Good note, and good callout, we should always call out these things.
But yes if you're self hosting and you both have a public facing instance and allow open registration, you are a much much braver person than I.
I'm not allowing random people hosting their git repos on mine but it's public and they can fork my own stuff on it in theoretically upload some bullshit.
Got curious and lurked your profile. You might want to update your about from Lemmy to PieFed 🙂
Oh, there is still some Lemmy link somewhere? I'm trying to find it but couldn't, where did you see it?
Oh actually it’s on your homepage (jeena.net) in the About section on the left side
Here are the steps:
- The attacker creates a standard Git repository.
- They commit a single symbolic link pointing to a sensitive target.
- Using the PutContents API, they write data to the symlink. The system follows the link and overwrites the target file outside the repository.
- By overwriting .git/config (specifically the sshCommand), the attacker can force the system to execute arbitrary commands--
amazing.
Especially since any version of Git from the last view years has a passionate hatred of symlinks for this reason, which is a bit annoying if you've a legit usecase. They're either very out-of-date, or have done some very foolish customisation...
I think the ZIP standard has something similar and it causes similar problems.
It's because of the old notion of "be generous in what you accept and strict in what you send". I think the error is something about adding more parent directories so that part of your zip file will be extracted above the selected directory. Not all implementations of zip support this "feature".
There are also all kinds of stupid ancient features in tar and zip from a time when hard drives were measured in megabytes or less. The latest episode of the open source security podcast talks about it.
People have open registration on those things... Thats.. Brave...
I have my own gitea instance in my homelab but of course its not accessable from the internet.
Well that kinda kills collaboration
I do the same thing. Anything I put on there isn't something that I would share with the Internet anyway. If it was a serious project, sure. It's just nice to have a personal git you can access over a VPN sometimes.
I can't understand why anyone would waste time writing code that won't be shared
Personal projects. Not everything has to be FOSS. My tiny little script to automate my lights turning green and my smart speaker playing All-Star by Smash Mouth at full volume, so I can jork it in peace? That shit doesn’t need to be public.
Yes, it needs to be public. The videos too.
Take my money.
Yeah. If I needed collaboration, I would just whitelist their ips or require everyone involved to use Wireguard vpn, Tailscale or other solutions that allows access without being publically exposed.
That kills collaboration from new people who just, like, discovered your project on some Lemmy thread
I wonder if it'd be feasible to make a fediverse github
Git is already a distributed version control system.
But it doesn't have any built-in concept of users, write permissions, or authentication (except for commit signing)
Hosting an unauthenticated git repo would be the equivalent to an open ssh port with no password required
Not to mention collaborative things like issue tracking, PRs, forums, etc
Forgejo has all that, and then you can achieve "federation" by virtue of pushing to whatever remote. I wasn't suggesting people use git itself (which is possible). I just meant that it's distributed as opposed to centralized like Subverison is.
no, forgejo doesnt have "all that". you are totally missing the point. git is federated, of course, but the added features of forgejo or any other known git forge is not (yet).
concept of users, write permissions, or authentication
collaborative things like issue tracking, PRs, forums, etc
Forgejo has those, yes.
and where does forgejo support federation for issues, PRs?
Never said it did, and the comment replying to didn't say it did either.
seems right. actually you were just not responding to the questions of anyone in this chain, but always responding with irrelevant things. and thanks for the downvotes! please bring some more.
"never said it did" was a response to where Forgejo supports federation for issues and PRs.
There was a discussion on Forgejo and ActivityPub IIRC
Edit: this is what you’re looking for: https://forgefed.org/
this is what I'm talking about when it comes to the selfhosted communities.
if you don't know how to properly segment and vlan your network, you have no business exposing your shit to the internet.
If i remember correctly on my gitea (now forgejo) the default is open registration which really shouldn't be the case for projects that are targeted towards self hosters.
My inital install was a long time ago so I don't remember for sure
I'm a current gitea user.. should I be moving to forgejo?
Yes, even without this current news.
Thanks! I'll add it to the todo list.
lmfao that's a lot of alts. Seems that my suspicion was correct: the exploiter is a threadiverse user.
I think it's more likely that 29 people feel pretty strongly negative about your writing style.
Not the 3-4 minutes instant downvotes🤣 after my reply. It wasn't even 3 minutes unto my response, and I got 12 downvotes across threadiverse instances.
The others forgot to read part 3.
What’s more likely, few guys created numerous accounts just to downvote your spam or people just tend to dislike spam?
Former.
You know I am an anarchist?
We have a whole host of /c/raid communities, even fash instances.
Also refresh 🧵
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
No low-effort posts. This is subjective and will largely be determined by the community member reports.
Resources:
Any issues on the community? Report it using the report flag.
Questions? DM the mods!