techknowlogick

The feedback was that we gave too many details too soon, and so we solicited feedback from the community and peertube's approach was given as a suggestion for us to try. But to be clear, this decision was discussed and made by the maintainers, including the elected leadership team. I'd say that this is a successful example of governance, as it isn't a unilateral decision, and everyone was involved in making.

(bias note: I am a project lead of Gitea) this approach is based on what peertube has been doing, and is being attempted as an alternative approach to what we've been doing previously due to feedback we've been receiving from the community.

Only posting here because I've been asked about it. Gitea is protected against both of these issues.

(bias note: part of project leadership of Gitea)

Edit: As a note, security incidents happen to everyone and we shouldn't shame anyone for reporting them, especially as that'd otherwise cause less issues to be reported overall.

I was one of the members who was a part of the initial grant for federation in Gitea, but sadly due to illness and other similar neither I nor my teammate were able to work on the grant (so no funding ended up being released), however the work we did start was completed, and we have continued to work on foundations since. Since spam/moderation/limitations are so significant we are focused on that portion first, since we don't want to open up another vector for it without having at least the minimum of protections in place. We have also been extremely fortunate to have experienced developers who do work on existing federated software share so much of their time, expertise, and experiences with us to help shape our work.

Woo! Thanks for the shoutout. I'm one of the project leads of Gitea, and if you ever run into any issues please feel free to hop into our chat:)

I'm one of the project leads of Gitea and we've put a ton of work into Gitea Actions, I'd be interested in any compatibility gaps that you've run into.

FWIW Gitea is still community driven as before, there are yearly elections for the community maintainers for TOC leadership.

disclaimer: I'm one of the project leads of Gitea

That's great to hear! I'm one of the project leads of Gitea, and if you ever run into any issues please feel free to hop into our chatroom:)

Best of luck! I'm one of the project leads of Gitea, and if you run into any issues please feel free to hop into our chat:)

I'm one of the project leads of Gitea. I'd be interested in knowing which features you are missing from Gitea compared to Gitlab? We are doing some backlog grooming right now, and input is very appreciated:)

Thanks for saying so <3 If you ever run into any issues with it please feel free to report an issue or hop into chat.

I'm a project lead of Gitea, and former elected board member of Codeberg. Gitea remains opensource (feel free to check out the repo and you can see that the license remiains as is), and maintains yearly community elections. The codeberg board was informed a full year prior to their "we just found out blog post", and so "catching the whole community by surprise" is very much not accurate since they very much knew. As well, we (the company) were very public with our activities prior to our blog post announcing things, including working to support other open source projects migrate, and posting about it through various channels (social media, chat, etc..).

I'm one of the project leads of Gitea (and am paid for some of my work on Gitea), and here are some more details around the specific incident you are talking about: We were alerted to an issue, and investigated provided a patch, and then waited until the end of the embargo to release the next version with the fix. It turns out they had sent a follow up after our response to them that, due to their usage of an email relay that gets blocked for spam often, went into the spam box for all of the maintainers on the security team (across multiple mail providers). We informed them of this and they still haven't corrected the record on their blog post. This is after previously giving us 10 and 2 day "embargoes" on "severe" issues and a multi-hundred line patch that rewrote core portions of the codebase and introduced issues in itself, we notified them of this and provided them with out patch. In our interactions with them we have also followed our documented approach, that we have followed with codeberg previously (that we were thanked and applauded), but they have changed their stance and claimed we are now acting improperly (and when we asked for how we could adjust our approach to something that works for their adjusted expectations we never received a response, even after receiving multiple emails from multiple non-company maintainers and even messages in multiple chatrooms).

Disclaimer: I was also previously an elected member of Codeberg's board (presidium), where before the company that was founded to support Gitea's community maintainers was created, I had asked for assistance with multiple matters to aid in project development and was denied.