cmjs

TIL I'm a Tailscale developer

> This report strictly audits the open source software provided to users under no condition of warranty per the BSD-3 license. As such, the researchers, and the users, are effectively developers of said software per its open source nature.

Nobody owns a domain name. You rent it, subject to the whims of the registry. Miss a single payment and you loose it forever. Even if you always pay up on time, despite price rises etc, they can still decide to take it away: https://neil.fraser.name/news/2026/09/03/

PLC is imperfect, like every solution to identity so far, but it's a lot better (in terms of ownership / control of your own ID) than DNS.

A PGP key server hosts PGP keys; the PLC directory hosts DID documents.

It's a flag. In what way is it supposed to resemble the dinosaur?

Especially relevant after Musk has been directly inciting racial riots and calling for civil war in the UK.

I see, thanks for the clarification.

Also Forgejo (2022)…

They definitely know about Gitea – though they don't acknowledge it, it's partly based on Gitea. https://github.com/harness/gitness/pull/3364/files#diff-4673...

Interestingly it looks like this is partly a fork of Gitea (or at least, incorporates large amounts of code from Gitea): https://github.com/harness/gitness/pull/3364/files#diff-4673...

Fediverse announcement: https://floss.social/@forgejo/109519186453892972

> We're excited to announce the official launch of the #Forgejo project, a community-driven fork of #Gitea under the stewardship of @Codeberg. Check out https://forgejo.org/2022-12-15-hello-forgejo/ to learn more, including the motivation for the fork, as well as Codeberg's announcement at https://blog.codeberg.org/codeberg-launches-forgejo.html Come and get involved at https://codeberg.org/forgejo/forgejo or in our Matrix room https://matrix.to/#/#forgejo-chat:matrix.org . We aim to be a fully inclusive community and everyone's participation is welcomed.

I also don't have a problem if open source developers try to monetize their work. In fact I think it's great, if done right. But context is important here.

In Gitea's case, I think this could have been done right, with the community's knowledge and involvement. But that's not what happened. Two of the three "elected owners" of the project effectively undertook a hostile takeover, transferring the ownership of the domains and trademarks to a secretive private company, without telling anyone until after the fact. I know people who were formerly active maintainers, and they were taken completely by surprise – even though it turns out that preparations for this had been ongoing behind closed doors for many months.

At first, I and many others thought it was perhaps a case of failures of communication, and were prepared to give them the benefit of the doubt. But after an open letter was signed by many community members, and the people behind Gitea Ltd had ample opportunity to improve the situation, they only dug their heels in and made things worse, and refused to answer questions beyond corporate-speak PR posts. It was at that point that the decision was taken to fork.

As a Gitea user and as someone who is excited about the forge ecosystem and the future of forge federation, I truly hope that Gitea as a community project continues to thrive, and that the company ultimately doesn't derail the community. Unfortunately, I am also very pessimistic about that being the reality, and so I think this fork is a very positive development.

Some of them have migrated. I imagine others are taking more of a "wait-and-see" approach.

For what it's worth, Codeberg is quite a major contributor to Gitea as well as the biggest public instance, and they are supporting the fork and will be switching over after the first stable release.

Thanks for the reply! That's basically what I thought then – but as you say, traditional captchas are deeply flawed and ineffective anyway, and I totally agree that in many cases the cost to real users outweighs any benefit. So I'm excited to see alternatives such as mCaptcha popping up. It'll be interesting to see how it works out for people in real-world use.

I'm curious whether this can actually be considered to be a "CAPTCHA" in the true sense of the term. It doesn't seem to be intended to "tell computers and humans apart", but rather to force the client computer (not the human user) to do some work in order to slow down DOS attacks.

Of course slowing down DOS attacks is a great goal in itself, and it's very often what captchas have been (ab)used for, but it doesn't seem to me to replace all or most use cases for a captcha. In particular, since it can be completed by an automated system at least as easily as by a human, it doesn't seem like it would limit spambot signups or spambot comment or contact form submissions in any meaningful way.

Or am I misunderstanding, @realaravinth?