Hacker News

points by KronisLV 1 day ago | 0 comments

If Alpine prides themselves on focusing so much on security, they probably shouldn’t use GitLab - the attack surface is too great and it’s never going to be easy to keep safe and up to date fully, unless you have FTEs whose main job is just maintaining it.

Just get the source code of Forgejo, audit it thoroughly and run an instance of that.

[–] pprotas 1 day ago

Didn’t Forgejo have a crit in pretty much all versions recently https://news.ycombinator.com/item?id=49645907

I like Forgejo btw, but these days everything is vulnerable. Switching tools isn’t the final answer

[–] KronisLV 21 hours ago

Forgejo did and will in the future, same as GitLab.

The only difference is the architecture/moving parts/featureset which roughly corresponds to the attack surface, which then roughly corresponds to how many CVEs will be found, though that's also affected by how big a given target is.

For example, total new CVEs:

          2024 2025 2026
  Forgejo    1   10  >55 (confirmed ones, checked what I could)
  Gitea      1    9  121
  GitLab   145  165  251

(a lot of the reporting out there sucks, cause some CVEs get assigned to Gitea and may or may not be applicable to Forgejo as well, so you have to dig into the details for example https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSear... and https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSear... and https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSear... )

That's not to say that Forgejo is some perfect piece of software, just that it builds on some of the past experience of Gitea and just has both less features than GitLab, is simpler, and also a smaller target. It will probably get >100 per year too soon, but I'd reckon that the totals will remain than GitLab for the foreseeable future.

Maybe I'm wrong!

[–] dewey 19 hours ago

> Just get the source code of Forgejo, audit it thoroughly and run an instance of that.

Or use the open-source version that is used by a lot of big companies and enterprises and has the enterprise features they actually need. Some of these will also have their own security team and would be flagging security issues to Gitlab in a hopefully responsible way.

There's no such thing as "just get the source and make sure there's no security issues". If it would be that easy don't you think Forgejo would've already done that?

[–] qweqwe14 1 day ago

Thinking that Forgejo is a viable replacement for someone who uses GitLab is wild. It's a bit like telling someone to use cgit instead of Forgejo. (yes I know Alpine uses cgit as well)

[–] KronisLV 21 hours ago

Depends on the team and which of the actual features you use! As someone who introduced GitLab CI to my org as well, but runs most of my private stuff on Gitea + WoodpeckerCI, based on what I've seen there are A LOT of workflows that don't need that much out of GitLab, especially when you can move a lot of complexity into your CI solution alongside some light patches to the forge if necessary. Hell, I've seen people who haven't migrated off of SVN do okay (though personally I wouldn't punish myself like that).

[–] ndsipa_pomu 17 hours ago

If they switched to using the official Gitlab containers, then it's just a case of upgrading to a new version number when Gitlab sends a security email (about once a fortnight or so).