Egregoros

@feld @matthew Gotcha... I think I would guess that this actually doesn't happen all that often, although I can really only use my own experience as a basis. Personally I have held back contributions to certain established open source projects because I didn't want to deal with the "drama", but it's never stopped me from creating my own new projects and putting all the open community features in place.

Of course I do not have the experience of being a maintainer of a large project with a very active community, so I can't speak to that.

@feld @matthew @diazona
I remember seeing GH for the first time, this was right after massively multiplayer online games and social networks got popular. Its headline/motto was "Social coding", and I was like: "Are you kidding me? Why make even this social?!",— I think I've been even ignoring it for quite some time, pretty much till right before MS took it over, just downloading tarballs from other sources.
I have my own git that's not even accessible from the outside, where I keep my own small projects and mirrors of others' with my patches — when I feel like sharing and that it's worth sharing, I just email the developer a patch. If I won't to report an issue and think that it's unlikely someone else would do it anytime soon, I also use email or reach out on Fedi.

And I was starting to feel like I'm too old-fashined with all this, but now I see that I was actually ahead of time

@m0xEE @feld @matthew To be fair, at least from my perspective (but I think it's widely shared), the reason GitHub was useful had nothing to do with its "social" features, at least not in the sense of social-media-style interactions. It was useful because it made collaboration easier and more visible than the status quo at the time, namely a repository that might have a web-accessible interface for browsing code but no discussion features. (Essentially: pull request reviews.) I would contend that the value of integrating discussion into the code contribution interface is still there - as the original post shows, not everyone needs it, but for many people and projects that's still added value.

@bonifartius @gabriel @matthew one of the issues we've had with Pleroma is that we ran a Gitlab with open registration (because why not?) and this was just a constant source of headaches.

It doesn't matter if you put up a captcha, those are too easily broken but a lot of the spam/abuse is coming from real humans working out of places like Vietnam. They're just paid to register accounts and paste spam everywhere. We could get 3000 new spam accounts per day easy. And GitLab doesn't offer tooling for bulk deletion of accounts...

Yes, the accounts required activation. So they'd register an email address on Gmail, sign up with us, verify their email, etc and then spam. It doesn't really matter what your defense or rate limiting are, they'll just keep going at a steady pace and overwhelm your server.

And this is *before* the LLM bots started hitting us. So now I'm doing things like importing blocklists to completely stop anyone coming from Vietnam or the ASNs of some Chinese companies training LLMs...

What I'd like to see is a first class email support in Gitea/Forgejo. It's not there yet but it's close enough. My thoughts are:


1. core team has real accounts and full access; world has read only view
2. any outside contributor should be opening an issue/pr via email
3. we can spam filter the incoming emails. We know this can work, especially doing a little bayesian training on the latest trends in spam crap that comes through
4. if someone is a good contributor and we want to invite them in, we just have to activate their account and send them the password reset link


this should keep a lot of the junk out while still being "open".