Thread

Gitea 28.0

91 points · 40 comments · porridgeraisin

Loading the complete thread in the background. This saved snapshot is available now. Refresh

ThePinion · 1790802095 · focus · HN ↗
> This release contains security fixes. To give everyone time to upgrade, details will be added to this post in about a week.
Is this something that has been happening for a while or a new trend due to LLM concerns? I understand the reasoning, it just made me do a double take because I haven't really seen that before.
1. QuantumNomad_ · 1790803400 · focus · HN ↗
  With Gitea specifically or in general? A lot of different software has silently included security fixes in updates combined with other changes and then later revealed what security fixes were made or stayed quiet about it all together, since long before LLMs could analyze changes.
  Security researchers and malware authors would reverse engineer software updates of proprietary software, and scrutinise source code changes of open source projects to find secret security fixes.
2. stackghost · 1790803440 · focus · HN ↗
  Bizarre policy. Any bad guys unaware of the security implications are analyzing the patch diffs as we speak, so this seems nonsensical to me.
  1. IshKebab · 1790803537 · focus · HN ↗
    Yeah maybe it made sense in the past, but not in the age of AI.
3. techknowlogick · 1790805267 · focus · HN ↗
  (bias note: I am a project lead of Gitea) this approach is based on what peertube has been doing, and is being attempted as an alternative approach to what we've been doing previously due to feedback we've been receiving from the community.
  1. entrope · 1790810492 · focus · HN ↗
    Is not describing the feedback part of the feedback you got? You're kind of playing into Forgejo's narrative about governance.
    techknowlogick · 1790870995 · focus · HN ↗
    The feedback was that we gave too many details too soon, and so we solicited feedback from the community and peertube's approach was given as a suggestion for us to try. But to be clear, this decision was discussed and made by the maintainers, including the elected leadership team. I'd say that this is a successful example of governance, as it isn't a unilateral decision, and everyone was involved in making.
4. e12e · 1790850171 · focus · HN ↗
  That's quite annoying - "security fixes" - but no information if your installation is affected or not? (Eg: in a module that's disabled)?
  Makes work harder for sys admins - little difference for black hats.
  It's still a (<LLM> look at diffs in latest gitea release - find the patched security issues and write poc exploit for cve assessment) I guess?
MitPitt · 1790802190 · focus · HN ↗
they skipped 26 major versions, ai is truly amazing
1. layer8 · 1790802299 · focus · HN ↗
  > Gitea drops the historical 1. prefix from its version numbers, so this release is 28.0.0 rather than 1.28.0.
wasting_time · 1790802375 · focus · HN ↗
For anyone curious why they should choose one over the other:
<a href="https://forgejo.org/compare-to-gitea/" rel="nofollow">https://forgejo.org/compare-to-gitea/
1. DASD · 1790802705 · focus · HN ↗
  Thanks! Currently going through this decision process myself.
  1. GrayShade · 1790802846 · focus · HN ↗
    I suggest browsing through the release notes of the last 4-5 versions to see what you like more.
    tjoff · 1790803615 · focus · HN ↗
    I'd argue project values, license and health are way more important.
    daneel_w · 1790808384 · focus · HN ↗
    Would you also argue that the technical quality, efficiency, capacity, performance etc. of a piece of machinery, too, is way less important than the the social and political values of its manufacturer? Say, a piece of medical equipment used in a hospital to keep a patient alive.
    ulimn · 1790808803 · focus · HN ↗
    I have a feeling that nobody will die (most likely) for choosing forgejo or gitea... Apples and oranges...
    DASD · 1790809237 · focus · HN ↗
    But from the downvoting, announcing evaluation of these is contentious. Oh HN!
    daneel_w · 1790876050 · focus · HN ↗
    I disagree, but for you I'm willing to offer an example of a CNC machine making parts for... anything. The question and comparison is at its core still just as valid and relevant. Is the result way less important than "feeling good" about the solution?
    yjftsjthsd-h · 1790809754 · focus · HN ↗
    Release notes would inform my view of project health and priorities
    p-e-w · 1790815953 · focus · HN ↗
    The project’s values as well, much more so than any “values statement”. The proof is in the pudding, not in the marketing speak.
2. nightpool · 1790803808 · focus · HN ↗
  Unfortunately, seems like this is Forgejo's best suggestion on how to compare the two: <a href="https://i.imgur.com/j1665QR.png" rel="nofollow">https://i.imgur.com/j1665QR.png. Not sure that helps much
  1. lloydatkinson · 1790871435 · focus · HN ↗
    "Content not viewable in your region"
    nightpool · 1790871941 · focus · HN ↗
    Ah, do you live in the UK? I'm sorry about your government. Unfortunately VPNs are the only way to get reasonable service in the UK right now.
    efilife · 1790932101 · focus · HN ↗
    [delayed]
    nightpool · 1790961915 · focus · HN ↗
    It's very widely discussed as having one of the most active regulators in the world, you can see some articles about the UK's current push for heavy regulatory burden for websites here:
    <a href="https://www.techdirt.com/2024/12/20/death-of-a-forum-how-the-uks-online-safety-act-is-killing-communities/" rel="nofollow">https://www.techdirt.com/2024/12/20/death-of-a-forum-how-the... <a href="https://www.techdirt.com/2026/07/13/the-uks-new-under-16-social-media-ban-will-cause-more-harm-than-it-prevents/" rel="nofollow">https://www.techdirt.com/2026/07/13/the-uks-new-under-16-soc...
    It costs hundreds of thousands of dollars to comply with the UK's current regulatory regime. Great for large players and horrible for small websites or ones struggling with profitability.
  2. thiht · 1790880407 · focus · HN ↗
    Gitea forking from Gogs was somewhat justified but I’ve always felt like Forgejo forking from Gitea was a huge overreaction to nothing
3. stryan · 1790805622 · focus · HN ↗
  I wish they had an actual feature comparison list. I've been trying to find anyone who can give me a list of non-trivial differences between the two; so far it's always either FUD about Gitea's governance and security structure or ForgeFed. The former has made me rather wary of the project[0] and the latter has been stagnate for years and I'm no longer convinced anything will come from it. Otherwise it's just silence.
  Personally I thought Forgejo was doing better work on their actions runner for a while from casual changelog browsing but Gitea's been putting a lot of work into theirs. Otherwise it mostly still looks like a soft-fork in practice to me.
  [0] Not that I'm thrilled with Gitea's semi-open-core setup and company but they make it seem like they're kicking puppies and dangling features over non-enterprise users head before snatching them away.
4. _g0xr · 1790807244 · focus · HN ↗
  deleted
  1. kevincox · 1790810064 · focus · HN ↗
    Of course I wouldn't recommend taking the conclusion. But it is a valuable view of some differences that the Forgejo developers perceive as valuable.
godbox · 1790803263 · focus · HN ↗
Holy shit. They went from 1.27.3 to 28.0.0. These guys are hauling ass
1. LoganDark · 1790803367 · focus · HN ↗
  They're even ahead of Apple. macOS 27? Nah, how about Gitea 28?
  1. QuantumNomad_ · 1790803520 · focus · HN ↗
    But far behind Firefox and Google Chrome.
    LoganDark · 1790803807 · focus · HN ↗
    Those are further yet behind Roblox, who is up to like release 740 now!
    ulimn · 1790808900 · focus · HN ↗
    Not for long if the next release will be Gitea 290 instead of 29.
dogline · 1790806610 · focus · HN ↗
Remember, if all you need is a git remote to push to somewhere via ssh, `git init --bare` on your server should be available and is solid if you don't need a web interface. Now you've got something you can push to on a shared server.
Unless you really also want a web interface, issue tracking, et. al. Then, use any of these fine tools. Go wild!
1. broodbucket · 1790810205 · focus · HN ↗
  It is kind of nuts how seemingly a generation of programmers came to think Git = GitHub
2. unsnap_biceps · 1790812722 · focus · HN ↗
  I don't really need the web interface, but the actions are useful. Automatically building updated docker images and software packages is enough to accept the gitea complications, but gitlab is way too heavy IMHO
  1. SmasherEpilepti · 1790813336 · focus · HN ↗
    You can do that via hooks. You could probably even manage to hook up a CI engine like woodpecker via hooks and do it entirely that way.
    Gitea or Forgejo with actions is almost certainly easier, but it's possible to do it with pure git.
    unsnap_biceps · 1790813820 · focus · HN ↗
    Actions support running on times. Sure, I could wire up a Rube Goldberg of systemd user timers and user units that trigger on hooks or I can store some yaml in the repo and it just works (tm)(r).
    Sometimes the juice isn't worth the squeeze, and for me, doing it all custom isn't worth it for my home projects.
    spwa4 · 1790862901 · focus · HN ↗
    What's wrong with a server-side post-receive hook?
    unsnap_biceps · 1790876447 · focus · HN ↗
    there's nothing wrong with it, just more work then I'd like. I'd have to setup a CI system or build my own to handle the dependency management of the jobs and, as I said, time based job runs (Rebuild this image monthly regardless of any code changes) add enough complexity that using the gitea container for the actions and ci is worth it compared to something marginally lighter weight.
  2. sublinear · 1790826822 · focus · HN ↗
    That's an interesting perspective.
    I feel like this is one of those topics where compromise is futile. I use GitLab at work and use plain git on personal projects. I don't like spending time on tools that aren't either teaching me or paying me.
3. sandreas · 1790831233 · focus · HN ↗
  [delayed]
4. pjmlp · 1790855271 · focus · HN ↗
  I miss the built-in server that mercurial has had for years (hgweb).
5. makeitrain · 1790994447 · focus · HN ↗
  I thought I was being lazy, but this has been working for me for years.
  I didn't do --bare, the live branch is checked out and I merge in dev to deploy.
marcus9999 · 1790807047 · focus · HN ↗
[dead]
donbox · 1790815697 · focus · HN ↗
Why does Gitea uses (hosts on etc.) Github and not on Gitea.
1. ChrisRR · 1790843826 · focus · HN ↗
  Welcome to the issue which has been open since 2017
  <a href="https://github.com/go-gitea/gitea/issues/1029" rel="nofollow">https://github.com/go-gitea/gitea/issues/1029
danillonunes · 1791086175 · focus · HN ↗
So... Where they using semver in the previous versions, never implemented API breaking changes and decided to drop the "1.x" because it was providing no information at all?

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.