00:15:57 docs: allow non-github approvals https://paste.debian.net/hidden/e3f00177 00:16:24 Should be interesting to see what happens with this one :) 14:35:19 .merge+ 10052 10512 14:35:19 Added 15:04:40 According to the CoC, "[t]he project MUST use a share-alike license, such as BSD-3" 15:04:52 However, BSD-3 is not a share-alike license 15:14:16 https://paste.debian.net/hidden/a21d8228 15:15:06 ^ Fix for the above, as suggested in -research-lounge 16:20:15 @jpk68:matrix.org: Why don't you commit yourself? 16:20:30 Banned GitHub account 16:20:41 (not banned for any good reason) 16:21:19 Make a new one? I made a new one yesterday 16:21:31 tor browser and protonmail 16:21:45 Believe me, I've tried 16:22:00 Tor browser too? 16:22:19 No, clearnet with a resedential IP and real phone number 16:22:24 They don't respond to my emails 16:22:40 On desktop or mobile? 16:22:47 Desktop. 16:22:49 Anyways, I have talked about this about 400 times and I don't want to keep clogging up this channel with me complaining 16:23:13 You probably have a unique fingerprint that is banned 16:26:22 It's highly likely that you're banned because you share a fingerprint with someone that did something against the policy. Bulk registration > <@jpk68:matrix.org> (not banned for any good reason) 16:28:44 Your phone number and emails are probably flagged too 16:29:21 Make everything new. No browser extensions 16:29:57 Microsoft is god, you have been banned for good reason > <@jpk68:matrix.org> (not banned for any good reason) 16:30:11 @hfree:matrix.org: Sure, but that's besides the point. If a decentralization-focused project is entirely dependant on a centralized platform (especially one owned by a company such as Microsoft) for its operations, and users can just be entirely blacklisted at their will, that's... problematic, to say the least 16:30:59 @jpk68:matrix.org: There is a lot of problematic centralization issues in this decentralized-focused project and github is just one of them. Don't worry you are not the first and you won't be the last to complain. 16:31:48 @hfree:matrix.org: Thanks, I don't need any more convincing that the powers that be don't like me :P 16:32:00 @jpk68:matrix.org: True. Can you give me a fresh email address (without login credentials)? I will try to register from tor browser 16:32:04 * plowsof walks passed the soap box https://github.com/monero-project/monero/pull/10576#issuecomment-4415766935 16:32:12 No thanks, I'm good 16:32:36 @jpk68:matrix.org: Fake news 16:33:26 Monero is not dependent on github 16:33:46 If github disappeared tomorrow, do you think we'd be fucked? Obv not. 16:33:56 @ofrnxmr:xmr.mx: The Monero project isn't, but its contributors are 16:34:07 @syntheticbird: No they arent 16:34:26 @ofrnxmr:xmr.mx: We disagree and that's fine. No need to argue about this :) 16:34:29 @ofrnxmr:xmr.mx: oh please spare me the "just give your patch on pastebin" bs 16:34:53 You don't have to complain and share commits on paste everyday. Create an account with a different fingerprint. Tor browser works...... > <@jpk68:matrix.org> Anyways, I have talked about this about 400 times and I don't want to keep clogging up this channel with me complaining 16:34:54 @ofrnxmr:xmr.mx: I think if the CoC says "contributors MUST have a platform account to accept or reject patches", that's not gonna work 16:35:20 @ofrnxmr:xmr.mx: ^ 16:35:20 why doesnt monero mirror its codebase on the hosted gitlab repo? 16:35:41 Good question... 16:35:42 No 16:35:47 @ofrnxmr:xmr.mx: and while github exists, people that can't sign in github (skill issue imo) are blocked from contributing 16:35:55 according to your logic 16:36:25 @r4v3r23: of fucking hell the gitlab repo is so undermaintained i hope they never do that. 16:36:37 @syntheticbird: lol 16:36:46 Blocked from openibg a github pull request is not the same thing as blocked from contributinf 16:36:55 @syntheticbird: Huge skill issue 16:37:21 @ofrnxmr:xmr.mx: "YoU CaN pErFeCtLy GiVe YoUr PaTcH To SoMeOnE ElSe AnD It WiLl PoSt It FoR yOu" 16:37:41 like this is realistically ever going to happen for +100 PRs 16:38:00 Jpks probably close to 20 now 16:39:14 In the core repo? Way lower 16:39:14 Just saying push mirrors are a thing nowadays 16:39:15 On github 16:39:17 Probably six or so, plus three in GUI and seven in P2Pool 16:39:18 and Github oauth2 could perfectly be used for lazy maintainers to not have to redo an account 16:39:55 @jpk68:matrix.org: So.. 16 16:40:06 and then some in Monfluo, etc. 16:40:10 i have a doubt here, i was referring to +100 loc, not +100 PRs 16:40:55 For every single one of the commits I made after my account was banned, I had to DM someone or have them offer to go out of their way to get it posted on GH. If I have to wait 10 hours for someone to update a mirror (no offense meant at all, that's just the way it is), and have to get people to forward review comments, I can in no way contribute in the way everyone with an account can 16:41:00 @syntheticbird: https://github.com/monero-project/monero/pull/10523 1000loc 16:41:08 @ofrnxmr:xmr.mx: The lines are blurry, and it depends what you consider to be "core" 16:41:21 I said github, not core 16:42:32 I am considering just making a fork of the Monero repo on the hosted GitLab, because people have accounts there anyways 16:42:43 Unless it will use too much storage space (which it probably will) 16:42:52 > <@jpk68:matrix.org> For every single one of the commits I made after my account was banned, I had to DM someone or have them offer to go out of their way to get it posted on GH. If I have to wait 10 hours for someone to update a mirror (no offense meant at all, that's just the way it is), and have to get people to forwar [... too long, see https://mrelay.p2pool.observer/e/57_3hoMLVlZ6QzlP ] 16:42:52 You also like to use not-functional draft prs like a save button. I personally dont think the pr should have been opened in the state that it was, and storing hundreds of mbs and doing 3hrs of CI runs multipke times a day (when u know the code doesnt work) doesnt make sense 16:43:10 @ofrnxmr:xmr.mx: I am not gonna argue "technically we did" bullshit. You know the workflow through middle men is outrageously slow and unhealthy for the quality of the PR. 16:43:36 @ofrnxmr:xmr.mx: You're talking about one PR that alone comprises a CCS. "Draft" PRs exist for a reason; I have never done this for documentation changes 16:44:12 @jpk68:matrix.org: You complain about Github but gitlab is worse 16:44:20 They are requesting credit card for sign in 16:44:31 I know. Not actual GitLab, our GitLab 16:44:34 @syntheticbird: I think theyre talking about the broken ccs gitlab 16:44:39 > <@jpk68:matrix.org> For every single one of the commits I made after my account was banned, I had to DM someone or have them offer to go out of their way to get it posted on GH. If I have to wait 10 hours for someone to update a mirror (no offense meant at all, that's just the way it is), and have to get people to forwar [... too long, see https://mrelay.p2pool.observer/e/4ZL-hoMLRUZhcDJU ] 16:44:39 fingerprint or other unique indicators 16:44:49 @jpk68:matrix.org: our Gitlab ? or OUR GITLAB 16:44:55 @ofrnxmr:xmr.mx: oh 16:45:05 i mean yeah there is 5 million users in there 16:45:40 @hfree:matrix.org: Not to be rude, but I am well aware of that and you can stop bringing it up. I know how to make burner accounts. 16:46:43 How hard would it be to get someone from Core to just set up a mirror on GL, and we can submit PRs there? CI can be worried about later 16:47:10 @jpk68:matrix.org: very hard 16:47:16 and not for technical reason 16:47:22 I am sure it would be preferable to my current duct-taped Codeberg situation 16:47:32 it's already taking weeks to get gitlab back up, expecting larger maintenance from core is unrealistic 16:48:51 @jpk68:matrix.org: Then why you can't do it without getting banned and bots can? 16:48:58 Maybe then we can stop pretending this problem doesn't exist, and make it clear that the current infra is far from ideal 16:49:50 @hfree:matrix.org: bro is speaking the quiet part loud 16:50:05 @hfree:matrix.org: https://github.com/iuyua9 16:50:05 "Joined last week" 16:50:10 hfree this is a soapbox moment (if you genuinely are trying to help) 16:50:50 its not about 'being able to create an account' - which is as ez as a-z https://github.com/auyua9 https://github.com/zuyua9 16:51:41 plowsof: Can you please ask the people you know to consider moving/mirroring some stuff on GitLab? I think it's worth a try 16:52:15 @jpk68:matrix.org: this comes up every so often 16:52:21 its not gonna happen 16:52:23 @jpk68:matrix.org: bro is asking that like plowsof knows a secret society with more authority on the repo than this channel 16:52:35 "theres plenty of copies sitting around peoples hard drives" 16:52:38 selsta: isn't that core's job though? 16:53:02 @redsh4de:matrix.org: ITS ALL VOLUNTEERS ALRIGHT STOP BEING UNHAPPY ABOUT PEOPLE FREE TIME 16:53:06 @syntheticbird: Maybe having commit access to the exact repo in question is relevant here..? 16:53:37 I don't see how a mirror on Gitlab would help the workflow for people that don't have a Github account 16:53:51 we do CI and reviewing on GitHub so Codeberg or GitLab would ber irrelevant 16:53:52 @redsh4de:matrix.org: No 16:53:53 selsta: I agree with redsh4de's comment on this. This should be answered. 16:54:09 @ofrnxmr:xmr.mx: https://www.getmonero.org/2018/03/01/core-team-announcement.html 16:54:09 > Manage the codebase of the Monero Project, which includes merging code on Github, keeping backups, and ensuring the safety, security, and free access of the code from any party. 16:54:29 Core doesnt exist in the same capacity as it did in 2014 16:54:46 @redsh4de:matrix.org: lawyer said its a marketing term with no engagement sorry 16:54:59 If we want to get pedantic, read-only access to the code does not really count as "accessing the code" in the sense of contributing to open source 16:55:02 Tobtoht isnt core and he merges code on github now. Core sogns off on releases and maintains infra and wallets 16:55:14 @jpk68:matrix.org: if you can clone it... 16:55:28 @redsh4de:matrix.org: Also, that says github, not gitlab :P 16:55:52 id consider gitlab being a part of keeping backups 16:56:05 we don't use gitlab for repo backups 16:56:32 the version we use doesn't even support mirroring, afaik in the past this feature was behind a paywall 16:56:38 so we'd have to setup our own mirroring 16:56:56 Is this a frog we have to swallow? 16:57:01 also https://www.getmonero.org/community/sponsorships/ 16:57:33 Is literally anyone opposed to this in principle, or are they just not looking forward to a bit of inconvenience? 16:57:43 selsta, I half disagree on your statement. Having a push mirror on Gitlab would ease the barrier of entry for this exact reason and contribute to the privacy of contributors. Realistically, this doesn't improve the workflow of the project, but for the few cases of people not wishing to because of privacy reasons and/or unable [... too long, see https://mrelay.p2pool.observer/e/tISuh4MLV2NCTWJD ] 16:57:50 Youre the main one that doesnt want to inc(nvenience themself with a new acct, tbf 16:57:52 plowsof: Hi plowsof. I'm happy to see your CCS almost got filled aside that many expensive CCS'. I did try to help. Yes, bots can create new accounts and make PRs without getting banned. Some humans not. At this point it makes no sense to blame github 16:58:13 oh thank you 16:58:18 99.9% of our gitlab was spam 16:58:33 it'd be easier to just post a patch here then to also deal with spam prs and comments there 16:58:40 @syntheticbird: Wen librejo revival 16:59:12 selsta: my statements only have the goal to ask for an alternative to github. Of course i don't want the CCS gitlab to be used because of the reasons you just said and others 16:59:42 I don't understand what you mean with push mirror exactly in this case 17:00:53 selsta: I think it's clear a decent amount of contributors here are not happy with GitHub. I would like to respectfully ask you and others to reconsider using GitHub as the primary platform. 17:00:58 cc tobtoht plowsof 17:01:05 selsta: In a push mirror setup, Github is the main authority and another platform like Forgejo would automatically pull changes from Github, but contributors can make PRs on Forgejo, with the whole discussion and maybe CI process, and when merged it get pushed on Github. 17:01:22 I'm against it for the reasons i've said multiple times 17:01:42 @jpk68:matrix.org: Are they in the room with us now 🫡 17:02:00 selsta: Against GH, or the alternatives? 17:02:14 against moving away from GH 17:02:35 I too am against moving away from GH. I'm just advocating for a push mirror on another platform 17:02:40 @jpk68:matrix.org: idk about this (Github is fine), but having push mirrors is only a net positive as it decentralizes the contribution workflow 17:03:00 syntheticbird: how would such a push mirror get setup securely? 17:03:11 @redsh4de:matrix.org: Yes, that's what I mean. Not fully to other platforms, but towards not having GH as the sole and primary one. 17:03:20 Can this be brought up at a MRL meeting? I'm not saying I'm going to push for it, I just want to gauge interest in it. 17:03:27 Its not a research subject, so no 17:03:46 how would me make sure it passes build beforehand? we have an extensive build and test matrix on GitHub that has saved as so many build issues and regressions compared to before we had this setup 17:03:54 I don't want to merge things only for later to have fixup PRs 17:04:30 selsta: Someone can work on replicating CI workflows for GitLab's CI, and then that can be merged into the main repo alongside GH actions. 17:04:35 cuprate could lead by example? /s 17:04:53 who would pay and maintain these CI servers (Linux, Windows, macOS)? 17:05:01 we can't even get weblate setup for over a year now 17:05:19 The general fund 17:05:51 It looks like myself, SyntheticBird, and redsh4de are in support of an "official" mirror on a platform such as the self-hosted GitLab. Others do not seem entirely opposed. Is this correct? 17:06:08 I dont think that is accurate 17:06:30 no one has answered how such a push mirror would be setup securely 17:06:53 What do you mean, securely? As in, ensuring contributions are from who they say they are? 17:07:05 if the gitlab server can push to our github that's insane 17:07:08 There could be a requirement to sign commits using the same PGP key 17:07:13 selsta, You have to setup webevents with a github access tokens that can push to the upstream (github) repo. Forgejo have an automated setup for that. About CI ? We would need to have our own CI infra. So this is a valid point of concern imo 17:07:16 gitlab has critical CVEs every couple weeks 17:07:21 yep 17:07:35 Yet another reason to not use them. 17:08:05 Is there an example of a large project that does this 17:08:07 i'm against any setup where a push token would be in the hands from anyone apart from core / tobt on local devices 17:08:07 i thought we where not using github, or gitlab - or has the context gotten to large 17:08:46 no setup where a server gets a push token, that's insane for security alone for a project like monero 17:08:57 (unless i'm missing something) 17:09:04 selsta: No, it would not. It's just essentially an auto-updating mirror of the main GitHub repos, which people can fork on GitLab, and add PRs to the GitLab repo which are merged to GH after approval. 17:09:27 Ppl contribute on an offshore platform, and the stuff gets yolo's into the release w/o any of the 9/10 github main contributors noticing 17:09:30 auto updating mirror is not the same as a push mirror which was suggested 17:09:32 The reason it being 'official' is relevant is just that people consider it to be so, and will check it 17:09:36 selsta, no you are not missing anything, that is a requirement. Securing the token is up to the infra operator 17:09:44 I did not suggest a push mirror. Either is fine. 17:09:51 Hahahahahaha > <@ofrnxmr:xmr.mx> Its not a research subject, so no 17:10:41 So yes, If this is a concern the discussion can be closed and the idea rejected 17:11:04 Regarding other projects that do this, both FFmpeg and GCC have similar workflows AFAIK 17:11:47 FFmpeg has a Forgejo/cgit repo they self-host, and a mirror on GitHub that can also be used for PRs. I'm not saying it has to be exactly that, and besides, it can change over time. 17:11:50 @jpk68:matrix.org: You make me laugh. I'm thankful for your contributions. Don't get me wrong 17:12:00 the infra operator can secure as good as he wants, with GitLab being an insecure mess (mooo has update it constantly due to critical security issues), it's a matter of time until someone would get push access to our main repo 17:12:26 Then we can just have a non-push mirror. Does anyone disagree with this? 17:12:32 selsta: you can forget gitlab as an argument, no one here is ever planning on using gitlab 17:12:45 anyone can run a non-push mirror 17:12:48 we are all perfectly aware this is utter shit 17:12:56 Isnt @pyxmr2025:mozilla.org doing this already 17:13:33 @syntheticbird: It's probably best to just choose the path of least resistance 17:13:35 And didnt syn do this on librejo (forgejo) 17:13:55 @jpk68:matrix.org: You are in the wrong channel if you think so 17:14:09 literally everything about this project is taking the path of most resistance 17:14:23 @ofrnxmr:xmr.mx: They closed their CCS repo issue for it, plus it's literally based in mainland China. My point, again, is that is has to be considered official or no one is going to check the mirror. 17:14:54 @ofrnxmr:xmr.mx: yes I had a pull mirrors for all monero-project repo. But it was just updating on a timer, so not the same setup as i would have suggested with web events 17:15:19 if you use webevents, whenever one repo is updated the other are triggered to update 17:15:29 I meant in terms of getting Core to do something 17:15:46 This is just making it overcomplicated. Have a regular mirror on GL and we can move on from there. 17:16:23 ^ "Thinking about the vulnerability mess of the platform our security focused project is building upon is overcomplicating" 17:16:24 ig that woud work. the mirror would sync FROM github, forks can be created there, maintainers can pull branches manually from the mirror into gh when submitted and re-open as PRs, instead of pastebin patches 17:16:24 anyone can set something like that up and doesnt require a token 17:16:34 💪 > <@syntheticbird> literally everything about this project is taking the path of most resistance 17:17:00 @redsh4de:matrix.org: Yes. But again, it should be considered official for people to actually check/use it 17:17:24 @redsh4de:matrix.org: That's actually a good middle ground. Maybe if someone have the faith they can even make a bot account for mirroring the PRs from forgejo to the gh repo so that we can trigger CI check 17:17:52 This way i don't even have to ask anyone's permissions 17:18:23 selsta is going to hate me but he don't have to do anything 17:18:44 have to see if theres precedent for a pattern like that, but i wouldnt be surprised if a setup like that does exist somewhere 17:18:48 a bot account would work fine 17:18:59 @jpk68:matrix.org: Hhaha 17:19:09 selsta: DEAL 17:19:11 selsta: Are you willing to ask someone with the proper permissions to just set this up? Please? 17:19:25 jk 17:19:29 i don't think it would need any permissions, am I missing something? 17:19:41 anyone can setup a mirror and the bot account 17:19:57 Does plowsof have the ability to make a new monero repo on GitLab (under the monero-project account)? 17:20:01 no im joking, im just saying I could just harass you with mirror bots and if you disagreed you would have to ban the bot accounts 17:20:03 core is not going to set this up, if you want this you need to make your own bot and mirror 17:20:05 @redsh4de:matrix.org: this is exactly what i do with i2p-sam branch 17:20:20 at a later point we can transition to an "official" mirror if it works well 17:20:22 duly understood 17:20:39 There are obv bots that make prs on the repo already 17:20:42 of course it's expected that the person with the mirror has signup disabled 17:20:51 and only manually adds new users 17:20:54 and looks out for spam 17:21:26 Alright then. I guess I'll use the self-hosted GitLab for my patches 17:21:28 alr librejo revive soon then 17:21:51 @jpk68:matrix.org: How is this any diff than using your codeberg 17:22:02 Except that gitlab was down for like 2 weeks and is crippled 17:22:21 the existing codeberg should work fine, you only need someone who can setup such a bot account 17:22:49 https://codeberg.org/siosios/GithubCodebergMirror 17:22:51