7 ms·

At my organization it's always been true. Setting up GitLab is fairly easy, in my company we do it and it's cheap (on-prem hosting is basically zero, and we had

At my organization it's always been true. Setting up GitLab is fairly easy, in my company we do it and it's cheap (on-prem hosting is basically zero, and we had the IPs/domains already) and it hasn't given us too many headaches. I think last time I had to do something was maybe a few months ago when I restarted it so that it picked up the updated SSL certificate.

xondono 5y ago
I’d say it depends, I run my own on prem server and gitlab was a PITA. Too many moving parts, updating took too much of my time, and I never felt “safe”. Moving to gitea solved all of those issues for me (thus far), now I’m looking into adding other stuff like CI through Drone.
- edgyquant 5y ago
  It definitely depends. We’re pretty early stage and I’m the senior engineer+infrastructure guy so running our own gitea instance or whatever is just more time that I’m almost out of.
- Inversechi 5y ago
  Did you consider woodpecker instead of drone? It's basically an evolved fork of the OSS version. https://woodpecker-ci.org/ https://woodpecker-ci.org/
  - xondono 5y ago
    Didn’t even know about it. I’ll check it out. Thanks!
- KronisLV 5y ago
  Curiously, this was also my own experience! I actually wrote a bit about the migration process, as well as the reasons for migrating over to Gitea, Nexus and Drone CI as opposed to using GitLab, GitLab Registry and GitLab CI: https://blog.kronis.dev/articles/goodbye-gitlab-hello-gitea-nexus-and-drone https://blog.kronis.dev/articles/goodbye-gitlab-hello-gitea-... With containers, it's actually a pretty good experience that's not too hard to setup or manage.
nightpool 5y ago
Self-hosted GitLab got a good callout yesterday from Microsoft, it appears to be a favorite of LAPSUS$: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/ https://www.microsoft.com/security/blog/2022/03/22/dev-0537-... Self-hosting always increases the operational burden of making sure your systems are secure. Maybe you have the engineering resources to spend on patching everything immediately and conducting in-house pen tests, but for most companies it's much, much more secure to let the software's developers host it as well.
- temp8964 5y ago
  Not necessarily. Self-hosted services are protected by company firewall / VPN. They can setup very restrictive network access. They don't have the same level of risks as public services like GitHub or GitLab.
  - hhh 5y ago
    Establishing an entry point via VPN is Lapsus$ primary first step.
- Melatonic 5y ago
  Except that the software developers hosting is also a much, much bigger target and you generally do not have any real control over how often they are patching either.
skeeter2020 5y ago
>> Setting up GitLab is fairly easy, in my company we do it and it's cheap (on-prem hosting is basically zero, and we had the IPs/domains already) In what tech company is hosting or domains the main cost centre? Many companies spend more on a single hour of a dev's time than their entire GH monthly bill.
- capitol_ 5y ago
  I think we pay about $10 per developer per month for github, and with about 1000 developers I would love that hourly rate.
  - kleebeesh 5y ago
    ...What? $10 x 1000 = $10k / month. $10k x 12 = $120k. That is a new grad software engineer salary in any US city. You'd pay more than that for a single dev with the devops and security experience to keep GHE running and patched for 1000 devs.
    - tjoff 5y ago
      Well, considering you'd likely spend an average of 5 minutes per day doing it I wouldn't mind it.
    - cortesoft 5y ago
      The person was replying to a comment saying they spend more on a SINGLE HOUR of a dev's time than the monthly GH bill, which is not true for an org of more than 20 people or so (depending on hourly rate).
      - kleebeesh 5y ago
        Ah, totally misread it. Thanks.
    - zeku 5y ago
      Just a bone to pick... new grad engineers in my US city started around 60-70k in 2018 when my college cohort graduated. Southern US...

xondono 5y ago

I’d say it depends, I run my own on prem server and gitlab was a PITA. Too many moving parts, updating took too much of my time, and I never felt “safe”. Moving to gitea solved all of those issues for me (thus far), now I’m looking into adding other stuff like CI through Drone.

edgyquant 5y ago
It definitely depends. We’re pretty early stage and I’m the senior engineer+infrastructure guy so running our own gitea instance or whatever is just more time that I’m almost out of.
Inversechi 5y ago
Did you consider woodpecker instead of drone? It's basically an evolved fork of the OSS version. https://woodpecker-ci.org/ https://woodpecker-ci.org/
- xondono 5y ago
  Didn’t even know about it. I’ll check it out. Thanks!
KronisLV 5y ago
Curiously, this was also my own experience! I actually wrote a bit about the migration process, as well as the reasons for migrating over to Gitea, Nexus and Drone CI as opposed to using GitLab, GitLab Registry and GitLab CI: https://blog.kronis.dev/articles/goodbye-gitlab-hello-gitea-nexus-and-drone https://blog.kronis.dev/articles/goodbye-gitlab-hello-gitea-... With containers, it's actually a pretty good experience that's not too hard to setup or manage.

nightpool 5y ago

Self-hosted GitLab got a good callout yesterday from Microsoft, it appears to be a favorite of LAPSUS$: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/ https://www.microsoft.com/security/blog/2022/03/22/dev-0537-... Self-hosting always increases the operational burden of making sure your systems are secure. Maybe you have the engineering resources to spend on patching everything immediately and conducting in-house pen tests, but for most companies it's much, much more secure to let the software's developers host it as well.

temp8964 5y ago
Not necessarily. Self-hosted services are protected by company firewall / VPN. They can setup very restrictive network access. They don't have the same level of risks as public services like GitHub or GitLab.
- hhh 5y ago
  Establishing an entry point via VPN is Lapsus$ primary first step.
Melatonic 5y ago
Except that the software developers hosting is also a much, much bigger target and you generally do not have any real control over how often they are patching either.

skeeter2020 5y ago

>> Setting up GitLab is fairly easy, in my company we do it and it's cheap (on-prem hosting is basically zero, and we had the IPs/domains already) In what tech company is hosting or domains the main cost centre? Many companies spend more on a single hour of a dev's time than their entire GH monthly bill.

capitol_ 5y ago
I think we pay about $10 per developer per month for github, and with about 1000 developers I would love that hourly rate.
- kleebeesh 5y ago
  ...What? $10 x 1000 = $10k / month. $10k x 12 = $120k. That is a new grad software engineer salary in any US city. You'd pay more than that for a single dev with the devops and security experience to keep GHE running and patched for 1000 devs.
  - tjoff 5y ago
    Well, considering you'd likely spend an average of 5 minutes per day doing it I wouldn't mind it.
  - cortesoft 5y ago
    The person was replying to a comment saying they spend more on a SINGLE HOUR of a dev's time than the monthly GH bill, which is not true for an org of more than 20 people or so (depending on hourly rate).
    - kleebeesh 5y ago
      Ah, totally misread it. Thanks.
  - zeku 5y ago
    Just a bone to pick... new grad engineers in my US city started around 60-70k in 2018 when my college cohort graduated. Southern US...