Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apache considered harmful

mikealrogers.com

Post reply on HN
Print view View original

41–50 of 171 posts

Re: Apache considered harmful

#41

Post by tptacek »

DannoHung wrote: post #34
tptacek wrote: post #29

Earlier quoted context omitted.

I'm not totally familiar with the issues here, but from an earlier perusal of the email threads on this, it seems like ASF's concern involves things like git's ability to edit the repository history.

I'm not super familiar with subversion's internals, but couldn't a malicious user edit a subversion repo history?

Without access to the database itself? How?

This is part of git's interface. (I appreciate it and don't think it's a bogeyman, but can see how it could be incompatible with some projects).

Re: Apache considered harmful

#42

Post by polychrome »

So you're saying a system that has had repeated successes is harmful. I really think you make a good point here about the need to remain open to change. So talk about that. Obviously github has some very positive impact. How can Apache adapt to that? You're not really talking about the tools here, you're talking about community.

I see a potential solution here being that Apache has different rules for projects in different stages. Do you think that would solve the issues?

Remember, you're view of anarchy on GitHub will only last so long. Rules and order come out of anarchy for a reason and like all things GitHub will become the exact same stale community you're complaining of now in 10 years.

Re: Apache considered harmful

#43

Post by aidos »

DannoHung wrote: post #34
tptacek wrote: post #29

Earlier quoted context omitted.

I'm not totally familiar with the issues here, but from an earlier perusal of the email threads on this, it seems like ASF's concern involves things like git's ability to edit the repository history.

I'm not super familiar with subversion's internals, but couldn't a malicious user edit a subversion repo history?

I don't think it's easy to do. You can change a commit message, but even that's not easy (you basically need admin access to the repo files).

If you want to edit the contents of the repo I think you need to read > filter > rewrite the whole thing. I could be wrong about this, it's been a while since I thought about it.

Re: Apache considered harmful

#44

Post by [deleted] »

mef wrote: post #22
jaaron wrote: post #15

Ok, there's a lot to cover here. First off, the Apache Software Foundation isn't trying to absorb anyone or anything. Projects and people come to the ASF. It's a specific policy of the Foundation to NOT solicit projects. If someone says they're representing Apache and soliciting projects, they're wrong. Secondly, Apache is very opinionated about how projects should be run. This comes from years of experience as not o…

what about Subversion goes "straight to the core" of the ASF that is not also true about git?

[deleted]

Re: Apache considered harmful

#45

Post by umarmung »

mef wrote: post #22
jaaron wrote: post #15

Ok, there's a lot to cover here. First off, the Apache Software Foundation isn't trying to absorb anyone or anything. Projects and people come to the ASF. It's a specific policy of the Foundation to NOT solicit projects. If someone says they're representing Apache and soliciting projects, they're wrong. Secondly, Apache is very opinionated about how projects should be run. This comes from years of experience as not o…

what about Subversion goes "straight to the core" of the ASF that is not also true about git?

Subversion is a centralised or push model.

Git is a distributed or pull model.

This is at the heart of the processes one may use, certainly within a project but possibly at cross-project or organisational model.

Re: Apache considered harmful

#46

Post by cpeterso »

jaaron wrote: post #15

Ok, there's a lot to cover here. First off, the Apache Software Foundation isn't trying to absorb anyone or anything. Projects and people come to the ASF. It's a specific policy of the Foundation to NOT solicit projects. If someone says they're representing Apache and soliciting projects, they're wrong. Secondly, Apache is very opinionated about how projects should be run. This comes from years of experience as not o…

Ironically, http://git.apache.org is not responding.

Re: Apache considered harmful

#47

Post by nknight »

tptacek wrote: post #29
buff-a wrote: post #23

Earlier quoted context omitted.

There's no reason apache can't maintain its own "legally authorative" git repo. Nothing in the authors post suggest that he is confusing the ASF with a "coding sandbox". Making that claim suggests to me that you are invested in the alternative and not thinking objectively. And I disagree about subversion being "made for Apache in the way Linus made git for Linux". Subversion is an utterly derivative implementation of…

I'm not totally familiar with the issues here, but from an earlier perusal of the email threads on this, it seems like ASF's concern involves things like git's ability to edit the repository history.

Yeah, that particular bit of FUD is quite popular with the anti-git crowd. It's nonsense. Any attempt to edit the history of a public repository will be noticed instantly by anybody who tries to sync up, no matter what.

Stick in a post-commit hook to force a sync to a backup repo nobody has access to if you want to be really paranoid, but as it is, git is already far more resilient against tampering with the public history than svn ever was.

Re: Apache considered harmful

#48

Post by JoshTriplett »

tptacek wrote: post #29
buff-a wrote: post #23

Earlier quoted context omitted.

There's no reason apache can't maintain its own "legally authorative" git repo. Nothing in the authors post suggest that he is confusing the ASF with a "coding sandbox". Making that claim suggests to me that you are invested in the alternative and not thinking objectively. And I disagree about subversion being "made for Apache in the way Linus made git for Linux". Subversion is an utterly derivative implementation of…

I'm not totally familiar with the issues here, but from an earlier perusal of the email threads on this, it seems like ASF's concern involves things like git's ability to edit the repository history.

Git normally only allows you to edit unpublished history; the server can prohibit editing of published history. Similarly, svn allows history editing if the server permits it.

Re: Apache considered harmful

#49

Post by nknight »

aidos wrote: post #43
DannoHung wrote: post #34

Earlier quoted context omitted.

I'm not super familiar with subversion's internals, but couldn't a malicious user edit a subversion repo history?

I don't think it's easy to do. You can change a commit message, but even that's not easy (you basically need admin access to the repo files). If you want to edit the contents of the repo I think you need to read > filter > rewrite the whole thing. I could be wrong about this, it's been a while since I thought about it.

Which is utterly trivial (I've done it, seriously, it's not the big deal you seem to think it is, aside from the obvious difficulty of particularly large repos), and is not conceptually different from what's necessary for editing git's history, except that nobody can tell you've done it without comparing the "new" repo to the old one -- and under svn's internal model, no one but the server will normally have a complete history.

With git's model, not only does everybody have the history, but the commit ID themselves are your insurance against tampering. You effectively validate that history every time you sync with another git repo.

Re: Apache considered harmful

#50

Post by ccashell »

apu wrote: post #3

Note that this article is about the Apache Software Foundation, not the webserver.

Yeah, I found the title to be misleading and quite annoying. It should definitely be fixed to clarify. To the vast majority of the IT world, Apache == Web Server, not Apache Software Foundation.
Post reply on HN