Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

app.radicle.xyz

Post reply on HN
Print view View original

81–90 of 299 posts

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#81

Post by DinaCoder99 »

mariusor wrote: post #54
cloudhead wrote: post #26

Earlier quoted context omitted.

While Git is designed in some way for peer-to-peer interactions, there is no deployment of it that works that way. All deployments use the client-server model because Git lacks functionality to be deployed as-is in a peer-to-peer network. For one, it has no way of verifying that the repository you downloaded after a `git clone` is the one you asked for, which means you need to clone from a trusted source (ie. a known…

> it has no way of verifying that the repository you downloaded after a `git clone` is the one you asked for Respectfully disagree here. A repository is a(or multiple) chain(s) of commits, if each commit is signed, you know exactly that the clone you got is the one you asked for. You're right that nobody exposes a UI around this feature, but the capability is there if anyone would have any workflows that require to p…

Perhaps, but none of that commit history is related to the invocation to git clone. To acquire and verify you need both a url and a hash for each branch head you want to verify

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#84

Post by cloudhead »

mambru wrote: post #77
cloudhead wrote: post #61

Earlier quoted context omitted.

Here's the problem: how do you know that the commit signers are the current maintainers of the repo?

Does that matter if the signatures are valid?

Yeah, because for eg. I can publish the given repository from my server with an additional signed commit (signed by me) on top of the original history, and that commit could include a backdoor. You have no way of knowing whether this additional commit is "authorized" by the project leads/owners or not.

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#85

Post by cloudhead »

pastage wrote: post #79
cloudhead wrote: post #61

Earlier quoted context omitted.

Here's the problem: how do you know that the commit signers are the current maintainers of the repo?

That problem is social you can never be sure of that even with hardware signing of commits. No tech can ever solve that. Just get "pull requests" from contributors you know and pull from maintainers you trust. Is the social model.

That's not quite right, we solved this in Radicle. Each change in ownership (adding/removing maintainers) is signed by the previous set of owners. You can therefore trace the changes in ownership starting from the original set, which is bound to the Repository ID.

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#86

Post by e12e »

est wrote: post #4

This looks like a fine project for its purpose, but I think git is already open-source and p2p. You don't need sh What's missing in git is code issues, wikis, discussions, github pages and most importantly, a developer profile network. We need a way to embed project metadata into .git itself, so source code commits don't mess up with wikis and issues. Perhaps some independent refs like git notes? https://git-scm.com/…

Fossil has a few of these.

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#87

Post by throwaway220033 »

cloudhead wrote: post #59
throwaway220033 wrote: post #30

Earlier quoted context omitted.

How much budget was spent on Radicle, how many people did work on it, how long you've been building it and who is using it ?

I won't reveal anything about our finances, but the current code base is a little under 2 years old. We've worked on the general problem for over 4 years in total though. The team is around 12 people, split between protocol, cli, tui, web and content. The product is set to launch this month, so we're just starting to onboard users, but many people in the community are already using it, and we've been using it interna…

My question wasn't about your "current codebase". It was about Radicle. It was launched 6 years ago, and for some reason it's always about to onboard the first users when crypto is on hype :)

An idea doesn't take off -- totally normal, but how on earth can you fund Radicle for such a long time with no users? You can even throw it away and rewrite it! What's the source of funding for Radicle ?

Asking because you seem to be best at getting the idea funded, not really actualizing it.

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#88

Post by e12e »

cloudhead wrote: post #85
pastage wrote: post #79

Earlier quoted context omitted.

That problem is social you can never be sure of that even with hardware signing of commits. No tech can ever solve that. Just get "pull requests" from contributors you know and pull from maintainers you trust. Is the social model.

That's not quite right, we solved this in Radicle. Each change in ownership (adding/removing maintainers) is signed by the previous set of owners. You can therefore trace the changes in ownership starting from the original set, which is bound to the Repository ID.

How do you fork an abandoned repo?

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#89

Post by mariusor »

cloudhead wrote: post #61
mariusor wrote: post #54

Earlier quoted context omitted.

> it has no way of verifying that the repository you downloaded after a `git clone` is the one you asked for Respectfully disagree here. A repository is a(or multiple) chain(s) of commits, if each commit is signed, you know exactly that the clone you got is the one you asked for. You're right that nobody exposes a UI around this feature, but the capability is there if anyone would have any workflows that require to p…

Here's the problem: how do you know that the commit signers are the current maintainers of the repo?

By the same way I know how the commit signers are who they say they are in "regular" usage of GPG: I have verified the key belongs to them, or their keys are signed by people I trust to have verified, etc, etc. Like a sibling said, the problem is social rather than technical.

Re: Radicle: Open-Source, Peer-to-Peer, GitHub Alternative

#90

Post by Luker88 »

This looks wonderful, I'll read more on details and follow the project!

Does this suffer from the code search problem, or are there plans to somehow introduce that?

The main problem of decentralized and federated code management projects is that I still go to github (not even gitlab) when I want to see what other people do, how they use a lib or something, and I can search issues, too.

So we obviously can't have each of our small servers serve code search requests from all the world's developers.

...a sync-and-search-only project is probably a job for someone like the EFF, or non-profit orgs that already have sufficient funding... has anyone heard any talks in that regard?

Post reply on HN