3 ms·

The big problem is people have been trained to think that centralized authority is a necessary precondition for security. Just look at the state of browsers gat

The big problem is people have been trained to think that centralized authority is a necessary precondition for security. Just look at the state of browsers gating access to APIs for sites on local sub networks. We have created a two tier WWW. But the security concerns are not without basis, yet doing things like coming up with a secure replacement for mdns is not exactly aligned with the interest of organizations that want all information to go via the cloud, and they will fight it tooth and nail. As tech people we really should put our money where our mouths are on this and stop using github, and in doing so fix the pain points.

robertlagrant 3y ago
> The big problem is people have been trained to think that centralized authority is a necessary precondition for security. Just look at the state of browsers gating access to APIs for sites on local sub networks. We have created a two tier WWW. Most people wouldn't in any way think like or even about this. Which people do you mean?
- Geisterde 3y ago
  Every single person that thoughtlessly backs up their data to cloud storage, so basically everyone outside of a few weirdos like us.
maccard 3y ago
> Just look at the state of browsers gating access to APIs for sites on local sub networks. Given we're on HN I think it's fair to nitpick a bit - what do you mean here? What API are you accessing through a browser? If it's a control panel or something through an API, you can install a cert into the browser, or get a wildcard cert signed for a local domain.
quickthrower2 3y ago
Github for work is so productive though! At home yeah just use git and have a backup and you are done.
- znpy 3y ago
  Gitlab is as productive if not more, without the need to be a central authority
  - eropple 3y ago
    GitLab is fine-I-guess, we use it at work--but at home I use GitHub and self-hosted runners because GitHub Actions is great and GitLab CI isn't nearly as comfortable to use. And I don't want to host GitLab and another CI, which also involves learning a third CI platform other than the one I use for work and the one I like. GitHub Actions turns out to be maybe the best CI out there these days for low-friction, get-it-out-there stuff, and there's probably a lesson or three to be learned in there too.
    - sureglymop 3y ago
      Could run Forgejo with the act Actions runner. Iirc they are also working on building federation right into the platform (Gitlab as well).
      - eropple 3y ago
        That looks pretty interesting - I have a setup that works comfortably for me right now, but it's nice to see maybe-a-future there.
indigochill 3y ago
> As tech people we really should put our money where our mouths are on this and stop using github, and in doing so fix the pain points. Github is (in my mind at least) just one manifestation of this, but yeah, I host my own Forgejo (a fork of Gitea) instance for personal projects. Also trying to get the company to switch to Gitlab (especially since I strongly prefer its CI/CD to TeamCity), but I'm against a lot of organizational inertia there so that's not really a fight I expect to win.
m3047 3y ago
> The big problem is people have been trained to think that centralized authority is a necessary precondition for security. I think that's inverted, but not in the way that you think it is inverted. I think the map that fits looks more like centralized authority builds the systems that serves its needs (and they're identifiable as such because they were built by a centralized authority with no inclination to hide its efforts, and maybe even incentives to advertise them). I'd like to know more about this though: > Just look at the state of browsers gating access to APIs for sites on local sub networks. We have created a two tier WWW. Because I don't see it (the first part). I don't agree wholly with the second part either, because I do defense in depth and I don't entirely trust my own network. But barring those measures / tastes yes there would be two classes of services, internal and external. This is pretty old school, along with the DMZ third wheel. So what do you mean by that?

robertlagrant 3y ago

> The big problem is people have been trained to think that centralized authority is a necessary precondition for security. Just look at the state of browsers gating access to APIs for sites on local sub networks. We have created a two tier WWW. Most people wouldn't in any way think like or even about this. Which people do you mean?

Geisterde 3y ago
Every single person that thoughtlessly backs up their data to cloud storage, so basically everyone outside of a few weirdos like us.

maccard 3y ago

> Just look at the state of browsers gating access to APIs for sites on local sub networks. Given we're on HN I think it's fair to nitpick a bit - what do you mean here? What API are you accessing through a browser? If it's a control panel or something through an API, you can install a cert into the browser, or get a wildcard cert signed for a local domain.

quickthrower2 3y ago

Github for work is so productive though! At home yeah just use git and have a backup and you are done.

znpy 3y ago
Gitlab is as productive if not more, without the need to be a central authority
- eropple 3y ago
  GitLab is fine-I-guess, we use it at work--but at home I use GitHub and self-hosted runners because GitHub Actions is great and GitLab CI isn't nearly as comfortable to use. And I don't want to host GitLab and another CI, which also involves learning a third CI platform other than the one I use for work and the one I like. GitHub Actions turns out to be maybe the best CI out there these days for low-friction, get-it-out-there stuff, and there's probably a lesson or three to be learned in there too.
  - sureglymop 3y ago
    Could run Forgejo with the act Actions runner. Iirc they are also working on building federation right into the platform (Gitlab as well).
    - eropple 3y ago
      That looks pretty interesting - I have a setup that works comfortably for me right now, but it's nice to see maybe-a-future there.

indigochill 3y ago

> As tech people we really should put our money where our mouths are on this and stop using github, and in doing so fix the pain points. Github is (in my mind at least) just one manifestation of this, but yeah, I host my own Forgejo (a fork of Gitea) instance for personal projects. Also trying to get the company to switch to Gitlab (especially since I strongly prefer its CI/CD to TeamCity), but I'm against a lot of organizational inertia there so that's not really a fight I expect to win.

m3047 3y ago

> The big problem is people have been trained to think that centralized authority is a necessary precondition for security. I think that's inverted, but not in the way that you think it is inverted. I think the map that fits looks more like centralized authority builds the systems that serves its needs (and they're identifiable as such because they were built by a centralized authority with no inclination to hide its efforts, and maybe even incentives to advertise them). I'd like to know more about this though: > Just look at the state of browsers gating access to APIs for sites on local sub networks. We have created a two tier WWW. Because I don't see it (the first part). I don't agree wholly with the second part either, because I do defense in depth and I don't entirely trust my own network. But barring those measures / tastes yes there would be two classes of services, internal and external. This is pretty old school, along with the DMZ third wheel. So what do you mean by that?