Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

app.radicle.xyz

Post reply on HN
Print view View original

121–130 of 299 posts

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#121

Post by maninak »

miohtama wrote: post #118
cloudhead wrote: post #114

Earlier quoted context omitted.

Thanks! There is no mirroring built-in yet, though this is something we're looking into. It should theoretically be as simple as setting up a `cron` job that pulls from github and pushes to radicle every hour, eg. git pull github master git push rad master

Good work! The main value capture at Github is issue tracking, PR reviews and discussion. Maybe not today, but is there an automated way to migrate these over in the future?

Yup, you can do this today! There's already this tool https://github.com/cytechmobile/radicle-github-migrate, built and maintained by the community, and which is already quite capable.

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#123

Post by gsaslis »

cloudhead wrote: post #114
ryscheng wrote: post #104

Congrats on the launch! I’ve been following this project and I’m really excited to see how much it has matured. For projects currently on GitHub, what’s the best way to migrate? Is there a mirror mode as we test it out?

Thanks! There is no mirroring built-in yet, though this is something we're looking into. It should theoretically be as simple as setting up a `cron` job that pulls from github and pushes to radicle every hour, eg. git pull github master git push rad master

In addition, in order to migrate your GitHub issues to Radicle (which the above doesn't cover), there's this command-line tool [1] that should get you most - if not all - of the way there.

Migrating GitHub Pull Requests (PRs) to Radicle Patches is somewhat more involved, but that should still be possible (even if it involves some loss of information along the way, due to potential schema mismatches) ...

[1] - https://github.com/cytechmobile/radicle-github-migrate

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#124

Post by cloudhead »

ianopolous wrote: post #67
cloudhead wrote: post #55

Earlier quoted context omitted.

If you mean collision attacks, this shouldn't be a problem with Git, since it uses Hardened SHA-1. Eventually, when Git fully migrates to SHA-2, we will offer that option as well. > Is Hardened SHA-1 vulnerable? > No, SHA-1 hardened with counter-cryptanalysis (see ‘how do I detect the attack’) will detect cryptanalytic collision attacks. In that case it adjusts the SHA-1 computation to result in a safe hash. This mea…

So you use hardened sha1 in radicle? It would be great to see this in the docs.

Everything that is replicated on the network is stored as a Git object, using the libgit2[0] library. This library uses hardened SHA-1 internally, which is called sha1dc (for "detect collision"). Will add to the docs, good idea!

[0]: https://github.com/libgit2/libgit2/blob/ac0f2245510f6c75db1b...

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#125

Post by MatthiasPortzel »

cloudhead wrote: post #85
pastage wrote: post #79

Earlier quoted context omitted.

That problem is social you can never be sure of that even with hardware signing of commits. No tech can ever solve that. Just get "pull requests" from contributors you know and pull from maintainers you trust. Is the social model.

That's not quite right, we solved this in Radicle. Each change in ownership (adding/removing maintainers) is signed by the previous set of owners. You can therefore trace the changes in ownership starting from the original set, which is bound to the Repository ID.

How do I verify the “original set”, or the Repository ID, if not out-of-band communication (like a project’s official website)? And then what advantage does this have over the project maintainer signing commits with their SSH key and publishing the public key out-of-band?

I think there’s room for improvements in distributed or self-hosted git, but I think they exist more in the realm of usability than any technological limitations with the protocol. Most people don’t sign git commits because they don’t know it’s possible—not because it’s insecure.

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#126

Post by crabbone »

miohtama wrote: post #120
cloudhead wrote: post #117

Earlier quoted context omitted.

Hey there. Yes, Windows support is something we'd like to have, but focusing on less OSes is helping us ship faster. In principle, there shouldn't be any issue in porting to Windows, but since no one on the team runs Windows it would have been hard to ensure things are working smoothly. If there is demand though, we will certainly start allocating time towards it. Radicle does work on macOS as well.

Windows Subsystem for Linux should alleviate these pains a lot.

It's just a somewhat better integrated VM with all the shortcomings that entails...

Having to deal with individual users of various software I'd sometimes resort to using WSL, but this isn't an always acceptable way.

To shed more light: some of the users of the system I'm talking about are hospital researchers. These people are very limited in terms of choices they can make about their computers. While it could be possible sometimes to convince hospital's IT to install / enable WSL, this won't work all the time esp. because it, essentially, allows too much control for the otherwise very restricted user over their workstation. MSYS2 here has an advantage that everything can be packaged as a single program (Git is distributed in this way for example), which makes it easier on the org. IT. In principle, WSL can be used that way too (iirc. Docker does something like it), but you'd still need a bunch of Windows-native wrapping for things to work (i.e. I understand that there needs to be at least one service process that does the peering).

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#127

Post by mariusor »

cloudhead wrote: post #108
mariusor wrote: post #92

Earlier quoted context omitted.

Sure, but again, you've added convenience - or what you feel like it's convenience - for something that probably can be achieved right now with open source tools. A "CONTRIBUTORS" file with sign-offs by maintainers is an example of a solution for the same thing. I don't deny that your improvements can benefit certain teams/developers but I feel like there are very few people that would actually care about them and th…

A CONTRIBUTORS file is easy to change by anyone hosting the repository - it's useless for the purpose of verification, unless you have a toolchain to verify each change to said file. "Sign-offs by maintainers" it not useful either unless you already know who the maintainers are, and you are kept up to date (by a trusted source) when the maintainers change. This is what Radicle does, for free, when you clone a repo.

All good points, but now you moved the trust requirement from me having to trust the people working on the code, to me having to trust the tool that hosts the code. I'm not convinced your model is better. :P

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#128

Post by perihelions »

That's a neat name! If "seeding" is the word for distribution in a peer-to-peer network, then a "radicle" (not a "radical"!) must be named after:

- "In botany, the radicle is the first part of a seedling (a growing plant embryo) to emerge from the seed during the process of germination.[1]"

https://en.wikipedia.org/wiki/Radicle

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#129

Post by gsaslis »

BlueTemplar wrote: post #80
viraptor wrote: post #6

Earlier quoted context omitted.

You're missing the discovery part. You want to get the repository X from user Y cloned - how do you find it? Especially if you don't know Y and their computer is off? Also radicle does want to tackle the issues / prs and other elements you mentioned as well.

How do you find a website ? And presumably the person hosting it will make sure that the computer hosting it is often on, for instance ISP routers and TV boxes are a good way to popularize it, since they often come with NAS capabilities : https://en.wikipedia.org/wiki/Freebox (Notably, it also supports torrents and creating timed links to share files via FTP.)

Depends on what you mean by finding :

- finding what the domain name is ? - resolving the DNS to an IP address ?

Radicle solves both problems in theory, but more the latter than the former right now:

- there is some basic functionality to search for projects hosted on Radicle, to find the right repo id (I expect this area will see a lot more activity and improvements in the near future), - given a repo id, actually getting the code onto your laptop. This is where the p2p network comes in, so that the person hosting it doesn't always need to keep their computer/router/tv box on, etc.

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#130

Post by chefandy »

Their monetization strategy is pretty critical for people who’d sink their time into the service and entrust it with the code for long-running projects. So… how do they plan on making money off of this? If they can’t or won’t say, what sort of projects do they imagine they’d attract in spite of that? (e.g. ephemeral ones? Data sets about current events?)

Downvoters: do you not think their monetization strategy is important to potential users? Surely their investors didn’t throw that money at them out of the goodness of their hearts, and surely it’s apparent how that could affect their users in the long run.

Post reply on HN