5 ms·

Headquartered in the PRC Interesting, but no, thanks!

replwoacause 4y ago
Yeah I noticed that too. Sorry but no way I'm installing this given that.
jasonvorhe 4y ago
Looks like the company running this is simply located in a co-working space in China. Didn't know that just living in China made you a possible PRC asset.
- mthoms 4y ago
  All Chinese companies are possible PRC assets: https://www.cnbc.com/2019/03/05/huawei-would-have-to-give-data-to-china-government-if-asked-experts.html https://www.cnbc.com/2019/03/05/huawei-would-have-to-give-da... Note - I'm not commenting about whether these guys are PRC assets or not. Or whether there is anything nefarious going on at all. I'm just pointing out that they could be compelled to become assets, even if that's against their wishes.
  - dancemethis 4y ago
    I mean, and all US companies are possible NSA/CIA assets. Which is kinda worse because it was already proven more than once. Snowden and PRISM, anyone?
    - mthoms 4y ago
      Kinda worse? That's highly debatable. It's just a different risk profile. I personally don't expect the US government to take an interest in my activities, but I'm not as convinced about the Chinese for various reasons. More to your point, as far as I'm aware, individuals can't be forced under law to cooperate with US intelligence. In China, individuals have to cooperate - by law - and the penalties for non-compliance are harsh. In the case of an open source project maintained by individuals, that's an important consideration.
- thekevan 4y ago
  "living in China made you a possible PRC asset" Unfortunately, really anything coming out of China might be a PRC asset. We just wouldn't know unless it was too late.
jacooper 4y ago
I mean gitea is too, as long as its fully open source its OK for me personally.
- 29athrowaway 4y ago
  How do you know the packaged binaries were built from the published source?
  - jacooper 4y ago
    You don't. If you are paranoid you can just build it yourself!
    - LoganDark 4y ago
      How do you know your compiler was built from its published sources? :) https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
      - yencabulator 4y ago
        https://dwheeler.com/trusting-trust/ https://dwheeler.com/trusting-trust/
philtar 4y ago
[dead]

Yeah I noticed that too. Sorry but no way I'm installing this given that.

Looks like the company running this is simply located in a co-working space in China. Didn't know that just living in China made you a possible PRC asset.

mthoms 4y ago
All Chinese companies are possible PRC assets: https://www.cnbc.com/2019/03/05/huawei-would-have-to-give-data-to-china-government-if-asked-experts.html https://www.cnbc.com/2019/03/05/huawei-would-have-to-give-da... Note - I'm not commenting about whether these guys are PRC assets or not. Or whether there is anything nefarious going on at all. I'm just pointing out that they could be compelled to become assets, even if that's against their wishes.
- dancemethis 4y ago
  I mean, and all US companies are possible NSA/CIA assets. Which is kinda worse because it was already proven more than once. Snowden and PRISM, anyone?
  - mthoms 4y ago
    Kinda worse? That's highly debatable. It's just a different risk profile. I personally don't expect the US government to take an interest in my activities, but I'm not as convinced about the Chinese for various reasons. More to your point, as far as I'm aware, individuals can't be forced under law to cooperate with US intelligence. In China, individuals have to cooperate - by law - and the penalties for non-compliance are harsh. In the case of an open source project maintained by individuals, that's an important consideration.
thekevan 4y ago
"living in China made you a possible PRC asset" Unfortunately, really anything coming out of China might be a PRC asset. We just wouldn't know unless it was too late.

jacooper 4y ago

I mean gitea is too, as long as its fully open source its OK for me personally.

29athrowaway 4y ago
How do you know the packaged binaries were built from the published source?
- jacooper 4y ago
  You don't. If you are paranoid you can just build it yourself!
  - LoganDark 4y ago
    How do you know your compiler was built from its published sources? :) https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
    - yencabulator 4y ago
      https://dwheeler.com/trusting-trust/ https://dwheeler.com/trusting-trust/

philtar 4y ago

[dead]