Sr.ht, the hacker's forge, now open for public alpha • Hacker News Board

Re: Sr.ht, the hacker's forge, now open for public alpha

#121

Post by sodaplayer » Thu, Nov 15, 2018, 9:46 PM UTC

Hey, this is pretty neat!

One quick bit of feedback: In the audit log, I noticed oauth tokens being issued even though I didn't recall granting any. I had a moment of pause worrying I was breached until I realized it was the various sr.ht services requesting the tokens. It would be cool if there was something to map the client ids to the names of the different services in the audit log.

Anyway, thanks for building this service. Like other's have already said, it's cool to see a useful dev-focused tool from within the community.

Re: Sr.ht, the hacker's forge, now open for public alpha

#122

Post by Sir_Cmpwn » Thu, Nov 15, 2018, 9:49 PM UTC

sodaplayer wrote: post #121

Hey, this is pretty neat! One quick bit of feedback: In the audit log, I noticed oauth tokens being issued even though I didn't recall granting any. I had a moment of pause worrying I was breached until I realized it was the various sr.ht services requesting the tokens. It would be cool if there was something to map the client ids to the names of the different services in the audit log. Anyway, thanks for building th…

Thanks! I should hide internal oauth tokens from the audit log. I'm glad you like sr.ht!

Re: Sr.ht, the hacker's forge, now open for public alpha

#123

Post by aktau » Thu, Nov 15, 2018, 9:54 PM UTC

I remember a discussion with Drew on HN a while ago. I held that the GitHub model was more inviting to small contributions given the overhead of figuring out how to get said small contribution integrated was paid for every new project outside of GitHub(-likes), but only once for GitHub and friends [1] (see discussion at https://news.ycombinator.com/item?id=17803588).

sr.ht takes a very good stab at that problem, while maintaining that old-style approach. (For example through predictable mailing list names, should the project choose to use lists.sr.ht, which is likely.)

Kudos, Drew.

One intriguing thing about sr.ht is the way builds.sr.ht is described: amazingly powerful [2]. It's been a while since I configured myself a Travis workflow, but remember it was YAML based as well and one could do quite a number of things with it. What I'm missing is a description of exactly how builds.sr.ht towers above all the rest.

[1]: By approximation, some projects hosted on GitHub have more specific rules and will not consider those who deviate.

[2]: https://drewdevault.com/2018/11/15/sr.ht-general-availabilit...

Re: Sr.ht, the hacker's forge, now open for public alpha

#124

Post by stock_toaster » Thu, Nov 15, 2018, 9:58 PM UTC

Sir_Cmpwn wrote: post #16

buoyantair wrote: post #15

Will we be able to selfhost it on our own infra?

Yep. https://man.sr.ht/installation.md

I didn't happen to see install instructions for dispatch on that page. Is that an oversight or is dispatch a component of builds.sr.ht?

Re: Sr.ht, the hacker's forge, now open for public alpha

#125

Post by tptacek » Thu, Nov 15, 2018, 10:02 PM UTC

yellowapple wrote: post #110

tptacek wrote: post #27

How does this compare to Trac, which is also a 100% free, open source "software forge" (also built on Python)?

One immediate difference is that sr.ht has a publicly-hosted version; I'm having trouble finding that for Trac. Trac is also not JS-free, so for those who prefer to not rely on arbitrary Turing-complete code running locally without explicit permission, sr.ht has an edge there. That said, Trac feels a lot more polished (unsurprisingly, given that it has a significant headstart in terms of development resource and time…

Right, Trac has an extreme head start; it was, before Github, practically the de facto standard answer to this "software forge" problem. But it also continues to work just great, and has a pretty decent ecosystem.

Re: Sr.ht, the hacker's forge, now open for public alpha

#126

Post by Sir_Cmpwn » Thu, Nov 15, 2018, 10:02 PM UTC

stock_toaster wrote: post #124

Sir_Cmpwn wrote: post #16

Earlier quoted context omitted.

Yep. https://man.sr.ht/installation.md

I didn't happen to see install instructions for dispatch on that page. Is that an oversight or is dispatch a component of builds.sr.ht?

dispatch is the newest sr.ht service and docs are scant. They'll come eventually... but it's pretty similar to the rest of sr.ht, you could probably figure it out if you gave it a shot.

Re: Sr.ht, the hacker's forge, now open for public alpha

#127

Post by carapace » Thu, Nov 15, 2018, 10:03 PM UTC

> average page weighing less than 10 KiB, with no tracking and no JavaScript.

Good Lord, I had a visceral reaction to that. (It was like the opposite of the urge to throw up.)

Re: Sr.ht, the hacker's forge, now open for public alpha

#128

Post by kazinator » Thu, Nov 15, 2018, 10:04 PM UTC

tarruda wrote: post #26

> On top of that, sr.ht is one of the most lightweight websites on the internet, with the average page weighing less than 10 KiB, with no tracking and no JavaScript At the age of Spectre/Meltdown, it is no longer safe to leave JavaScript enabled, so thank you for this.

Javascript hardly needs help from Spectre/Meltdown to be a security threat. It has never been safe to allow Javascript. A reasonable compromise is to use a Javascript blocker that lets you white-list domains.

Re: Sr.ht, the hacker's forge, now open for public alpha

#129

Post by zestyping » Thu, Nov 15, 2018, 10:11 PM UTC

You mention:

> lists.sr.ht finally modernizes mailing lists

What's new that lists.sr.ht brings to the table? I only had a quick browse of https://lists.sr.ht/~sircmpwn/sr.ht-dev, but as far as I could tell it looked like a pretty normal list of topic lines (like a typical web forum), and the e-mail conversations themselves are just the messages concatenated into one long page (e.g. https://lists.sr.ht/~emersion/mrsh-dev/%3C20180916165820.144...).

Is there something interesting and new about the way these mailing lists work that I'm not seeing?

Re: Sr.ht, the hacker's forge, now open for public alpha

#130

Post by stock_toaster » Thu, Nov 15, 2018, 10:12 PM UTC

Sir_Cmpwn wrote: post #126

stock_toaster wrote: post #124

Earlier quoted context omitted.

I didn't happen to see install instructions for dispatch on that page. Is that an oversight or is dispatch a component of builds.sr.ht?

dispatch is the newest sr.ht service and docs are scant. They'll come eventually... but it's pretty similar to the rest of sr.ht, you could probably figure it out if you gave it a shot.

Very cool. Thanks!