Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

app.radicle.xyz

Post reply on HN
Print view View original

211–220 of 299 posts

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#211

Post by [deleted] »

always2slow wrote: post #185
zlatan_todoric wrote: post #172

Earlier quoted context omitted.

Here you go [0] - the project hasn't launched yet and there are bits and pieces to be dealt with, the current focus is a bit somewhere else. You can also build from source [1] with Rust's cargo. [0] https://files.radicle.xyz/latest/ [1] https://app.radicle.xyz/nodes/seed.radicle.garden/rad:z3gqcJ...

Thanks but... no thanks, you've missed my point entirely. Why would I want to run peer to peer software built by developers whose security stance starts with curl-bash? Would you curl-bash a webserver? an email server? No? Probably even worse for your source code repository then right?

[deleted]

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#212

Post by heybrendan »

always2slow wrote: post #165

>Installation > >The easiest way to install Radicle is by firing up your terminal and running the following command: > >$ curl -sSf https://radicle.xyz/install | sh Ah.. my high hopes were immediately dashed by the trash that is curl-bash. What a great signal for thoughtless development, if this project catches on I can't wait to watch the security train wreck unfold. Maybe someday we'll get an "Open-Source, Peer-to-…

This is an overreaction, almost to the point of absurdity.

Risks inherent to pipe installers are well understood by many. Using your logic, we should abandon Homebrew [1] (>38k stars on GitHub), PiHole [2] (>46k stars on GitHub), Chef [3], RVM [4], and countless other open source projects that use one-step automated installers (by piping to bash).

A more reasonable response would be to coordinate with the developers to update the docs to provide alternative installation methods (or better detail risks), rather than throwing the baby out with the bathwater.

[1] https://brew.sh/

[2] https://github.com/pi-hole/pi-hole

[3] https://docs.chef.io/chef_install_script/#run-the-install-sc...

[4] https://rvm.io/rvm/install

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#213

Post by alchemist1e9 »

doctorpangloss wrote: post #199
alchemist1e9 wrote: post #191

Earlier quoted context omitted.

I’m confused. What does this comment mean?

Let's say you had $12m, with the requirement that it be spent on an "interesting problem." What would you spend it on? These guys picked "distributed source code repositories, with a client idiosyncratically written in Rust and idiosyncratically built with a cryptocurrency idea." Why? I agree it's intellectually stimulating. But besides that, is there a reason they are particularly passionate about distributed source…

> I agree it's intellectually stimulating. But besides that, is there a reason they are particularly passionate about distributed source code repositories?

I’m surprised the answer isn’t obvious to you, yet again maybe I shouldn’t be as I suspect you’re a nocoiner.

Distributed decentralized anything is fundamentally about censorship resistance. Understanding that, for me, make the answer as to why they are passionate about distributed decentralized version control … they are concerned about coming censorship attempts on software, which honestly seems pretty likely given the current authoritarian direction of western civilization in general.

I’d also speculate that your perception isn’t shared by everyone based on the large number of upvotes on this submission.

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#214

Post by __MatrixMan__ »

cloudhead wrote: post #161
k8svet wrote: post #139

Earlier quoted context omitted.

Does this v3 iteration mean that if I pull Radicle from nixpkgs right now that I might be a major version behind?

I am a nix noob, but we are now using flake[0], I don't know if that helps! [0]: https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:z3gqcJUoA...

It would be neat to define the radicle repo as an input to the flake for a project which used radicle, that way you could add it to the devshell and you'd have pinned the version of radicle to your project such that running "nix flake update" updates that project's version of radicle along with updating its other dependencies (this, among other things, is what having a flake.nix at your repo root makes possible).

A workflow of this sort doesn't need nixpkgs at all, but it does require that the nix flake input handler knows how to fetch from radicle repos. I'll try it a bit later today, but I'm guessing that this will require a change to nix before it works.

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#215

Post by LegibleCrimson »

tonymet wrote: post #206
LegibleCrimson wrote: post #196

Earlier quoted context omitted.

It is if you don't care about any of the other things that Git brings to the table. I fail to see what `git rebase` has to do with issue trackers, project boards, wikis, repository notifications, or any of the other things that GitHub does. I use git forges as well as `git rebase`. Neither of these things precludes the other.

GCM glorified commit messages

I find them useful, as do many others. They can do many things that commit messages obviously can't.

You can technically coordinate many of the other things through external tools like email, but email sucks, and there is real value to having them all in one place.

Obviously, I'd rather have all these things part of the repo itself, like with Fossil. What's what Radicle is trying to do, it looks like.

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#216

Post by LegibleCrimson »

andrewaylett wrote: post #207
always2slow wrote: post #185

Earlier quoted context omitted.

Thanks but... no thanks, you've missed my point entirely. Why would I want to run peer to peer software built by developers whose security stance starts with curl-bash? Would you curl-bash a webserver? an email server? No? Probably even worse for your source code repository then right?

The counterpoint would be: you're intending to run their code, if it's malicious then you're hosed anyway. In bygone times, one might suffer from a truncation attack or otherwise end up running arbitrary code that's not what the vendor intended. Nowadays, there's really no security difference in curl|bash vs downloading a package and running it. Or, indeed, installing using `cargo install`. That doesn't mean I'm happ…

The cleanup and uninstall concern is one of the reasons I run as many things in containers as I can. It's so easy to blow away a container and its volumes compared to traditional software uninstallation.

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#217

Post by k8svet »

__MatrixMan__ wrote: post #214
cloudhead wrote: post #161

Earlier quoted context omitted.

I am a nix noob, but we are now using flake[0], I don't know if that helps! [0]: https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:z3gqcJUoA...

It would be neat to define the radicle repo as an input to the flake for a project which used radicle, that way you could add it to the devshell and you'd have pinned the version of radicle to your project such that running "nix flake update" updates that project's version of radicle along with updating its other dependencies (this, among other things, is what having a flake.nix at your repo root makes possible). A w…

Interesting. "fetchFromRadicle" would be insanely cool.

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#218

Post by oooyay »

colinsane wrote: post #208
clemiclemen wrote: post #201

Earlier quoted context omitted.

I think this already exists for issues. git-bug [1] uses git internal files to store the issues. It is distributed and it even comes with a web ui in addition to the usual cli. [1]: https://github.com/MichaelMure/git-bug

do you know of any projects using [anything like] git-bug? i know i've encountered something like this once in a notable repo. thought it was graphics related, like mesa or something, but looks like they're using GitLab.

Most CI runners use git notes which is similar to what git-bug uses iirc

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#219

Post by k8svet »

cloudhead wrote: post #161
k8svet wrote: post #139

Earlier quoted context omitted.

Does this v3 iteration mean that if I pull Radicle from nixpkgs right now that I might be a major version behind?

I am a nix noob, but we are now using flake[0], I don't know if that helps! [0]: https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:z3gqcJUoA...

Of course you are! All the coolest projects are! Thanks, now there's no excuse to not try later!

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#220

Post by computerfriend »

wokwokwok wrote: post #40
lftherios wrote: post #15

Hi HN. I am the co-founder of the project. If you are interested in how the protocol works under the hood, start here: https://docs.radicle.xyz/ Docs are still WIP though.

I read the documentation and this stands out to me: > Radicle repositories, which can be either public or private, can accommodate diverse content including source code, documentation, and arbitrary data sets. If this is, basically, a peer-to-peer file sharing application, what part of the protocol handles dealing with abuse? Otherwise, how is this different from the previous generation of file sharing applications (…

Sharing arbitrary copyrighted content did not ruin BitTorrent so I don't see why it would ruin this.
Post reply on HN