Open Source Software Community - it's about ethics in Code of Conducts

  • Want to keep track of this thread?
    Accounts can bookmark posts, watch threads for updates, and jump back to where you stopped reading.
    Create account
anyone running gogs, open source alternative to github is likely getting their shit wrecked by an unfixed 0day.
https://gogs.io/ - https://github.com/gogs/gogs

https://www.theregister.com/2025/12/10/gogs_0day_under_active_exploitation/ - https://ghostarchive.org/archive/W4KAP
https://www.wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit - https://ghostarchive.org/archive/9eQfh

the timeline makes it look even worse:

  • July 10, 2025: First indication of exploitation observed by Wiz.
  • July 15, 2025: Discovery of Supershell malware on a vulnerable machine.
  • July 17, 2025: Vulnerability reported to Gogs maintainers.
  • Oct 30, 2025: Acknowledgment of the vulnerability by Gogs maintainers.
  • Nov 1, 2025: A second wave of attacks observed in the wild.
  • Dec 10, 2025: The vulnerability has not yet been fixed.
1765479755109.png
LOL. Rest in piss Chink shitware.
 
It's really funny to me that both Gogs and Gitea use GitHub for development. Not as a mirror, as their main repository. Doubly so for Gitea, as they also provide managed instances as a service.
I think it is mainly because Github is a more popular and more accessible service, and its easier to get contributions and bug reports if everyone you're going to get them from already has an account where you host your code. Individually hosted instances have the downside of making everyone need an account on them, and I'm in the boat of hating it when I need to make a new account somewhere.

Last I heard, Forgejo (Fork of Gitea) was implementing their own federation called ForgeFed that minimizes this hassle. Unsure if Gitea plans to implement it or ever will.
 
Last I heard, Forgejo (Fork of Gitea) was implementing their own federation called ForgeFed that minimizes this hassle. Unsure if Gitea plans to implement it or ever will.
When I had registrations open on my forgejo instance, it got flooded with spam repos.
And also one cool repo that was kinda like some virus, it was a mirror of a project on another forge, which was a mirror of... - so it kept spreading like this. The account was named O and the repo was named O, I think the author was russian. It had both deep and broad directory structure, a lot of the names symmetrical and exotic, the files themselves, if readable (I assume all were readable, I just couldn't recognize some of the formats, it had everything from txt, through pdf and to blend and beyond) contained symmetrical and esoteric contents, sometimes just circles, sometimes photos. It also got new commits almost daily. Really interesting, I ended up deleting even that account, because the repo had over 5G and I got bored of it. Managed to find it on a few sites by googling: 1, 2, 3. No idea if it's some ARG or what, but pretty cool.
Anyways, I definitely don't want anyone federating with my git server because it will 100% just lead to spam.
 
Anyways, I definitely don't want anyone federating with my git server because it will 100% just lead to spam.
Honest question. Why would you want to federate a fucking git server in the first place?
What is the use-case?

It just sounds like the most autismo-retarded thing ever to do with zero actual benefits.
Is it some kind of venture-capital scam? We have a federated git server with block-chain and integrated chat-client ?
 
Yeah, I hate Mint, but I’m not going to be chimping out that someone chose Mint as their OS.
The thing is, the people that ACTUALLY believe there is something wrong with using a "just works" distro are a figment of their imagination. It's not even worth acknowledging it. Especially since the seething over distro choices seems to be coming from inside the house. It's the same shit, every week, every month, everywhere.

Idk what happened to them, but it never leaves their mind. I know it can't be from when I was messing with them before I realized how easily they react and it lost it's fun. This is surely something that has gone on even longer. It's like a loop.
Pure rage bait on Reddit post complaining about Wayland
Just wondering, whos fault is it when an application doesn't work on xorg? I've definitely had applications that just didn't work in the past while using it. I mean I probably use one as much as the other, wayland and xorg that is.
 
Last I heard, Forgejo (Fork of Gitea) was implementing their own federation called ForgeFed that minimizes this hassle. Unsure if Gitea plans to implement it or ever will.
Forgejo is great, I use it too. Gittea is also great, GitLab is 3 steps down from that, and GitHub is down in niggerhell. I know basically nothing about Savannah, and SourceHut is pure brimstone.
Just wondering, whos fault is it when an application doesn't work on xorg?
Nvidia, regardless of if you are using an N*idia GPU.
 
Last edited:
I always struggle with the "it just works" distros because I don't know how or why they work. Also permanent changes, apparently, e.g. different coreutils, different display servers, base components like systemd permanently mutating and reinventing the wheel etc.. Frankly, if that was my only experience with Linux, I don't think I'd like it much and I'd probably be with one of the BSDs by now. That's why I prefer distros like gentoo. I set them up exactly how I like them once and then never touch the configuration again. I don't need to worry that e.g. gentoo 28.0 will throw X11 and the gnu coreutils overboard or change some build options in the kernel so the default kernel won't work for me anymore. It, actually, just works, for me. I've been using gentoo since the middle 00s and the investment into compiling things and fixing things used to be a lot bigger than it is now. The package landscape also has become a lot more mature, with packages landing in stable only when it actually makes sense. For a modern processor anything except the biggest packages is trivial to compile and to install, barely slower in any way that matters vs. a binary. The building isn't really about optimization (although that is still measurable), it's more of a requirement to actually have that kind of flexibility.

That said, I had a few year stint with Alpine and that was pretty good too, because it was a distro that assumed little and respected my configuration. The only downside was the general lack of packages, musl edge case weirdness and the relative difficulty using the build system properly to build the lacking packages.

I heard the argument that you have to fiddle with a gentoo installation constantly very often over the years. That always sounded very odd to me. I find comments in some of the portage-specific configuration files I wrote 10+ years ago. Same with init and backup scripts and other low-level parts that make up a unixoid workstation. That's sometimes how long I haven't touched them, keeping them over several generations of computers. Gentoo is a "meta distribution", when you use gentoo for a long time it is natural to kinda fork off from upstream in some ways, for example by having completely customized init ebuilds for your systems. These changes are good because they make sense to you and can remain as they are for a long time as the upstream ebuilds don't mandate much and what little they mandate can be overruled by you easily. If you fiddle with anything in gentoo constantly, you're either not understanding something correctly or doing something wrong. I think if I was forced to use Ubuntu or Mint, I would find the workload to constantly having to relearn the components of the system far higher than any maintenance I have to do on gentoo. I could possibly be persuaded to use a distro like this if there was more continuity in the supporting software components in them and these attempts at reinventing the wheels would cease (which I don't see happening if things posted to this thread are any indication), otherwise I think they are more trouble than they are worth. But well, maybe it's just me being weird by actually caring what runs on my system. I just like to have the kind of certainty, contiunity and stability that comes with a well configured linux system. I don't think I'd enjoy having to constantly worry about what the distro jannies will ruin/mandate/dictate next release. That's not what free software is about, for me. If I wouldn't mind that, I probably would have stuck with Windows.
 
Gentoo is a "meta distribution", when you use gentoo for a long time it is natural to kinda fork off from upstream in some ways, for example by having completely customized init ebuilds for your systems. These changes are good because they make sense to you and can remain as they are for a long time as the upstream ebuilds don't mandate much and what little they mandate can be overruled by you easily.
Using Guix is a very similar experience. Some of the most customized systems I've ever seen have been Guix configs. Custom channels, custom programs, bizzare setups like an entire system built on literate programming with Emacs org files that get tangled into Scheme via Emacs' org-babel-tangle function serving as configuration files, just to give one example. You really get the feeling that the people who know how to use Guix enjoy making it their own. Since it assumes nothing and gives you this giant Lispy sandbox to play around in, customization is pretty highly incentivized, if indirectly. Granted, you've had your Gentoo config longer than I've know how to walk, but even only after a couple years, I can't picture myself enjoying any standard Linux distro nearly as much as my Guix.
 
I always struggle with the "it just works" distros because I don't know how or why they work
Have you tried asking? The Linux Mint community is very open about discussing how even the more exotic components of the OS work, and the developers have a clear set of guidelines they work within and communicate clearly any changes that are made. They operate with the understanding that a lot of their users don't understand Linux very well and will react extremely negatively to unpredictable actions and unexpected changes.
 
Have you tried asking? The Linux Mint community is very open about discussing how even the more exotic components of the OS work, and the developers have a clear set of guidelines they work within and communicate clearly any changes that are made. They operate with the understanding that a lot of their users don't understand Linux very well and will react extremely negatively to unpredictable actions and unexpected changes.
I don't think it's that people can't learn how things are actually being done underneath. It's that these are actually anything but simple. And understanding what is going on is much easier when you are basically handed a blank slate, that is a bootable system with a kernel, an init, a shell and the coreutils, and you add the things you want yourself. Just by the nature of you setting it up yourself you understand at least to some level what's happening, and why. This is obviously only important to people that actually care about understanding the in's and outs of what they are using, and not everyone needs to know, or cares to know what's happening on the computer.

That's just one aspect of it. The other aspect, is like what @Ferryman was talking about with his guix setup. Once you have a system that you set up yourself, that works in the exact way you understand, and feel comfortable with, it's really hard to go from that, to something that was put together by someone else to work for as many people as possible. It's feels like you are putting a shoe on the wrong foot or something (idk I could probably find a better analogy). After you are used to having something that works perfectly with the way your brain works, and with the way you use your computer. If you are someone that intents to set your computer up like this you can take something like mint, or some other already put together distro, and turn it into whatever you want, but at that point why would you? It is legitamately more work at a certain point to undo what someone else did, to then redo it how you want it, and it usually means you are going to be fighting against the choices that were already made for you on some level.

There's also another plus to a simpler system, that was put together with only the things you wanted. With less going on, generally there are fewer places for things to fail, and when something does go wrong, if you have some understanding of what's happening on your system, it's not too hard to fix it yourself. A lot of the time you won't need to even ask anyone. At most it will be googling an error message, and taking it from there. But I find it's a lot rarer that I have any problems at all on a system that only has what I absolutely need. Fewer programs running, means less code is running, less code, is less bugs. It doesn't matter what OS it is, if there is code there are bugs. And cutting out what isn't necessary is generally a good way to avoid headaches you might otherwise deal with.

All that is just an explanation of why people like the simpler distros. The voids, the arches, the alpines. Obviously there are a lot of people that won't see anything appealing about any of that. But I don't think I will ever go back to something like mint for myself. It's still the distro I recommend to people moving to linux, and I've personally installed it a few times on normies computers for them.
 
Last edited:
so basically like driving a car with a cvt instead of a manual transmission.
 
Packages [are] trivial to compile and to install,
The one thing that I absolutely despise in Linux is the compliling of packages. Every single time I do it myself without some program like Pacman or Yay, it never-ever fucking works. I’d be missing some weird-ass dependency that wasn’t installed or included with the readme.md, I was missing compiled dependencies or my processor just “didn’t really feel like” compiling. Maybe I’m just a massive fucking retarded nigger and have trouble grasping basic English, but I’d imagine I’m at least at the right side of the belle curve, using Arch and being able to RTFM, but compiling is always a nightmare for me.
 
This is what you get in the free tier.
:lol: Most people in this thread probably already know, but maybe some people would wonder how Kiwiflare works if the necessary compute is so cheap. The answer is pretty simple: to defeat a DDoS attack you only need to reduce the number of packet requests below a certain threshold so that the server can serve every request, and adding a delay will do that (in fact it's more effective at slowing DDoS traffic than normal traffic since botnets are mostly made of low power ASICs in things like toothbrushes, because apparently we needed wifi-enabled toothbrushes).
 
Honest question. Why would you want to federate a fucking git server in the first place?
What is the use-case?

It just sounds like the most autismo-retarded thing ever to do with zero actual benefits.
Is it some kind of venture-capital scam? We have a federated git server with block-chain and integrated chat-client ?
Git was designed to be used in a federated network, namely e-mail. One can host a bare Git repository with a static HTTP server, giving anyone read-only access. Other contributors could gain access to that repository by giving their SSH public key. Pull-requests and issues are analogous to e-mails with patch files and regular e-mails, respectively.

The advent of Web 2.0 gave birth to GitHub and its copycats. By now, most have forgotten or dismiss the old ways of e-mail oriented Git. To their credit, GitHub's UX is just way better than plain text e-mails (for non-powerusers!).

The Forgejo/Gitea people correctly recognize that GitHub has become a social media website AND that it's owned by an evil jeeted corporation. It's only natural that the stinkditches in FOSS want them to be to GitHub, as what Mastodon is to Twitter.
 
I always struggle with the "it just works" distros because I don't know how or why they work. Also permanent changes, apparently, e.g. different coreutils, different display servers, base components like systemd permanently mutating and reinventing the wheel etc.
Your issue is that you're incapable of looking at something from someone else's point of view and you can only look at something from your own. As an analogy, the average user doesn't have to know what the Windows registry is, what's the difference between HKCU and HKLM is, what's SysWOW64, what's svchost.exe and how to manage services and so on. All they care about is that their computer runs what they need to run and that it won't croak. Similarly, the average user couldn't give two shits about whether or not his distro runs systemd or OpenRC, whether it's using X11 or Wayland, whether it's using KDE or GNOME and so on.

Because unlike you, the average user isn't a die hard nerd that gets a kick out of learning every single component that goes into their operating system. They just expect their shit to work for years without having to do shit about keeping it working. That's why Mint is the perfect choice for them and why you keep struggling with it. You'd be better off with Artix or Gentoo where you assemble your entire system by hand without the evil Poetteringware, but here's the shocker: that's you, and you aren't the target market for distros like Mint. No one forces you to use Mint, nor should you force anyone to not use Mint just because you hate it for being too opaque for your tastes.
 
Back
Top Bottom