pull down to refresh
appreciate knowing that. thanks for sharing.
I've been running a Gitea server for a few months now. No need to stay centralized since the clankers can handle my devops.
Same. Also beyond the obvious, local forges bear no extra cost beyond setting it up, so we can just do 1 bot config = 1 narrow scoped account, rather than use PATs and messing up.
Not using GH => improved everything, except sharing with others. But most stuff nowadays is better if it isn't shared anyway haha
most stuff nowadays is better if it isn't shared anyway haha
curious about your perspective... what's better left unshared?
I think we need to find a better way to do collaborations (stay tuned for updates on related stealth projects). FOSS is important to preserve sovereignty.
what's better left unshared?
Anything where the liability clause of the MIT license is meaningful beyond protection against litigation trolls, because if you need it, it means that you simply are a liability.
Exceptions to that:
- Clearly marked experimental / immature software
- Repos with good process or at the very least many eyes, independent audits help too
- Novel primitives, but those should generally fall under (1)
For example, I like what @m0wer did with #1546237 the other day. I'm not nearly done with analyzing it (so this isn't a recommendation, yet) but what is good about it is the supporting framework: it is extensive and thoughtful and there is a lot of process around provisioning there. If half the ecosystem would do half the effort of what was done there, my days would be a lot less frustrating.
I think we need to find a better way to do collaborations
I really, really should go check out Block's Buzz thingy, because that feels like it provides a way to do on-topic collaboration without (premature) publication.
FOSS is important to preserve sovereignty.
It's important to make/keep sovereignty attainable, agreed.
I've once seen an honest (though not much into responsible disclosure) security researcher suspended, which allegedly (GH is always opaque about this) was triggered by a report on a PR. I did some digging after that and reached out to some people I knew at GH - they said it is often automatically triggered by someone filing a report against a pr/issue/comment/gist. Suspend first, maybe ask questions later, preferably reactively.
The account in question never got restored afaik. It was a good thing for me because I learned to stop using GH for things that don't need it.