Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

app.radicle.xyz

Post reply on HN
Print view View original

51–60 of 299 posts

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#51

Post by ianopolous »

cloudhead wrote: post #26
est wrote: post #4

This looks like a fine project for its purpose, but I think git is already open-source and p2p. You don't need sh What's missing in git is code issues, wikis, discussions, github pages and most importantly, a developer profile network. We need a way to embed project metadata into .git itself, so source code commits don't mess up with wikis and issues. Perhaps some independent refs like git notes? https://git-scm.com/…

While Git is designed in some way for peer-to-peer interactions, there is no deployment of it that works that way. All deployments use the client-server model because Git lacks functionality to be deployed as-is in a peer-to-peer network. For one, it has no way of verifying that the repository you downloaded after a `git clone` is the one you asked for, which means you need to clone from a trusted source (ie. a known…

How do you handle the SHA1 breaks in an untrusted p2p setting?

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#52

Post by grumbel »

zamalek wrote: post #46
est wrote: post #4

This looks like a fine project for its purpose, but I think git is already open-source and p2p. You don't need sh What's missing in git is code issues, wikis, discussions, github pages and most importantly, a developer profile network. We need a way to embed project metadata into .git itself, so source code commits don't mess up with wikis and issues. Perhaps some independent refs like git notes? https://git-scm.com/…

Classic git does not evade censorship, such as the extremely recent news concerning Nintendo. An idea like this has been rolling around in my head, and I'm overjoyed that someone has done the hard work.

Git evades censorship just fine, since it is properly decentralized and doesn't care about where you got the repository from. Plain HTTP transport however does not and most Git repositories are referred to by HTTP URL.

If you simply host Git on IPFS you have it properly decentralized without the limits of HTTP. IPNS (DNS of IPFS), which you need to point people to the latest version of your repository, however wasn't working all that reliably last time I tried.

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#53

Post by saurik »

From their documentation:

> It’s important to only publish repositories you own or are a maintainer of, and to communicate with the other maintainers so that they don’t initialize redundant repository identities.

Based on my experience with people taking my code and shoving it onto GitHub--as well as separately in my demoralizing general experience of putting random little "please for the love of all that is holy don't do X as it will cause problems for other users" notices in the documentation or even as interstitial UI (!!) of my products and watching everyone immediately do exactly that thing as no one reads or thinks (or even cares)--a large number of people aren't going to honor this request in the documentation... and, frankly a large number of people aren't even going to see this in the first place as the home page tells you how to push code but you only find this "important" request in the "user guide" that people definitely do not bother to read.

It thereby seems quite concerning that, apparently?!, this system is designed in a way where doing what feels like a very reasonable thing to do--just pushing whatever open source code you are working on, based on the instructions on the home page--is going to interact with something about this protocol and how things are stored that something important enough to have this separated boxed "important" statement in the documentation is going to get cluttered and maybe even confusing over time :(.

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#54

Post by mariusor »

cloudhead wrote: post #26
est wrote: post #4

This looks like a fine project for its purpose, but I think git is already open-source and p2p. You don't need sh What's missing in git is code issues, wikis, discussions, github pages and most importantly, a developer profile network. We need a way to embed project metadata into .git itself, so source code commits don't mess up with wikis and issues. Perhaps some independent refs like git notes? https://git-scm.com/…

While Git is designed in some way for peer-to-peer interactions, there is no deployment of it that works that way. All deployments use the client-server model because Git lacks functionality to be deployed as-is in a peer-to-peer network. For one, it has no way of verifying that the repository you downloaded after a `git clone` is the one you asked for, which means you need to clone from a trusted source (ie. a known…

> it has no way of verifying that the repository you downloaded after a `git clone` is the one you asked for

Respectfully disagree here. A repository is a(or multiple) chain(s) of commits, if each commit is signed, you know exactly that the clone you got is the one you asked for. You're right that nobody exposes a UI around this feature, but the capability is there if anyone would have any workflows that require to pull from random repositories instead of well established/known ones.

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#55

Post by cloudhead »

ianopolous wrote: post #51
cloudhead wrote: post #26

Earlier quoted context omitted.

While Git is designed in some way for peer-to-peer interactions, there is no deployment of it that works that way. All deployments use the client-server model because Git lacks functionality to be deployed as-is in a peer-to-peer network. For one, it has no way of verifying that the repository you downloaded after a `git clone` is the one you asked for, which means you need to clone from a trusted source (ie. a known…

How do you handle the SHA1 breaks in an untrusted p2p setting?

If you mean collision attacks, this shouldn't be a problem with Git, since it uses Hardened SHA-1. Eventually, when Git fully migrates to SHA-2, we will offer that option as well.

> Is Hardened SHA-1 vulnerable?

> No, SHA-1 hardened with counter-cryptanalysis (see ‘how do I detect the attack’) will detect cryptanalytic collision attacks. In that case it adjusts the SHA-1 computation to result in a safe hash. This means that it will compute the regular SHA-1 hash for files without a collision attack, but produce a special hash for files with a collision attack, where both files will have a different unpredictable hash.

From https://shattered.io/

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#56

Post by cloudhead »

saurik wrote: post #53

From their documentation: > It’s important to only publish repositories you own or are a maintainer of, and to communicate with the other maintainers so that they don’t initialize redundant repository identities. Based on my experience with people taking my code and shoving it onto GitHub--as well as separately in my demoralizing general experience of putting random little "please for the love of all that is holy don…

I don't think there's anything "special" here. You have the same problem currently where finding the canonical location of a repository is done via some out-of-band social network or website.

On GitHub, you also can look at the stars to give you extra confidence, and on Radicle the equivalent is the seed count for a given repository.

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#57

Post by saurik »

cloudhead wrote: post #56
saurik wrote: post #53

From their documentation: > It’s important to only publish repositories you own or are a maintainer of, and to communicate with the other maintainers so that they don’t initialize redundant repository identities. Based on my experience with people taking my code and shoving it onto GitHub--as well as separately in my demoralizing general experience of putting random little "please for the love of all that is holy don…

I don't think there's anything "special" here. You have the same problem currently where finding the canonical location of a repository is done via some out-of-band social network or website. On GitHub, you also can look at the stars to give you extra confidence, and on Radicle the equivalent is the seed count for a given repository.

Then why does the documentation say this is "important"? GitHub certainly does not have a notice anywhere saying "it's important to only publish repositories you own or are a maintainer of" (...well, I guess it could be buried deep in some user guide I never read, lol).

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#59

Post by cloudhead »

throwaway220033 wrote: post #30
lftherios wrote: post #15

Hi HN. I am the co-founder of the project. If you are interested in how the protocol works under the hood, start here: https://docs.radicle.xyz/ Docs are still WIP though.

How much budget was spent on Radicle, how many people did work on it, how long you've been building it and who is using it ?

I won't reveal anything about our finances, but the current code base is a little under 2 years old. We've worked on the general problem for over 4 years in total though. The team is around 12 people, split between protocol, cli, tui, web and content.

The product is set to launch this month, so we're just starting to onboard users, but many people in the community are already using it, and we've been using it internally for about a year.

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#60

Post by saurik »

bordumb wrote: post #21
mikepapadim wrote: post #19

How is this related to the $RAD coin?

From a technical standpoint, Radicle (P2P git protocol) is not related to $RAD. $RAD is the token of the organization that has been funding Radicle over the years.

If the RAD token has nothing to do with their product, why does it have value? Did/do they have some other product that uses the token?
Post reply on HN