Shakedown Social

3 posts3 participants0 posts today

Christian M. Grube 🐧<a href="https://social.tchncs.de/tags/gitlab" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#gitlab</a> Securityfix 7.10.1, 17.9.3, 17.8.6Cross-site Scripting (XSS) through merge-request error messagesCross-site Scripting (XSS) through improper rendering of certain file typesAdmin Privileges Persists After Role is RevokedExternal user can access internal projectsand so on ...<a href="https://social.tchncs.de/tags/opensource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#opensource</a> <a href="https://social.tchncs.de/tags/adminlife" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#adminlife</a> <a href="https://social.tchncs.de/tags/git" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#git</a> <a href="https://about.gitlab.com/releases/2025/03/26/patch-release-gitlab-17-10-1-released/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://about.gitlab.com/releases/2025/03/26/patch-release-gitlab-17-10-1-released/</a>

Kevin Karhan :verified:Anyone else having issues with <a href="https://infosec.space/tags/PyCharm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PyCharm</a> randomly "forgetting" / bricking <a href="https://infosec.space/tags/logins" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#logins</a> on <a href="https://infosec.space/tags/UbuntuLTS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#UbuntuLTS</a> Desktop?<ul><li>And it's not just <a href="https://infosec.space/tags/GitHub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GitHub</a> and <a href="https://infosec.space/tags/GitLab" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GitLab</a> but any <a href="https://infosec.space/tags/git" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#git</a>.</li></ul>The only workaround is to literally delete the configs and manually reenter the credentials, only for those to get fucked up with an update or at random.<ul><li>Seriously, why???</li></ul><a href="https://programming.dev/c/jetbrains" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@jetbrains</a> , <a href="https://infosec.space/tags/plzfix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#plzfix</a>!

Andre Courchesne (co2.click)Do I have any <a href="https://zeroes.ca/tags/golang" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#golang</a> developers in my followers that are located in Canada and looking for contracts ? No need to be a senior. Looking to give a chance to local talent.Must have an <a href="https://zeroes.ca/tags/OpenSource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSource</a> philosophy, know <a href="https://zeroes.ca/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> well, <a href="https://zeroes.ca/tags/Git" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Git</a>, <a href="https://zeroes.ca/tags/Gitlab" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Gitlab</a> Reply or DM me.

Chris PittsI hate programming in YAML I hate arcane scripting structures I hate side effects I hate overcomplicated CI/CD pipelinesThat is all.<a href="https://agilodon.social/tags/GitLab" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GitLab</a>

FolkeføderationSkrevet af <a href="https://mastodon.lyng.space/@benjamin" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@benjamin</a> I får lige en forsmag på det den hjemmeside vi arbejder på, samt lidt om hvordan vi arbejder.Noget af det første vi skulle finde ud af var hvordan vi arbejder sammen på projektet. Vi er alle tilhængere af <a href="https://expressional.social/tags/OpenSource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSource</a> og <a href="https://expressional.social/tags/SelfHosting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SelfHosting</a>, men vi vil nødigt afhænge af enkeltpersoner og deres hjemmeservere. Bl.a. derfor har vi lavet et projekt i <a href="https://expressional.social/tags/gitlab" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#gitlab</a> som anvender gitlabs CI til at bygge hjemmesiden med en statisk side generator, samt deploye den til gitlab pages. (Til de interesserede så har vi taget udgangspunkt i <a href="https://www.getzola.org/documentation/deployment/gitlab-pages/#setting-up-the-gitlab-runner" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.getzola.org/documentation/deployment/gitlab-pages/#setting-up-the-gitlab-runner</a>). Det giver gode muligheder for samarbejde samt en klar ændringshistorik at have det hele i git.Vi har grønne pipelines ✅ så nu taster vi løs for at levere noget tekst + fede logoer så vi kan få defineret konceptet Folkeføderation så tydeligt som muligt. Sig til hvis i vil være med, så bliver i inviteret ind i gitlab-klubben.

Ross Gayler<a href="https://aus.social/@andyjennings" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@andyjennings</a> TYMBI<a href="https://social.mcwhirter.io/@craige/114135826723289231" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://social.mcwhirter.io/@craige/114135826723289231</a> craige@mcwhirter.io - Hey peeps, if you're still using <a href="https://aus.social/tags/GitLab" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GitLab</a> and <a href="https://aus.social/tags/GitHub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GitHub</a> and you're twitching a bit because they're felating fascists, I want to point to the sign that says you can self-host @forgejo - a project which is also working on decentralisation and federation.Failing that, @Codeberg also exists, are a European non-profit that also supports the developmnet of Forgejo.Hope that helps 😀

TainomeYo, I just heard about the Gitlab news (see here to find out: <a href="https://mastodon.design/@markwyner@mas.to/114136899003664890" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://mastodon.design/@markwyner@mas.to/114136899003664890</a> ) I'm already preparing my Codeberg migration... I think this won't be my last migration before the end of the year but I can tell you that it's tiring me to change the web services I use every two weeks or so, I have other things to do with my life <a href="https://mastodon.design/tags/rant" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#rant</a> <a href="https://mastodon.design/tags/tech" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#tech</a> <a href="https://mastodon.design/tags/fatigue" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fatigue</a> <a href="https://mastodon.design/tags/mentalFatigue" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mentalFatigue</a> <a href="https://mastodon.design/tags/fascismEverywhere" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fascismEverywhere</a> <a href="https://mastodon.design/tags/gitlab" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#gitlab</a>

Bob Mottram ✅According to <a href="https://epicyon.libreserver.org/tags/GitLab" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GitLab</a> I have no projects. I am guessing this is a snafu.

mray<a href="https://mas.to/@markwyner" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@markwyner</a> Maybe, what he *actually* wants to say is that people can do more with less <a href="https://social.tchncs.de/tags/GitLab" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GitLab</a>?What a shame. But no surprise that a company with a revenue of US$424.3 million (wikipedia says that) slowly goes the way of the <a href="https://social.tchncs.de/tags/GitHub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GitHub</a>…

Mark Wyner Won’t Comply :vm:GitLab CFO, Brian Robins, says they are “aligned with the goals of DOGE, because the company’s software tools aim to help people do more with less. What the Department of Government Efficiency is trying to do is what GitLab does.”<a href="https://archive.is/okSlz" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://archive.is/okSlz</a>You either support fascism or you don’t. It’s binary. There’s no gray area or “aligning.”Considering GitLab? Don’t. Use <a href="https://social.anoxinon.de/@Codeberg" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@Codeberg</a>.(Hat tip <a href="https://woof.group/@aphyr" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@aphyr</a>)<a href="https://mas.to/tags/Code" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Code</a> <a href="https://mas.to/tags/Dev" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Dev</a> <a href="https://mas.to/tags/Development" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Development</a> <a href="https://mas.to/tags/Codeberg" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Codeberg</a> <a href="https://mas.to/tags/GitLab" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GitLab</a> <a href="https://mas.to/tags/Fascism" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Fascism</a> <a href="https://mas.to/tags/GIT" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GIT</a>

ArveIf you’re currently using <a href="https://mastodon.social/tags/gitlab" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#gitlab</a> this is your time to leave for literally any other service as they have chosen to align with the current US regime. Via <a href="https://www.washingtonpost.com/business/2025/03/09/doge-companies-warnings-sec-filings/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.washingtonpost.com/business/2025/03/09/doge-companies-warnings-sec-filings/</a>

PierreNick :apple_old_logo: 💾Well at least <a href="https://hachyderm.io/tags/GitLab" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GitLab</a> lets you delete your account with no fuss. Good CI though, shame.Re: <a href="https://woof.group/@aphyr/114134266721872222" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://woof.group/@aphyr/114134266721872222</a>

craigeHey peeps, if you're still using <a href="https://social.mcwhirter.io/tags/GitLab" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GitLab</a> and <a href="https://social.mcwhirter.io/tags/GitHub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GitHub</a> and you're twitching a bit because they're fellating fascists, I want to point to the sign that says you can self-host <a href="https://floss.social/@forgejo" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@forgejo</a> - a project which is also working on decentralisation and federation.Failing that, <a href="https://social.anoxinon.de/@Codeberg" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@Codeberg</a> also exists, are a European non-profit that also supports the development of Forgejo.Hope that helps 😀

nevUpdate: now a blog post which I will update instead! <a href="https://nevillepark.ca/2025/03/13/branching-out-some-github-gitlab-com-alternatives/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://nevillepark.ca/2025/03/13/branching-out-some-github-gitlab-com-alternatives/</a>Gitea is 1) commercial and 2) based in the US, which I know many people are looking to avoid. <a href="https://social.anoxinon.de/@Codeberg" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@Codeberg</a> (<a href="https://codeberg.org" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://codeberg.org</a>) is a public server running Forgejo, which began as a Gitea fork: <a href="https://forgejo.org/compare-to-gitea/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://forgejo.org/compare-to-gitea/</a> It's where I have most of my stuff.A few more public Forgejo servers: <a href="https://codeberg.org/forgejo-contrib/delightful-forgejo#public-instances" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://codeberg.org/forgejo-contrib/delightful-forgejo#public-instances</a> Shout-out to <a href="https://social.besties.house/@besties" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@besties</a>' <a href="https://git.gay" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://git.gay</a>. There's also the venerable Sourcehut, whose UI makes me break into hives: <a href="https://sourcehut.org/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://sourcehut.org/</a>Want to self-host? <a href="https://toot.aquilenet.fr/@yunohost" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@yunohost</a> is dead easy to set up and has Gogs, Gitea, Forgejo, and GitLab apps: <a href="https://apps.yunohost.org/catalog?search=git&category=dev" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://apps.yunohost.org/catalog?search=git&category=dev</a>OK with Gitea/GitLab servers outside the US? <a href="https://framapiaf.org/@Framasoft" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@Framasoft</a> has a public GitLab server: <a href="https://framagit.org" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://framagit.org</a> So do <a href="https://sunbeam.city/@autonomic" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@autonomic</a>: <a href="https://git.autonomic.zone" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://git.autonomic.zone</a> and <a href="https://git.coopcloud.tech" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://git.coopcloud.tech</a>, plus they'll do paid hosting (price scales with budget).For cheap independent hosting, PikaPods has Gitea: <a href="https://www.pikapods.com/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.pikapods.com/</a>There are SO many options if you are willing to give up the "everyone on the planet uses the same public Git server" model.<a href="https://bananachips.club/tags/git" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#git</a> <a href="https://bananachips.club/tags/github" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#github</a> <a href="https://bananachips.club/tags/gitlab" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#gitlab</a> <a href="https://bananachips.club/tags/selfhosting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#selfhosting</a> <a href="https://bananachips.club/tags/forgejo" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#forgejo</a>

Thor A. Hopland<a href="https://tutoteket.no/@forteller" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@forteller</a> holy smeg the <a href="https://snabelen.no/tags/freedeaktop" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#freedeaktop</a> <a href="https://snabelen.no/tags/gitlab" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#gitlab</a> server is slow as snails crawling through molasses. Hoo-boy!

Fabio ManganielloIf you run a <a class="hashtag" href="https://manganiello.social/tag/drone" rel="nofollow noopener noreferrer" target="_blank">#Drone</a> CI server, set <code>DRONE_REGISTRATION_CLOSED=true</code> (and manually create users only when you really really trust someone).The CPU on my CI/CD server suddenly spiked to 100% today.A closer look found some users who had registered on <a href="http://git.platypush.tech" rel="nofollow noopener noreferrer" target="_blank">git.platypush.tech</a> and on the CI/CD server and created a repo with a .drone.yml, a .gitlab-ci.yml and some scripts with base64-encoded commands.The repo also contains a <code>deepCC.ipynb</code> Jupyter notebook that downloads some training data from S3 and uses Tensorflow to train a model, and then uses the <code>deepCC</code> binary to do something with that model.The repository also has a configure script with base64-encoded commands that seem to configure a miner (the wallet ID is R9WpFbvkb6dep6bfLdbpcyz3LpMeikUL6W and the coin is VRSC, if anyone is interested in investigating further).The <code>deepCC</code> binary is itself quite big (~50 MB), and a look at the <code>setup</code> script reveals that it’s actually a .tar.gz archive with a larger binary inside.A quick run of <code>strings</code> on the binary confirms that it’s actually a miner - it connects to <code>eu1-etc.ethermine.org</code> and it also has a bunch of CUDA bindings to run on GPUs.I still don’t get what’s the point of the Jupyter notebook that trains a model and passes it to this miner, but if you feared the day of the arrival of the zombie Docker containers that exhaust system resources by mining cryptocrap AND training AI models, well, I’m afraid to inform you that that day has come.If you are a <a class="hashtag" href="https://manganiello.social/tag/gitea" rel="nofollow noopener noreferrer" target="_blank">#Gitea</a> / <a class="hashtag" href="https://manganiello.social/tag/forgejo" rel="nofollow noopener noreferrer" target="_blank">#Forgejo</a> admin, take a look at the users and repos created in the past couple of weeks. Check in particular if any recently registered users have created a repo named <code>deepcc-v</code>.The most likely authors are users named <code>farzanfarid16</code> and <code>zurizoey0</code>.A quick search confirms that both these users are registered on <a class="hashtag" href="https://manganiello.social/tag/gitea" rel="nofollow noopener noreferrer" target="_blank">#Gitea</a> too and have already created the incriminated repo:<ul><li><a href="https://gitea.com/farzanfarid16/deepcc-v" rel="nofollow noopener noreferrer" target="_blank">https://gitea.com/farzanfarid16/deepcc-v</a></li><li><a href="https://gitea.com/zurizoey0/deepcc-v" rel="nofollow noopener noreferrer" target="_blank">https://gitea.com/zurizoey0/deepcc-v</a></li></ul>And if you are a Drone CI or <a class="hashtag" href="https://manganiello.social/tag/gitlab" rel="nofollow noopener noreferrer" target="_blank">#Gitlab</a> admin, check if any of these users have also started CI/CD pipelines connected to that repo.For now, disabling the execution of CI/CD pipelines unless a user has been explicitly authorized is the best idea that comes to my mind.

e11bits :python: :emacs:I recently had a discussion with a coworker about commit messages. And I wonder what guidelines developers prefer.Past tense example (Django): <a href="https://docs.djangoproject.com/en/5.1/internals/contributing/committing-code/#committing-guidelines" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://docs.djangoproject.com/en/5.1/internals/contributing/committing-code/#committing-guidelines</a>Imperative example: <a href="https://github.com/RomuloOliveira/commit-messages-guide/blob/master/README.md#good-practices" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/RomuloOliveira/commit-messages-guide/blob/master/README.md#good-practices</a>Conventional/Semantic: <a href="https://www.conventionalcommits.org/en/v1.0.0/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.conventionalcommits.org/en/v1.0.0/</a> and <a href="https://gist.github.com/joshbuchea/6f47e86d2510bce28f8e7f42ae84c716" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://gist.github.com/joshbuchea/6f47e86d2510bce28f8e7f42ae84c716</a>Maybe other styles?<a href="https://fosstodon.org/tags/programming" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#programming</a> <a href="https://fosstodon.org/tags/git" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#git</a> <a href="https://fosstodon.org/tags/gitlab" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#gitlab</a> <a href="https://fosstodon.org/tags/github" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#github</a> <a href="https://fosstodon.org/tags/codeberg" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#codeberg</a> <a href="https://fosstodon.org/tags/softwaredevelopment" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#softwaredevelopment</a>

Jeff Fortin T.Achievement unlocked: loaded a GNOME <a href="https://mastodon.social/tags/GitLab" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GitLab</a> link that was pasted in a chatroom and triggered <a href="https://pony.social/@cadey" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@cadey</a>'s "Anubis" anti-LLM-scraper protection catgirl with my genuine Firefox browser, and had to watch my CPU burn for a minute :blobmiou:I regret to inform you that we have now entered the DEFCON 1 stage of the struggle against the LLMs "AI" <a href="https://mastodon.social/tags/enshittification" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#enshittification</a> bubble 🫠What I don't quite understand is why the GitLab instance would put up this challenge to already logged-in users 🤔<a href="https://mastodon.social/tags/GNOME" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GNOME</a>

Jan Wildeboer 😷:krulorange:And after going through the replies and comments, let me give you an alternative opening statement:<a href="https://social.wildeboer.net/tags/codeberg" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#codeberg</a> or your own <a href="https://social.wildeboer.net/tags/forgejo" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#forgejo</a> instance are <a href="https://social.wildeboer.net/tags/GoodEnough" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GoodEnough</a> to be used instead of <a href="https://social.wildeboer.net/tags/Github" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Github</a> and <a href="https://social.wildeboer.net/tags/Gitlab" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Gitlab</a> for 95% of your new FOSS projects, IMHO.(refocused on new projects) 6/6

Andreas Bulling<a href="https://social.wildeboer.net/@jwildeboer" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@jwildeboer</a> I am also running <a href="https://mastodon.social/tags/forgejo" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#forgejo</a> since several years and it's great. Super robust and resource-efficient, packed with features incl. LDAP support, ... the list goes on.What I particularly like (as an admin) is that the update to a new version involves replacing a single binary. That's it.I used <a href="https://mastodon.social/tags/gitlab" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#gitlab</a> before and that, in comparison, was a PITA. Bloated, memory-hungry, slow. Particularly updates were painful and broke the system multiple times because migrations failed.

Recent searches

Search options

Administered by:

Server stats:

#gitlab