3 ms·

It would be generally be a good idea to migrate away from this to something else, I use gitbucket, and it works very well for me. Yes it is an open source proj

It would be generally be a good idea to migrate away from this to something else, I use gitbucket, and it works very well for me. Yes it is an open source project, but the entire team that works on it is based out in China, and that's really not something you want to play games with.

Zababa 4y ago
Has there been any issues because of that, or is this just speculation on your part? The codebase is open source so it's not like they can hide anything.
- bioemerl 4y ago
  It's not so much about the issues, but the potential for issues down the line. For tools like this the aim is always to lay low and expand to reach as far as possible, then once you have a lot of control and trust you can abuse it, often you can abuse it without much loss, because once you have institutional momentum it's very hard to screw it up. You can't operate on If there's a history of abuse of power, only if there is an incentive. I believe there's a very strong incentive in this case.
  - Zababa 4y ago
    I don't really see how can an open source project that you can self host be abused. Do you have any example of that happening?
    - bioemerl 4y ago
      All you need to do is sneak in something in an update that gives people access to your server, or creates a vulnerability that allows them to get access. The fact that itself hosted is actually a really huge concern, because this thing is sitting on your local network with no firewall between it and everything else that you run. It takes very little to put a vulnerability in a piece of code, and unless you have a person combing every commit with a fine tooth comb, even the fact that it's open source cannot prevent that. No single security measure is bulletproof. Being open source does not counteract the misaligned incentives.
- roastedpeacock 4y ago
  I am no Sinophobe but I think the pragmatic concern is by being under P.R.C jurisdiction 'certain parties' could either force abandonment of the project by (some of) the original team or compel certain code changes that may not be in the users interest. No offense to anyone and do not want to imply anything nefarious is about but from what I remember Gogs was even worse in that only a single maintainer inside P.R.C had merge access to the main branch. Also a concern because I might remember something about known vulnerabilities having been outstanding on the issue-tracker when the maintainer was busy.
matsemann 4y ago
In that vein, as a European I'm generally more afraid of US. How they can force anyone to give up my secrets. Or the power of Google, MS, Facebook to screw me over.
- bioemerl 4y ago
  The alternative project I mentioned is actually mostly developed by Japanese developers.
rascul 4y ago
> Yes it is an open source project, but the entire team that works on it is based out in China, and that's really not something you want to play games with. Maybe you could expand on why this is an issue.
- bioemerl 4y ago
  China is a country that has been well well known for theft of intellectual property for a couple of decades now, and when the majority of the people developing the project live inside of the borders of China their state has an incredible ability to control the direction of the project and sneak in bad changes over time should they want to. The fact that it's open source helps a little bit, but I do not believe they number of eyes on the project is enough that they couldn't sneak something through if they wanted to. This isn't Linux with worldwide attention, it's a relative niche.
deleted 4y ago
[deleted]
DethNinja 4y ago
Do you got any proof about "entire team" being based in China? It looks like they got developers from bunch of other locations at least according to their Github activity.
- bioemerl 4y ago
  If it's the entire team or not doesn't really matter, what matters is is that the locus of control, the people who really own the project and commit most of the changes are all based in China. But you are correct, they do get commits from outside of the country

Zababa 4y ago

Has there been any issues because of that, or is this just speculation on your part? The codebase is open source so it's not like they can hide anything.

bioemerl 4y ago
It's not so much about the issues, but the potential for issues down the line. For tools like this the aim is always to lay low and expand to reach as far as possible, then once you have a lot of control and trust you can abuse it, often you can abuse it without much loss, because once you have institutional momentum it's very hard to screw it up. You can't operate on If there's a history of abuse of power, only if there is an incentive. I believe there's a very strong incentive in this case.
- Zababa 4y ago
  I don't really see how can an open source project that you can self host be abused. Do you have any example of that happening?
  - bioemerl 4y ago
    All you need to do is sneak in something in an update that gives people access to your server, or creates a vulnerability that allows them to get access. The fact that itself hosted is actually a really huge concern, because this thing is sitting on your local network with no firewall between it and everything else that you run. It takes very little to put a vulnerability in a piece of code, and unless you have a person combing every commit with a fine tooth comb, even the fact that it's open source cannot prevent that. No single security measure is bulletproof. Being open source does not counteract the misaligned incentives.
roastedpeacock 4y ago
I am no Sinophobe but I think the pragmatic concern is by being under P.R.C jurisdiction 'certain parties' could either force abandonment of the project by (some of) the original team or compel certain code changes that may not be in the users interest. No offense to anyone and do not want to imply anything nefarious is about but from what I remember Gogs was even worse in that only a single maintainer inside P.R.C had merge access to the main branch. Also a concern because I might remember something about known vulnerabilities having been outstanding on the issue-tracker when the maintainer was busy.

matsemann 4y ago

In that vein, as a European I'm generally more afraid of US. How they can force anyone to give up my secrets. Or the power of Google, MS, Facebook to screw me over.

bioemerl 4y ago
The alternative project I mentioned is actually mostly developed by Japanese developers.

rascul 4y ago

> Yes it is an open source project, but the entire team that works on it is based out in China, and that's really not something you want to play games with. Maybe you could expand on why this is an issue.

bioemerl 4y ago
China is a country that has been well well known for theft of intellectual property for a couple of decades now, and when the majority of the people developing the project live inside of the borders of China their state has an incredible ability to control the direction of the project and sneak in bad changes over time should they want to. The fact that it's open source helps a little bit, but I do not believe they number of eyes on the project is enough that they couldn't sneak something through if they wanted to. This isn't Linux with worldwide attention, it's a relative niche.

deleted 4y ago

[deleted]

DethNinja 4y ago

Do you got any proof about "entire team" being based in China? It looks like they got developers from bunch of other locations at least according to their Github activity.

bioemerl 4y ago
If it's the entire team or not doesn't really matter, what matters is is that the locus of control, the people who really own the project and commit most of the changes are all based in China. But you are correct, they do get commits from outside of the country