos when GIMP is freely available. (I hope I get extra credit for not using a car analogy :) To be clear I'm not dissing command line git - I use it every day. But if you're managing multiple code projects and need to keep track of issues and run automated tests then Gitlab gives you an amazingly powerful tool set for making your life easy.
- hedora 5y ago
  I think the difference is that the gitlab instance will probably require care and feeding beyond letting the OS "apt update; apt upgrade" once a night.
deleted 5y ago
[deleted]

by jdvh 5y ago

gizmo385 5y ago

You could make this argument about basically any service and it comes up on HN without fail anytime something like this happen: "Just self host, it isn't hard." And sure - self hosting might not be terribly complicated but that's one more thing that now you've got to worry about and keep track of. One more thing that you've got manage and keep up to date. There is a lot of value in convenience, ease of access, and simple scalability.

mmsbdjjkvjj 5y ago
In this case though, gitlab is a self hosted product
detaro 5y ago
You're in a thread about an update to the self-hosted Gitlab offering. They aren't saying "use this instead of the service", but "if you self-host you can also self-host a simpler thing", so your response really doesn't fit the topic at hand.
- isbvhodnvemrwvn 5y ago
  There is a point where "simpler" is so laughably inadequate when compared to the alternative that dismissing the comment makes sense. You lose code review, integrated CI, and will need quite a lot of time to manage this entire solution anyway.
  - detaro 5y ago
    If you want to make a different argument agains the comment, feel free to do so, but I'm not sure how that's relevant to my comment or the comment I replied to?
jdvh 5y ago
This service update only applies to people who self-host. Servers managed by gitlab are patched by gitlab staff. If you're going to self-host I think you should at least --consider-- self-hosting something with a tiny attack surface instead of a complicated product with many dependencies and "casual" security practices.
indymike 5y ago
I'd love to see the same effort that is going into avoiding managing a service go into contributing better tooling to that service or to the OS package/configuration so it's not 30 minutes of work. I'd love it if it worked more like this: apt install myservice and maybe one or two tweaks/decisions to configure for use. A lot of the issues here are that dynamic language based services (python/ruby/js) don't play nice with OS provided interpreters. This is a problem that really needs to be solved, if we'd like to continue to have nice things.
- programd 5y ago
  The tooling is already there. All the "not playing nice" issues are largely solved by using Docker. Installing a local Docker instance of Gitlab is literally four commands. Mkdir three directories and docker run to get it started. See https://docs.gitlab.com/ee/install/docker.html https://docs.gitlab.com/ee/install/docker.html
  - indymike 5y ago
    > All the "not playing nice" issues are largely solved by using Docker Not really. Now any integration has to be done inside the container or with other containers... which adds lots of extra steps. I do agree using Docker makes a simple deployment easier, though.

acidburnNSA 5y ago

Oh geez I've been hand wringing about which self-hosted git thing to put on my personal VPS to replace Phabricator and this is such an obvious answer. Thanks! EDIT: replace isn't the right word for most phab features (code review, issue track, wiki), but I just mean replace for repo sharing with push and pull

djbusby 5y ago
My team went to gitLab after phabricator maybe 2 years ago. Works great here
- dnsmichi 5y ago
  Thanks for sharing :) GitLab team member here. Phabricator has many great features which inspired GitLab. I've shared some of them in this blog post: https://about.gitlab.com/blog/2021/08/13/five-great-phabricator-features-inspired-gitlab/ https://about.gitlab.com/blog/2021/08/13/five-great-phabrica...
Lammy 5y ago
Personally I hope Phorge gets enough momentum to live on as a community project https://we.phorge.it/source/phorge/ https://we.phorge.it/source/phorge/

88913527 5y ago

What about the cost of maintaining the server? I've had poor experiences with maintaining my own VPS in the past. Basic advice is setup fail2ban and I'm unable to ascertain if that's adequate. We're not all walking around with that knowledge, nor do I know how to easily acquire it.

jdvh 5y ago
Either go with a hosted solution or take the time to learn linux server admin. Linux hasn't changed much in the past 15 years, and I don't think it will change much in the coming years either. With web stuff you have to keep up with new developments, but linux is very stable and boring by comparison. There's a learning curve, but taking the time to understand how linux really works is totally worth it. You'll want to follow some linux hardening guides, set up a firewall, set up fail2ban, set up full disk encryption, backups, and some other things.
EnigmaCurry 5y ago
The parent suggestion of just running git over SSH has a small attack surface, its not like HTTP accepting anyone through the front door. Set `PasswordAuthentication no` in `/etc/ssh/sshd_config` and I don't think you even need fail2ban. But you could put a rate limit on new connections to port 22, or leave the fail2ban setup as an additional guard, and of course you want to block all the other ports you don't need.

orf 5y ago

This comment drastically undervalues the features that both Gitlab and GitHub provide, even for very small teams.

mattl 5y ago

For a Linux user, you can already build such a system yourself quite trivially by getting an FTP account, mounting it locally with curlftpfs, and then using SVN or CVS on the mounted filesystem. From Windows or Mac, this FTP account could be accessed through built-in software.

Datagenerator 5y ago
Exposé without encryption, at least use SFTP and rclone mounts in this theoretical use case scenario
- Sebb767 5y ago
  I'm pretty sure this is a reference to the famous Dropbox comment[0], not an actual proposal. [0] https://news.ycombinator.com/item?id=9224 https://news.ycombinator.com/item?id=9224

ec109685 5y ago

Your setup could also have a security issue.

jdvh 5y ago
What's the attack surface of a git linux account that doesn't have a shell and can only log on through ssh with a key from whitelisted IPs in a firewall? Compare that attack surface with that of a complicated web app like gitlab.
- gmfawcett 5y ago
  Sure, but you could control access to the Web app, too? E.g. allow only certain VPN accounts to access it? There are lots of ways to manage attack surfaces.

bushbaba 5y ago

It takes just 30 minutes to clean your office. You can go to Home Depot and buy all the supplies for cheaper than what it costs for a janitor in a month. Accept your time is limited and valuable. You might drive a higher roi focusing your time on the core business than doing ancillary tasks

devoutsalsa 5y ago
It only takes 15 minutes to order a new prefabricated office!
saurik 5y ago
Sure... and yet I would happily spend an entire day learning about git to avoid 30 minutes cleaning: the premise that time is fungible is simply incorrect. (Regardless: this "30 minutes" is of course an estimate, and isn't "30 minutes longer". I do demos in college classes on how to set up personal git servers--given your existing ssh and web server setup--with nothing more than a git init --bare and renaming a single default hook, and so setting up GitLab to me is definitely going to take way more time as it probably is going to require learning some new config file format and figuring out if it has some kind of database dependency and the such. But the reality is that time is NOT fungible so GitLab might be worth setting up no matter how hard it is vs. using git as intended.)

UncleMeat 5y ago

Gitlab and Github do way way way more than just run git.

0xbadcafebee 5y ago

There are 100 different features in Gitlab, and only one of those is keeping your code in version control. It's valuable for any size team. Why would you want to waste a small team's time trying to DIY everything when they can just install one solution that does everything for them for free?

oauea 5y ago

How are you going to do code review and manage that discussion?

IshKebab 5y ago

Smaller groups can do without code review, CI/CD and issue tracking? I mean I guess if your "smaller group" is literally 1 or 2 people.

jahewson 5y ago

It doesn’t though. I need a secure, maintainable, audited, backed-up solution which would pass a SOC2 audit.

hedora 5y ago
Any soc2 auditor (or other security auditor) that will sign off on self-hosted gitlab, but not self-hosted git should have their accreditation pulled! Git's attack surface and trusted computing base are a subset of gitlab's. Even if gitlab security were perfect, it would still be no better than git.

programd 5y ago

> It takes about 30 minutes to set up your own git server. It takes about 50 seconds to setup and run a local Docker instance of Gitlab-ce. The value for time and money (it's free) is insane. You don't just get git, but a fully featured issue management system, a nice UI, CI/CD integration, Kubernetes hooks...etc,etc. If you want to run your own repo I can't think of anything which is even remotely as valuable. You can even throw it on a Raspberry Pi and have a home lab code repository setup which would make major corporations envious just a few years ago. If you're using just plain command line git to manage your code projects you're lingering in the past, which is perfectly fine, but these days you can do way better for less work. It's as if you were using bvi (binary vi) to edit your photos when GIMP is freely available. (I hope I get extra credit for not using a car analogy :) To be clear I'm not dissing command line git - I use it every day. But if you're managing multiple code projects and need to keep track of issues and run automated tests then Gitlab gives you an amazingly powerful tool set for making your life easy.

hedora 5y ago
I think the difference is that the gitlab instance will probably require care and feeding beyond letting the OS "apt update; apt upgrade" once a night.

deleted 5y ago

[deleted]