5 ms·

ForgeFed: ActivityPub-based forge federation protocol

116 points by rapnie 1y ago

tomhow 1y ago
Previously: ForgeFed - https://news.ycombinator.com/item?id=37362088 https://news.ycombinator.com/item?id=37362088 - Sept 2023 (63 comments)
chrismorgan 1y ago
Is there any server actually using this so one can see it in action? They only seem to list Vervis, but the linked https://vervis.peers.community/ https://vervis.peers.community/ is down. Last obvious activity on the spec/issue tracker is a month ago (fairly recent), blog six months ago, forum a year ago. Sounds alive, but not particularly active.
- rapnie 1y ago
  See my other comment at https://news.ycombinator.com/item?id=44896910 https://news.ycombinator.com/item?id=44896910 .. community involvement determines progress. Especially since the goal is to mature open standard specification for the ActivityPub protocol extension there is a chicken/egg. The spec has most chance to become successful if there are early adopters who embrace the vision of forge federation.
xvilka 1y ago
Forgejo started implementing it but it's very far from being useful in practice yet. A lot of work needs to be done first[1], might take years, I guess. [1] https://codeberg.org/forgejo-contrib/federation/src/branch/main/FederationRoadmap.md https://codeberg.org/forgejo-contrib/federation/src/branch/m...
- rapnie 1y ago
  It all depends on interest from the developer community. Many devs are rooting for forge federation for years and are waiting for it to happen. Both Forgejo [0] and ForgeFed [1] are fully community-driven free software efforts, and things go as fast as there are people stepping up to do the work. The ActivityPub-related [2] epic at Gitlab [3], which I also linked in another comment, is another example. It is a ramp up to adding support for the ForgeFed protocol extension. Gitlab has mentioned they do not give high priority to the issue, but will leave it open for community contribution. At one point implementation-wise things went very fast here, until people involved got other duties. For everyone who'd love to see the fragmented landscape of separate self-hosted code forges become inter-connected and offer similar FOSS project discovery experience as Github: You can help make that a reality. Edit: I should of course also mention Codeberg [4] which runs Forgejo on their servers with some additional facilities for scaling to support their big community. An example where a centralized community hub starts to shape which may one day become a real competitor to Github (where it comes to hosting FOSS repo's). [0] https://forgejo.org https://forgejo.org [1] https://forgefed.org https://forgefed.org [2] https://www.w3.org/TR/activitypub/ https://www.w3.org/TR/activitypub/ [3] https://gitlab.com/groups/gitlab-org/-/epics/11247 https://gitlab.com/groups/gitlab-org/-/epics/11247 [4] https://codeberg.org https://codeberg.org
tough 1y ago
im gonna bet this was gpt-5 as patio11 mentioned 1 line suggestion > It’s a little rich, pardon the pun, to cash a check for $20 billion and then whine about fintechs freeriding on your IT spend.
- chrismorgan 1y ago
  I think you posted on the wrong thread.
  - tough 1y ago
    yes, weird, lol
bobajeff 1y ago
Okay, so this is actually GitHub's mastodon. I'm down. Honestly, i was just thinking of moving to Gitlab because I have a feeling GitHub might start being terrible soon.
- rapnie 1y ago
  At Gitlab there is this epic working on ActivityPub support: https://gitlab.com/groups/gitlab-org/-/epics/11247 https://gitlab.com/groups/gitlab-org/-/epics/11247
  - rglullis 1y ago
    They are not going to do anything about it. The issue was closed last month. Some vocal people complained, then the PM reopened but made it clear that federation is not their priority: https://gitlab.com/groups/gitlab-org/-/epics/11247#note_2603598572 https://gitlab.com/groups/gitlab-org/-/epics/11247#note_2603...
    - rapnie 1y ago
      Indeed. But all the work done before that are community contributions. They reopened to allow that kind of work to continue. If there's enough community interest, then Gitlab will become a federated forge most likely.
- sschueller 1y ago
  Gitlab is a monster to host for your own small amount of projects. If I where to start fresh I would go with https://forgejo.org/ https://forgejo.org/ I am also a bit worried how gitlab has changed its pricing not so long ago and the clear push to go towards maximum profit regardless if it's users are still getting a good product.
  - franga2000 1y ago
    I use GitLab for essentially everything and I haven't noticed anything get worse. It's constantly getting new features and many of them are very enterprise-focused, but they don't make the everyday user's experience worse, you can mostly just ignore them.
mudkipdev 1y ago
Could be similar: https://tangled.sh https://tangled.sh
- brunoqc 1y ago
  and tangled supports jujutsu change-ids.
- evbogue 1y ago
  Tangled is cool, but it makes me long for the good old days when we had git-ssb: https://git.woodbine.nyc/cel/git-ssb https://git.woodbine.nyc/cel/git-ssb
  - ptman 1y ago
    Isn't radicle quite similar? https://radicle.xyz/ https://radicle.xyz/
    - discardedrefuse 1y ago
      You are correct. Someone posted about Radicle here a couple days ago[1] and went down that rabbit hole. The user docs say that their p2p network draws inspiration for Secure Scuttlebutt's gossip protocol. I'm not 100% sold on federation / activitypub in its current state. I think p2p is far more interesting. With Radicle, you don't have to run a server (which, if Mastodon is anything to go by, is a lot of overhead). So anyone can try it! Radicle is ready to use right now. [1] https://news.ycombinator.com/item?id=44874945 https://news.ycombinator.com/item?id=44874945
DeepYogurt 1y ago
Ya sure whatever. Forgejo is already awesome, just give me a host I can pay for enterprise support
- rapnie 1y ago
  And if you just need a great forge for your company's dev teams you are all good to go. OTOH if you self-host a popular FOSS project then all of the network effects of hosting your repo on Github are gone. If you are a quite large project, such as Fedora who chose Forgejo [0] then it is fine to have a dedicated forge. If your small library repositories are hosted on single-person or small community self-hosted instances, then there is a lot of benefit if the forges hooked into this larger software development social network. [0] https://communityblog.fedoraproject.org/fedora-chooses-forgejo/ https://communityblog.fedoraproject.org/fedora-chooses-forge...
- cimnine 1y ago
  Talk to https://www.codey.ch/ https://www.codey.ch/.
  - rapnie 1y ago
    There are a couple more among public Forgejo instances [0]. For instance, though it is not very clear what they offer exactly, CodeFloe [1] mentions priced tiers in their FAQ. > The priced tiers only exist to cover additional hardware costs of individual users which require extended resources for storage and CI/CD (CPU/Mem) in a transparent manner. [0] https://delightful.coding.social/delightful-forgejo/#public-instances https://delightful.coding.social/delightful-forgejo/#public-... [1] https://codefloe.com/ https://codefloe.com/
  - styanax 1y ago
    Sadly, as soon as I open the site in a private window with access to Notifications denied, a full page error screen about "Odoo Client Error" appears asking you to report... something.... to someone...? Not a good look at all. Screenshot: https://postimg.cc/WFDzQndC https://postimg.cc/WFDzQndC
WD-42 1y ago
This is the dream right? Self host all your repos but still have contact with the community. The other alternative forges like forejo are cool but feel like simply turning the clock back on GitHub.
- Black616Angel 1y ago
  I think you are mixing things up. Forgejo is one of the soon implementing, self-hostable software forges and one of the 3 listed implementations. Codeberg is the (Github-alike) central forgejo server, where the team develops and which is also available for general open source coding needs. ForgeFed issues are tracked on Codeberg, so they already show their interest.
- bigfishrunning 1y ago
  Given github's reliability trend, maybe turning the clock back isn't such a bad thing...
- zoobab 1y ago
  Self host on my phone. Automatic replication so that 3 copies are always available through the network, even in 50 years.
rapnie 1y ago
Git-bug [0] added request for ForgeFed-based federation support to Triage last April [1]. [0] https://github.com/git-bug/git-bug https://github.com/git-bug/git-bug [1] https://github.com/git-bug/git-bug/issues/172 https://github.com/git-bug/git-bug/issues/172
tcfhgj 1y ago
I hope ActivityPub is the right protocol for this. I have been using Mastodon for a couple of years now and frequently can't access media which is more than a couple days old from other servers, and I see only a subset of the replies, toots and stars...
- vidarh 1y ago
  The media issue has nothing to do with the protocol itself, and everything to do with servers that choose to expire remote content. The "subset of the replies" issue likewise isn't inherent, but is somewhat more problematic as it requires everyone to behave in ways that makes it work, e.g. push replies back to the origin server, and regularly poll the origin for additional replies etc., and Mastodon itself is not great at his. To the extent AcitivityPub itself is affecting any of it, it's only in the sense that ActivityPub imposes very few constraints on implementations, and that leaves a lot of room for specific applications to behave in counter-productive ways..
  - styanax 1y ago
    A problem I've seen emerge in the Lemmy side of ActivityPub is that it relies on a hub and spoke model. In practice this has failed when the hub goes offline, all the spokes are now left with independent copies of it's last known state and destroys the community progress (have to rebuild elsewhere, lose old content and references, etc.) if even you can regrow the community. Mastodon has the similar problem but worse with content discovery; a user is not "seen" remotely by anyone until one remote person finds them and subscribes to their content explicitly. On every single remote instance, which of course is undesirable but that's how ActivityPub is designed. I don't believe in ForgeFed terms this matters as much as being able to search across the federated network for repos, etc. which I think is a key feature. Sure issues and user accounts and whatnot, but an AP-linked FF-wide search would be insane on how useful it could be for users (and how to implement a "distributed search index" seems like a tough nut to crack).
    - vidarh 1y ago
      A search is pretty "easy" (doing it distributed is just more expensive in terms of resources than a single index, because you end up doing multiple searches in parallel and merging results) - the main issue with search on the Mastodon side of things have been politics. That is, a lot of people like that discovery isn't as easy as searching. For subsets of the Fediverse where people actually agree search is a good thing or if the software specifically indicates consent or not, it'd be fairly straightforward to provide. For Lemmy the hub and spoke model is essentially intentional - groups "belong" to a specific instance. But there's nothing in ActivityPub that'd prevent a USENET style model of groups either. There's nothing in ActivityPub that prevetns an application where a collection is effectively open to writing by all, and that would then relay messages to a sufficient set of "downstream" instances. It'd be interesting to have that as an alternative to the Lemmy approach - I think the two could live quite well side by side.
benrutter 1y ago
> Without federation, we end up having to choose between: > Centralizing into huge profit-oriented websites, where we're powerless > Hosting our code on a small website where we're in control and freedom but isolated from the community Yes, yes, yes, yes!!!! This would be a huge boost for everyone. I'm sure I'm not alone in disliking github, but begrudgingly using it quite a lot[0] because realistically, the alternatives create barriers to entry for a lot of people. I think this will take a long time to catch on, but hopefully in several years time, the point where all the world's open source projects were beholden to a single tech giant will seem like a strange footnote. [0] I've shifted a lot of projects to codeberg, but still mirror them all to github.
blessedcavapoo1 1y ago
[dead]
myaccountonhn 1y ago
I still believe that it'd be easier to add better tooling to the already existing email integration. Nothing is stopping a desktop app to allow users to easily set up git+email and view/comment/preview/apply patches in a clean and easy-to-use interface. Activitypub just brings so much complexity. Activitypub works best when you're not using it like a website but rather have a dedicated "activitypub" client. Otherwise you'll visit a repo, try to add a pr/issue/etc, it will ask you to sign in to your instance. You'll be redirected, sign in and then see the same repo but on your instance where you can then do the operations. The whole UX is just really confusing. Any new forge that wishes to partake in this social network also has a massive task ahead of it, because creating an activitypub integration is a lot of work. It's not easy. Most importantly, people are already signed up to email, so the account signup part is already done too.
- xeonmc 1y ago
  What if pull requests are accepted via a Delta Chat channel? Reusing chatmail infrastructure to deliver .patch files essentially.
curtisszmania 1y ago
[dead]

116 points by rapnie 1y ago

Previously: ForgeFed - https://news.ycombinator.com/item?id=37362088 https://news.ycombinator.com/item?id=37362088 - Sept 2023 (63 comments)

chrismorgan 1y ago

Is there any server actually using this so one can see it in action? They only seem to list Vervis, but the linked https://vervis.peers.community/ https://vervis.peers.community/ is down. Last obvious activity on the spec/issue tracker is a month ago (fairly recent), blog six months ago, forum a year ago. Sounds alive, but not particularly active.

rapnie 1y ago
See my other comment at https://news.ycombinator.com/item?id=44896910 https://news.ycombinator.com/item?id=44896910 .. community involvement determines progress. Especially since the goal is to mature open standard specification for the ActivityPub protocol extension there is a chicken/egg. The spec has most chance to become successful if there are early adopters who embrace the vision of forge federation.

xvilka 1y ago

Forgejo started implementing it but it's very far from being useful in practice yet. A lot of work needs to be done first[1], might take years, I guess. [1] https://codeberg.org/forgejo-contrib/federation/src/branch/main/FederationRoadmap.md https://codeberg.org/forgejo-contrib/federation/src/branch/m...

rapnie 1y ago
It all depends on interest from the developer community. Many devs are rooting for forge federation for years and are waiting for it to happen. Both Forgejo [0] and ForgeFed [1] are fully community-driven free software efforts, and things go as fast as there are people stepping up to do the work. The ActivityPub-related [2] epic at Gitlab [3], which I also linked in another comment, is another example. It is a ramp up to adding support for the ForgeFed protocol extension. Gitlab has mentioned they do not give high priority to the issue, but will leave it open for community contribution. At one point implementation-wise things went very fast here, until people involved got other duties. For everyone who'd love to see the fragmented landscape of separate self-hosted code forges become inter-connected and offer similar FOSS project discovery experience as Github: You can help make that a reality. Edit: I should of course also mention Codeberg [4] which runs Forgejo on their servers with some additional facilities for scaling to support their big community. An example where a centralized community hub starts to shape which may one day become a real competitor to Github (where it comes to hosting FOSS repo's). [0] https://forgejo.org https://forgejo.org [1] https://forgefed.org https://forgefed.org [2] https://www.w3.org/TR/activitypub/ https://www.w3.org/TR/activitypub/ [3] https://gitlab.com/groups/gitlab-org/-/epics/11247 https://gitlab.com/groups/gitlab-org/-/epics/11247 [4] https://codeberg.org https://codeberg.org

tough 1y ago

im gonna bet this was gpt-5 as patio11 mentioned 1 line suggestion > It’s a little rich, pardon the pun, to cash a check for $20 billion and then whine about fintechs freeriding on your IT spend.

chrismorgan 1y ago
I think you posted on the wrong thread.
- tough 1y ago
  yes, weird, lol

bobajeff 1y ago

Okay, so this is actually GitHub's mastodon. I'm down. Honestly, i was just thinking of moving to Gitlab because I have a feeling GitHub might start being terrible soon.

rapnie 1y ago
At Gitlab there is this epic working on ActivityPub support: https://gitlab.com/groups/gitlab-org/-/epics/11247 https://gitlab.com/groups/gitlab-org/-/epics/11247
- rglullis 1y ago
  They are not going to do anything about it. The issue was closed last month. Some vocal people complained, then the PM reopened but made it clear that federation is not their priority: https://gitlab.com/groups/gitlab-org/-/epics/11247#note_2603598572 https://gitlab.com/groups/gitlab-org/-/epics/11247#note_2603...
  - rapnie 1y ago
    Indeed. But all the work done before that are community contributions. They reopened to allow that kind of work to continue. If there's enough community interest, then Gitlab will become a federated forge most likely.
sschueller 1y ago
Gitlab is a monster to host for your own small amount of projects. If I where to start fresh I would go with https://forgejo.org/ https://forgejo.org/ I am also a bit worried how gitlab has changed its pricing not so long ago and the clear push to go towards maximum profit regardless if it's users are still getting a good product.
- franga2000 1y ago
  I use GitLab for essentially everything and I haven't noticed anything get worse. It's constantly getting new features and many of them are very enterprise-focused, but they don't make the everyday user's experience worse, you can mostly just ignore them.

mudkipdev 1y ago

Could be similar: https://tangled.sh https://tangled.sh

brunoqc 1y ago
and tangled supports jujutsu change-ids.
evbogue 1y ago
Tangled is cool, but it makes me long for the good old days when we had git-ssb: https://git.woodbine.nyc/cel/git-ssb https://git.woodbine.nyc/cel/git-ssb
- ptman 1y ago
  Isn't radicle quite similar? https://radicle.xyz/ https://radicle.xyz/
  - discardedrefuse 1y ago
    You are correct. Someone posted about Radicle here a couple days ago[1] and went down that rabbit hole. The user docs say that their p2p network draws inspiration for Secure Scuttlebutt's gossip protocol. I'm not 100% sold on federation / activitypub in its current state. I think p2p is far more interesting. With Radicle, you don't have to run a server (which, if Mastodon is anything to go by, is a lot of overhead). So anyone can try it! Radicle is ready to use right now. [1] https://news.ycombinator.com/item?id=44874945 https://news.ycombinator.com/item?id=44874945

DeepYogurt 1y ago

Ya sure whatever. Forgejo is already awesome, just give me a host I can pay for enterprise support

rapnie 1y ago
And if you just need a great forge for your company's dev teams you are all good to go. OTOH if you self-host a popular FOSS project then all of the network effects of hosting your repo on Github are gone. If you are a quite large project, such as Fedora who chose Forgejo [0] then it is fine to have a dedicated forge. If your small library repositories are hosted on single-person or small community self-hosted instances, then there is a lot of benefit if the forges hooked into this larger software development social network. [0] https://communityblog.fedoraproject.org/fedora-chooses-forgejo/ https://communityblog.fedoraproject.org/fedora-chooses-forge...
cimnine 1y ago
Talk to https://www.codey.ch/ https://www.codey.ch/.
- rapnie 1y ago
  There are a couple more among public Forgejo instances [0]. For instance, though it is not very clear what they offer exactly, CodeFloe [1] mentions priced tiers in their FAQ. > The priced tiers only exist to cover additional hardware costs of individual users which require extended resources for storage and CI/CD (CPU/Mem) in a transparent manner. [0] https://delightful.coding.social/delightful-forgejo/#public-instances https://delightful.coding.social/delightful-forgejo/#public-... [1] https://codefloe.com/ https://codefloe.com/
- styanax 1y ago
  Sadly, as soon as I open the site in a private window with access to Notifications denied, a full page error screen about "Odoo Client Error" appears asking you to report... something.... to someone...? Not a good look at all. Screenshot: https://postimg.cc/WFDzQndC https://postimg.cc/WFDzQndC

WD-42 1y ago

This is the dream right? Self host all your repos but still have contact with the community. The other alternative forges like forejo are cool but feel like simply turning the clock back on GitHub.

Black616Angel 1y ago
I think you are mixing things up. Forgejo is one of the soon implementing, self-hostable software forges and one of the 3 listed implementations. Codeberg is the (Github-alike) central forgejo server, where the team develops and which is also available for general open source coding needs. ForgeFed issues are tracked on Codeberg, so they already show their interest.
bigfishrunning 1y ago
Given github's reliability trend, maybe turning the clock back isn't such a bad thing...
zoobab 1y ago
Self host on my phone. Automatic replication so that 3 copies are always available through the network, even in 50 years.

rapnie 1y ago

Git-bug [0] added request for ForgeFed-based federation support to Triage last April [1]. [0] https://github.com/git-bug/git-bug https://github.com/git-bug/git-bug [1] https://github.com/git-bug/git-bug/issues/172 https://github.com/git-bug/git-bug/issues/172

tcfhgj 1y ago

I hope ActivityPub is the right protocol for this. I have been using Mastodon for a couple of years now and frequently can't access media which is more than a couple days old from other servers, and I see only a subset of the replies, toots and stars...

vidarh 1y ago
The media issue has nothing to do with the protocol itself, and everything to do with servers that choose to expire remote content. The "subset of the replies" issue likewise isn't inherent, but is somewhat more problematic as it requires everyone to behave in ways that makes it work, e.g. push replies back to the origin server, and regularly poll the origin for additional replies etc., and Mastodon itself is not great at his. To the extent AcitivityPub itself is affecting any of it, it's only in the sense that ActivityPub imposes very few constraints on implementations, and that leaves a lot of room for specific applications to behave in counter-productive ways..
- styanax 1y ago
  A problem I've seen emerge in the Lemmy side of ActivityPub is that it relies on a hub and spoke model. In practice this has failed when the hub goes offline, all the spokes are now left with independent copies of it's last known state and destroys the community progress (have to rebuild elsewhere, lose old content and references, etc.) if even you can regrow the community. Mastodon has the similar problem but worse with content discovery; a user is not "seen" remotely by anyone until one remote person finds them and subscribes to their content explicitly. On every single remote instance, which of course is undesirable but that's how ActivityPub is designed. I don't believe in ForgeFed terms this matters as much as being able to search across the federated network for repos, etc. which I think is a key feature. Sure issues and user accounts and whatnot, but an AP-linked FF-wide search would be insane on how useful it could be for users (and how to implement a "distributed search index" seems like a tough nut to crack).
  - vidarh 1y ago
    A search is pretty "easy" (doing it distributed is just more expensive in terms of resources than a single index, because you end up doing multiple searches in parallel and merging results) - the main issue with search on the Mastodon side of things have been politics. That is, a lot of people like that discovery isn't as easy as searching. For subsets of the Fediverse where people actually agree search is a good thing or if the software specifically indicates consent or not, it'd be fairly straightforward to provide. For Lemmy the hub and spoke model is essentially intentional - groups "belong" to a specific instance. But there's nothing in ActivityPub that'd prevent a USENET style model of groups either. There's nothing in ActivityPub that prevetns an application where a collection is effectively open to writing by all, and that would then relay messages to a sufficient set of "downstream" instances. It'd be interesting to have that as an alternative to the Lemmy approach - I think the two could live quite well side by side.

benrutter 1y ago

> Without federation, we end up having to choose between: > Centralizing into huge profit-oriented websites, where we're powerless > Hosting our code on a small website where we're in control and freedom but isolated from the community Yes, yes, yes, yes!!!! This would be a huge boost for everyone. I'm sure I'm not alone in disliking github, but begrudgingly using it quite a lot[0] because realistically, the alternatives create barriers to entry for a lot of people. I think this will take a long time to catch on, but hopefully in several years time, the point where all the world's open source projects were beholden to a single tech giant will seem like a strange footnote. [0] I've shifted a lot of projects to codeberg, but still mirror them all to github.

blessedcavapoo1 1y ago

[dead]

myaccountonhn 1y ago

I still believe that it'd be easier to add better tooling to the already existing email integration. Nothing is stopping a desktop app to allow users to easily set up git+email and view/comment/preview/apply patches in a clean and easy-to-use interface. Activitypub just brings so much complexity. Activitypub works best when you're not using it like a website but rather have a dedicated "activitypub" client. Otherwise you'll visit a repo, try to add a pr/issue/etc, it will ask you to sign in to your instance. You'll be redirected, sign in and then see the same repo but on your instance where you can then do the operations. The whole UX is just really confusing. Any new forge that wishes to partake in this social network also has a massive task ahead of it, because creating an activitypub integration is a lot of work. It's not easy. Most importantly, people are already signed up to email, so the account signup part is already done too.

xeonmc 1y ago
What if pull requests are accepted via a Delta Chat channel? Reusing chatmail infrastructure to deliver .patch files essentially.

curtisszmania 1y ago

[dead]