We are struggling to keep Codebreg.org available for unauthenticated users due to massive abuse of expensive endpoints.
Our current priority is keeping Codeberg.org responsive for authenticated users.
Timeline
Post
Remote status
Replies
13
@codebergstatus Shouldn't have drama forked Gitea, otherwise you would already have some of the tools for that.
image.png
image.png
@phnt @codebergstatus congrats, you missed a point big time
@phnt @codebergstatus also, this solution sucks
@tragivictoria @codebergstatus I know the point, I've been trying to keep my forge running on the same box as this instance in a usable state as well for 2 years without being too much intrusive about it. I know the issues and problems associated with it.
My point is that if Codeberg didn't fuel dumb drama and fears years ago, they would be in a better position to fix their current issues than what they currently have.
>also, this solution sucks
I know that it's not the greatest implementation. It's more of a band-aid solution than anything else. Still better than a full on/off switch and a better start than an on/off switch.
My point is that if Codeberg didn't fuel dumb drama and fears years ago, they would be in a better position to fix their current issues than what they currently have.
>also, this solution sucks
I know that it's not the greatest implementation. It's more of a band-aid solution than anything else. Still better than a full on/off switch and a better start than an on/off switch.
@phnt @tragivictoria @codebergstatus i did something similar for git.pleroma.social with caddy setting and checking cookies, works alright. traffic was indeed unusably bad before.
@phnt @codebergstatus I have that setting on my ForgeJo instance, pretty sure Codeberg has it in their toolbox, but the goal of Codeberg is to be a public forge, where stuff can be published !
@moanos @codebergstatus Not really at least in Forgejo specifically. Forgejo doesn't have the "expensive" option recently introduced in Gitea, that requires signin only on some of the more expensive routes and leaves the rest public. Last time I checked they had some cookie setter/checker that triggered on most things outside of the main repo page and I guess that still isn't enough.
@Sobex @codebergstatus Gitea has a third option in the same setting that requires authentication only for some of the more expensive routes that usually cause issues. That's the difference between the two.
>but the goal of Codeberg is to be a public forge, where stuff can be published !
If they are getting flooded, which they are for at least two years now, it's better to hide certain things to anonymous users than bring the whole service down altogether with scraping. Things like blame that are expensive and rarely used legitimately.
>but the goal of Codeberg is to be a public forge, where stuff can be published !
If they are getting flooded, which they are for at least two years now, it's better to hide certain things to anonymous users than bring the whole service down altogether with scraping. Things like blame that are expensive and rarely used legitimately.
@phnt @moanos @codebergstatus
> Forgejo doesn't have the "expensive" option recently introduced in Gitea
lol wat why wouldn't they just cherry-pick that?
Gitea continues to be the superior fork for having less nonsense and continued reasonable developer behavior. Like when I pinged about this:
https://github.com/go-gitea/gitea/issues/34521
now Forgejo devs saw this come through and made the same change on their end, but look at the code style differences here. Gitea's is far superior IMHO
https://github.com/go-gitea/gitea/pull/37985/changes
https://codeberg.org/forgejo/forgejo/pulls/12905/files
> Forgejo doesn't have the "expensive" option recently introduced in Gitea
lol wat why wouldn't they just cherry-pick that?
Gitea continues to be the superior fork for having less nonsense and continued reasonable developer behavior. Like when I pinged about this:
https://github.com/go-gitea/gitea/issues/34521
now Forgejo devs saw this come through and made the same change on their end, but look at the code style differences here. Gitea's is far superior IMHO
https://github.com/go-gitea/gitea/pull/37985/changes
https://codeberg.org/forgejo/forgejo/pulls/12905/files
@taylor @phnt @codebergstatus
> I get blocking commits, diffs, blames, graph, and some other things, but this prevents unauthenticated users from doing anything except for pretty much looking at the README.
> At least looking at code on the main branch should be accessible without logging in, and certainly getting an overview of issues.
I disagree with all of this except about the wiki. That should be open still.
You want to look at the code? Download a source tarball.
You want to look at diffs/blames/graphs? Make an account or git clone it and do it locally with your own compute. The developers you want aren't using their browser as an IDE anyway.
Can't make an account because it's locked down? Well that's for good reason
> I get blocking commits, diffs, blames, graph, and some other things, but this prevents unauthenticated users from doing anything except for pretty much looking at the README.
> At least looking at code on the main branch should be accessible without logging in, and certainly getting an overview of issues.
I disagree with all of this except about the wiki. That should be open still.
You want to look at the code? Download a source tarball.
You want to look at diffs/blames/graphs? Make an account or git clone it and do it locally with your own compute. The developers you want aren't using their browser as an IDE anyway.
Can't make an account because it's locked down? Well that's for good reason
@Sobex @phnt @codebergstatus
> but the goal of Codeberg is to be a public forge, where stuff can be published !
Then they need to put on their big boy pants and buy some more compute and bandwidth and also build a CDN. They're trying to be something on the public internet that they clearly cannot afford to be and they don't have the skills and money to build the infra they need.
(I'm still laughing about their Postgres corruption fiasco)
> but the goal of Codeberg is to be a public forge, where stuff can be published !
Then they need to put on their big boy pants and buy some more compute and bandwidth and also build a CDN. They're trying to be something on the public internet that they clearly cannot afford to be and they don't have the skills and money to build the infra they need.
(I'm still laughing about their Postgres corruption fiasco)
@feld @codebergstatus @Sobex I mean it's a nonprofit ran almost exclusively by volunteers. Can't really blame them at that point. The community around them is the bigger issue I think. Building a foss equivalent of GitHub simply isn't possible now, so instead of most foss people saying "migrate to Codeberg from Git{lab,hub}", it should be "run your own if you can" instead.