3 ms·

Be warned that Gitea has its own problems—the trademarks and domain were transferred to a for-profit entity (Gitea Ltd. [0]) and gitea.com is now being operated

Be warned that Gitea has its own problems—the trademarks and domain were transferred to a for-profit entity (Gitea Ltd. [0]) and gitea.com is now being operated by a different for-profit entity (CommitGo, Inc.). Given that Gitea Ltd. was created specifically to make money to fund the development of Gitea, it's concerning that they already felt the need to obfuscate the situation further with another company, with no real explanation for why. I think the Forgejo developers were correct that the transfer of the IP did not bode well for the future of the open source project. As for GitLab, I'm concerned by the fact that the company has become weirdly enterprise-y of late. This might not affect the self-hosted version yet, but I wasn't willing to risk it. I ended up going with Forgejo as the option with the least concerning governance structure. [0] https://news.ycombinator.com/item?id=33372471 https://news.ycombinator.com/item?id=33372471

remram 3y ago
My main problem with GitLab is not only that they have become very enterprise-y, having tons and tons of features to the point that it's impossible to find anything in the left menu. It's that they don't seem very good at it: it seems that every week, another critical security release comes out with a dozen very exploitable CVEs. Makes me feel like they can't write this many features correctly... Going back one month (see https://about.gitlab.com/releases/categories/releases/ https://about.gitlab.com/releases/categories/releases/): Feb 7: CVE-2024-1250 (medium, privilege escalation), CVE-2023-6840 (medium, bypass branch protection), CVE-2023-6386 (medium, ReDoS), CVE-2024-1066 (medium, DOS) Jan 25: CVE-2024-0402 (critical, unprivileged RCE), CVE-2023-6159 (medium, ReDoS), CVE-2023-5933 (medium, CSRF), CVE-2023-5612 (medium, info disclosure), CVE-2024-045 (medium, arbitrary change of ticket assignees) Jan 11: CVE-2023-7028 (critical, arbitrary account takeover without interaction), CVE-2023-4812 (high, bypass MR approval rules), CVE-2023-5356 (high, privilege escalation from Slack/Mattermost integration), CVE-2023-6955 (medium, run commands in Kubernetes cluster from another subgroup), CVE-2023-2030 (low, commit signature validation issue). Note that those are all GitLab issues, not issues with Git or SSH that affect the GitLab application. Running a self-hosted GitLab really keeps you on your toes...

remram 3y ago

My main problem with GitLab is not only that they have become very enterprise-y, having tons and tons of features to the point that it's impossible to find anything in the left menu. It's that they don't seem very good at it: it seems that every week, another critical security release comes out with a dozen very exploitable CVEs. Makes me feel like they can't write this many features correctly... Going back one month (see https://about.gitlab.com/releases/categories/releases/ https://about.gitlab.com/releases/categories/releases/): Feb 7: CVE-2024-1250 (medium, privilege escalation), CVE-2023-6840 (medium, bypass branch protection), CVE-2023-6386 (medium, ReDoS), CVE-2024-1066 (medium, DOS) Jan 25: CVE-2024-0402 (critical, unprivileged RCE), CVE-2023-6159 (medium, ReDoS), CVE-2023-5933 (medium, CSRF), CVE-2023-5612 (medium, info disclosure), CVE-2024-045 (medium, arbitrary change of ticket assignees) Jan 11: CVE-2023-7028 (critical, arbitrary account takeover without interaction), CVE-2023-4812 (high, bypass MR approval rules), CVE-2023-5356 (high, privilege escalation from Slack/Mattermost integration), CVE-2023-6955 (medium, run commands in Kubernetes cluster from another subgroup), CVE-2023-2030 (low, commit signature validation issue). Note that those are all GitLab issues, not issues with Git or SSH that affect the GitLab application. Running a self-hosted GitLab really keeps you on your toes...