Hacker News Reader

Comment by CaptainFever | Hacker News Reader

This is interesting. I run a Forgejo instance but if the project is really more of an Ayo.js (over-interested in governance and office politics, under-interested in coding), I would consider Gitea or Gitlab instead. Do you have a source? I can't find anything about this online.

View on HN

Be warned that Gitea has its own problems—the trademarks and domain were transferred to a for-profit entity (Gitea Ltd. [0]) and gitea.com is now being operated by a different for-profit entity (CommitGo, Inc.). Given that Gitea Ltd. was created specifically to make money to fund the development of Gitea, it's concerning that they already felt the need to obfuscate the situation further with another company, with no real explanation for why. I think the Forgejo developers were correct that the transfer of the IP did not bode well for the future of the open source project.

As for GitLab, I'm concerned by the fact that the company has become weirdly enterprise-y of late. This might not affect the self-hosted version yet, but I wasn't willing to risk it. I ended up going with Forgejo as the option with the least concerning governance structure.

[0] https://news.ycombinator.com/item?id=33372471

My main problem with GitLab is not only that they have become very enterprise-y, having tons and tons of features to the point that it's impossible to find anything in the left menu. It's that they don't seem very good at it: it seems that every week, another critical security release comes out with a dozen very exploitable CVEs. Makes me feel like they can't write this many features correctly...

Going back one month (see https://about.gitlab.com/releases/categories/releases/):

Feb 7: CVE-2024-1250 (medium, privilege escalation), CVE-2023-6840 (medium, bypass branch protection), CVE-2023-6386 (medium, ReDoS), CVE-2024-1066 (medium, DOS)

Jan 25: CVE-2024-0402 (critical, unprivileged RCE), CVE-2023-6159 (medium, ReDoS), CVE-2023-5933 (medium, CSRF), CVE-2023-5612 (medium, info disclosure), CVE-2024-045 (medium, arbitrary change of ticket assignees)

Jan 11: CVE-2023-7028 (critical, arbitrary account takeover without interaction), CVE-2023-4812 (high, bypass MR approval rules), CVE-2023-5356 (high, privilege escalation from Slack/Mattermost integration), CVE-2023-6955 (medium, run commands in Kubernetes cluster from another subgroup), CVE-2023-2030 (low, commit signature validation issue).

Note that those are all GitLab issues, not issues with Git or SSH that affect the GitLab application. Running a self-hosted GitLab really keeps you on your toes...

This was a year or 2 ago - I didn't save specific links. However, if you're interested, you can poke around in https://codeberg.org/forgejo/meta. Below are two that I just found now that represent the kinds of things I saw at the time that concerned me. There were teams being formed and dissolved and multiple accusations of CoC violations flying around with lengthy, passionate discussions being had on these topics. It gave me a strong vibe of a group of people that was way more concerned with the power and control aspects of a project than the engineering.

There's also the behavior that others have linked in comments here about the fact that they have people designated as "enforcers" who edit/remove content and comments they don't like.

YMMV.

https://codeberg.org/forgejo/meta/issues/176

https://codeberg.org/forgejo/meta/issues/146

This whole HN story is about Forgejo doing a hard fork and focusing on their own code instead of relying on Gitea, so I don't think calling them under-interested in coding is accurate.

there is no source, they made it up

Reply on news.ycombinator.com