From Newsgroup: muc.lists.freebsd.stable
--000000000000fd861f0649385e5b
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
On Sun, Jan 25, 2026 at 6:10=E2=80=AFAM <
joachim@durchholz.org> wrote:
I contributed to Forgejo for a while (tried to improve the HTTPS setup instructions but was frustrated by a slow/haphazard review process and
gave up), so FWIW my impressions:
It's a project that it constrained by developer time, which has
consequences:
* Not all parts of the code have a maintainer. This is partly due to the
fact that Forgejo is a fork of a fork.
* The CVE track record shows that they do care (and that they do have a working CVE process), but also that they did have two remotely
exploitable vulnerabilities in the past three years and needed roughly a month to fix each one.
FWIW, those of us involved with the Glasgow Haskell Compiler have been considering alternatives to GitLab because of various non-technical issues.
We rejected ForgeJo in large part because of that developer time constraint=
:
we don't have enough active developers to contribute to both it and GHC,
and they indeed don't appear to have enough on their own.
I personally contribute to a project on CodeBerg, and my impression of it i=
s
that it seems to be mostly branding and points you to ForgeJo for
documentation and contribution. Also, its CI appears to be pretty
underpowered and large projects would probably need to self-host it.
--=20
brandon s allbery kf8nh
allbery.b@gmail.com
--000000000000fd861f0649385e5b
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr"><div dir=3D"ltr">On Sun, Jan 25, 2026 at 6:10=E2=80=AFAM &= lt;<a href=3D"mailto:
joachim@durchholz.org">
joachim@durchholz.org</a>> w= rote:</div><div class=3D"gmail_quote gmail_quote_container"><blockquote cla= ss=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid = rgb(204,204,204);padding-left:1ex">I contributed to Forgejo for a while (tr= ied to improve the HTTPS setup <br>
instructions but was frustrated by a slow/haphazard review process and <br> gave up), so FWIW my impressions:<br>
It's a project that it constrained by developer time, which has <br> consequences:<br>
* Not all parts of the code have a maintainer. This is partly due to the <b=
fact that Forgejo is a fork of a fork.<br>
* The CVE track record shows that they do care (and that they do have a <br=
working CVE process), but also that they did have two remotely <br>
exploitable vulnerabilities in the past three years and needed roughly a <b=
month to fix each one.<br></blockquote><div><br></div><div>FWIW, those of u=
s involved with the Glasgow Haskell Compiler have been</div><div>considerin=
g alternatives to GitLab because of various non-technical issues.</div><div= >We rejected ForgeJo in large part because of that developer time constrain= t:</div><div>we don't have enough active developers to contribute to bo=
th it and GHC,</div><div>and they indeed don't appear to have enough on=
their own.</div><div><br></div><div>I personally contribute to a project o=
n CodeBerg, and my impression of it is</div><div>that it seems to be mostly=
branding and points you to ForgeJo for</div><div>documentation and contrib= ution. Also, its CI appears to be pretty</div><div>underpowered and large p= rojects would probably need to self-host it.</div></div><div><br></div><spa=
n class=3D"gmail_signature_prefix">-- </span><br><div dir=3D"ltr" class=3D"= gmail_signature"><div dir=3D"ltr"><div><div dir=3D"ltr"><div>brandon s allb= ery kf8nh</div><div><a href=3D"mailto:
allbery.b@gmail.com" target=3D"_blank= ">
allbery.b@gmail.com</a></div></div></div></div></div></div>
--000000000000fd861f0649385e5b--
--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to
news-admin@muc.de
--- Synchronet 3.21a-Linux NewsLink 1.2