Slashdot Mirror
FSF Migrating From Savannah to Gforge
bluestrain writes "It's been almost 4 months since Savannah was hacked. The site is still not completely functional, no new projects have been accepted since December 2003. Now it seems that the FSF is abandoning Savannah in favor of Gforge. RMS himself has
confirmed the plans. A few developers are questioning the change. Hopefully the dust will settle and savannah can start accepting projects again."
...already. Savannah moving over is certainly a big one, though.
Stuff like this is why we're continuing to optimize GForge's SQL...
The Army reading list
If you just need a good (and free) public CVS server, what other options are there besides sf and gforge?
Do you even lift?
These aren't the 'roids you're looking for.
I consider SourceForge to be representative of Open Source Software, and Savannah to be representative of Free Software.
It's amazing how accurately they seem to portray their respective ideologies.
May we never see th
Oooh! GForge looks cute.
(Although I suggest that people using it make that decision based on a more technical analysis)
"Shouldn't that be GNU/Forge?"
"I for one welcome our Gnu project management overlords"
"In Soviet Russia, projects manage gnu!"
Please help metamoderate.
This is probably uneducated on the matter, but I can understand why they want to move.
Frankly 4 months is way too long for the site to be "not completely functional" and it can't help but make you doubt the quality of the administration of the site if there weren't sufficient provisions in place for this eventuality. Any website is a target so any webadmin should have a plan in place.
When there are seemingly more secure options out there, more reliable anyway, then you'd go with them. Being faithful is one thing, but you can only do that for so long.
Seems like Stallman has lost sight of his roots!
...you will have keyword index searching of all source? Will 1 gig be enough for a repository size? Could this be the largest size implementation of source control using an email service?
Anyone know if they can get subversion support in their as long as they are going through the effort to switch? I'd really like to see a free OSS hosting solution using all the latest and greatest tools. That and I'm not to sure about trusting the future of SourceForge, given VA's seemingly complete retraction from the open source community.
-- Fighting mediocrity one bad post at a time.
Gforge may be great for high traffic sites like Savanaah, but for low traffic 1-10 project sites I use Xoops+MyXoopsForge or Novell Forge. I think Savanahh made a good choice here, but they are stuck once they port. Novell Forge is the other choice.
GForge uses some highly optimized transaction stuff and database functions inside postgres that probably should be in the PHP layer.
Reminds me to port MyXoopsForge to postnuke to take advantage of ADODB! Compatibility or speed?
-Electrawn
I don't have time to discuss this further. I am in the hospital and falling behind on my other work.
He's in hospital? Nothing serious, I hope.
SpamNet - a spam blocker that really works
Let everyone hope that Richard Stallman gets well soon.
Dammit!
You beat me to it.
The owls are not what they seem
His post says that he is in the hospital. What happened to him?
http://mediagoblin.org/
Considering everyone's favorite company in the world, VA Software, is pimping SourceForge as a tool to help companies outsource their workers to India..I'm glad the FSF is going with something _other_ than SourceForge, frankly.
Having your project on SourceForge gives VA's salesmen something to point to, and say "See? Look how flexible it is! Look how many people are using it!"
Go look for yourself. VA is pimping SourceForge off as a tool to help companies ship jobs overseas. They don't even hide the fact.
Have a look for yourself: VA Software
I do think that is rather disconcerting. Rather than fix the problem, the solution was to "upgrade" or "install other software".
Sorta like how Windows users are "trained" to handle their problems - either live with them or buy more software.
Windows: Years in the making, hacked every day, still not working.
Would someone enlighten me to the main differences between Savannah, GForge and SourceForge?
[IIRC, SourceForge is written in PHP. I've never been comfortable with how customizable and interoperable the whole PHP package is...]
"Provided by the management for your protection."
It sounds like a total of two people are questioning this decision, which is a small number given how many people use savannah. I have rarely seen a controversy about GNU end so quickly - there were a total of about ten messages in the thread. There is always someone for whom any change is a big tragedy.
As to losing track of roots, maybe RMS is getting a little bit more pragmatic in his old age. It's all very well and good to say "we should do X" when you have the resources to do X, but if you don't have the resources to do X, then saying "we should do X" is just stupid.
-delusions of grandeur.
-dementia.
-old codgers disease.
-BO.
The doctor, a specialist in indegent care, said it is the worst he had ever seen.
Is it just me, or is gforge.org already slashdotted? gforge might be more secure, but what about stability?
http://mediagoblin.org/
1) Savannah is insecure.
2) GForce is nice.
3) VA advertises SourceForge as a tool to help companies ship jobs overseas. Go look at their website for yourself if you don't believe it. They're not even bashful about it. I'm not surprised people are leaving it in droves, if not for sucking, but for the fact they're (the developers) are getting dicked as well.
It would seem that Gforge is /.ed. I would be thinking the move over if I was FSF.
Ya the same thing happened when debian got hacked. Took a couple months for the shit to come back up. The static pages came up but the stuff with cgi took forever. That's when i switched to another distro. I need a distro that is secure and responds to infrastructure failure quickly. Debian does not.
Let's see you develop new security protocols overnight.
#3 is very important! I can't believe that Slashdotters don't seem to care about this issue. VASoftware is actively selling SourceForge as an "offshoring" tool (not even "outsourcing", but OFFSHORING).
I can't imagine anything more on topic.
VA doesn't even call it "outsourcing". They call it "offshoring". So much for supporting the "community".
What's so wrong with using the techinical tools for outsourcing. If you don't like this trend, I understand you. But the best way to fight IMHO is to promote a law that requires paying the US (or watever country's corporation is outsourcing) minimal wages to the workers in India, Russia, etc. This will not allow them (us) compete only on price.
The very next words I quoted said, "according to Richard Stallman". Well, I guess you see that as him throwing his hands up in the air and giving up. You don't know Stallman very well, do you? If you recognized the way RMS works, you'd know that on religious differences like this, he is very pedantic and doesn't stop.
I mean, read the following made up quote to realize that I'm right: "The decision to move to MS IIS was made by Bradley Kuhn and the system adminitrators, according to Richard Stallman. They considered Apache could not be made secure enough."
Sure, this comparison isn't exactly valid because GForge is GPL'd and Apache is way more secure than IIS, but Richard "St. Ignucius" Stallman's brain is not wired like most people's, and believe me, he has veto power on all religious issues.
Sometimes a few of the users try to hold total power over all the rest. For example, in 1984, a few users at the MIT AI lab decided to seize power by changing the operator password on the Twenex system and keeping it secret from everyone else. (I was able to thwart this coup and give power back to the users by patching the kernel, but I wouldn't know how to do that in Unix.)
However, occasionally the rulers do tell someone. Under the usual su mechanism, once someone learns the root password who sympathizes with the ordinary users, he can tell the rest. The "wheel group" feature would make this impossible, and thus cement the power of the rulers.
I'm on the side of the masses, not that of the rulers. If you are used to supporting the bosses and sysadmins in whatever they do, you might find this idea strange at first.
Many of the previous savannah contributors have already moved to gna.org, which is sometimes referred to as savannah's successor.
I have already moved all my projects to gna a month ago. Gna is way more stable and way faster than savannah. I love it.
Here is a more comprehensive quote:
Savannah is lesser used -- there are fewer adherents of Free Software than Open Source.
The Open Source stance (as exemplified by ESR) is a more pragmatic one than an ideological one -- that people should use Open Source rather than Free Software because it *works better* than closed source, not because of a moral or philosophical mandate. The primary issue that SourceForge detractors bring up is that the current codebase is not available; this is an issue to a number of people strongly ideologically aligned with Free software, who want to interact with nothing but Free software. There is a parallel here. Since SF costs nothing, works well, and helps spread and facilitate open source software, there are few pragmatic issues with SourceForge that Savannah solves. Thus, the issues with Open Source that Free advocates have are mostly the same complaints that are raised about SourceForge.
Savannah's main issues are caused by a lack of people working on it, and it is currently less ready-to-go than SourceForge. It's HURD and Linux in a mirror.
Savannah makes its feelings on the importance of Free software very clear with the nongnu and gnu names. The SF people don't particularly place a lot of emphasis on someone being associated with a project or having a particular license -- there's no sourceforge.sortaopen.net for BSD-licensed projects, for instance.
Finally, while this is more germane to this story than to SF in general, the politics in the linked-to story remind me a good deal of the complex and never-ending debates about Free software purity that come up more frequently in the Free Software world.
I suppose that a lot of Free advocates are going to view this as a bit flamish -- I guess it's a bit cutting in that it identifies that Savannah hasn't been operating as well as SourceForge, but I don't feel that it's particularly false or misleading.
I use the GNU utilities as well as Apache every day -- I like both chunks of software.
I also, as people who read my posts frequently know, tend to often feel a bit frusterated with Free advocates. I do, not infrequently, think that Free folks can come off as a bit too rabid to the general public -- this mainly becomes an issue when media, desperate for some kind of figurehead for the open source world, settle on RMS, and he propagates his (intimidating to a CTO) views on intellectual property. I also remember when the Crystal Space team (an excellent LGPLed 3d engine), wanted to be absolutely correct WRT the GPL and valuing Stallman's input, wrote him to ask for a bit of clarification on a licensing detail. Stallman's response, an enlightening read, highlights a good deal of what I consider the difference between Open Source folks like Jorrit and Free folks like Stallman.
May we never see th
I understand your point. I too don't like it when somebody complains about a good or service that is provided free or at below cost.
However, the post to which you are responding may also have a point. The free rider problem and the tragedy of the commons (or, perhaps more precisely, tragedy of the net-commons) are inherent and endemic problems with Open Source software and projects.
Let's face it, Open Source projects are classically Marxist -- i.e., To each according to their needs, from each according to their ability. I'm not saying that to red-bait. On the contrary, I think it is kind of nice.
Which I guess is my way of saying that, given these problems, I'm always surprised when people are surprised when an Open Source or Free Software project is over-burdenend and/or under-supported.
Only Women Bleed (Sex, Sharia remix)
I could be, but who uses slashcode? If you want blogging software you can use Moveabletype or livejournal.com / greatestjournal.com .
Oh? Slashdot a news site? Sorry. Xoops for Mission Critical stuff, Php-nuke, Post Nuke and any derivatives, tikiwiki or some other CMS derivative.
No one cares about Slashcode because no one uses it other than Slashdot.
-Electrawn
There are two reasons this decision is somewhat controversial for those of us maintaining FSF-related projects:
For example, GCC is under constant pressure by RMS to move from its own server (that happens to be hosted at Red Hat) and onto Savannah. But this pressure has been resisted for the same reasons, and it will continue to be resisted regardless of what "packaged development environment" Savannah is using.
With regard to the pair above, (1) the GCC maintainers have never been invited to share their concerns with the Savannah maintainers; when they speak up, they're ignored, and (2) Savannah gets fscked up on a regular basis, and complaints are ignored. For example, Savannah is supposed to be mirroring the GCC CVS repository, but it falls over constantly, leading to even higher load on the GCC servers as users switch over. The Savannah team has a long long way to go if they want to hold themselves up as a reliable open development site.
You cannot apply a technological solution to a sociological problem. (Edwards' Law)
Interesting!
Or, if not a law, maybe an international union of some sort.
How is this different? The ethical issue is that the users of the system should be able to control the system. So, in 1979, you could log in as Stallman and change all of his files if you wanted to. He would disapprove and have to restore his files from backup.
Fast forward to today, and a user of the system changed the system in a way that the administrators disapproved of. They'd have to restore from backup.
Same situation.
It's unfortunate, because the code is insecure as hell.
u e& file=source.php
For instance, 'source.php' lets you view the source of files, but only if 'sys_view_source' (a global) is set in the config.
Of course, they don't check to see HOW it is set, but rather, allow you to pass it on the _GET global, which overrides the config, which, of course, lets you view the source of any file:
Compare:
http://gforge.org/source.php?file=source.php
http://gforge.org/source.php?sys_show_source=tr
Nice, eh?
--
Use Vobbo for Video Blogs
tperdue has the docroot in his home directory:
Insecure!
This would seem to be more a function of how *PHP* on the gforge server is setup. If register_globals is on, this will happen, if register_globals is off, which it is by default in the recent (read at least 1 year or more) stock php tarballs, this would not occur.
Depends. Sometimes you decide that if we don't have the resources to do it, we must *get* the resources to do it.
How important is X to you?
Also, what's the GForge license? It's quite possible that RMS sees nothing wrong with moving to GForge. (I know that GForge is Debian-Free, so it's likely to be GPL. In which case the choice of which site would probably be largely pragmatic.)
I think we've pushed this "anyone can grow up to be president" thing too far.
The PostgreSQL community is also migrating to GForge from GBorg. I'm pretty excited to see the outcome. There are some things I'd like to see in GForge, which can easily happen if enough people take the time to submit patches, such as modular support for revision control systems. Remember GForge is a fork of Sourceforge, maintained by one of the original architects and authors of Sourceforge.
well said.
How was this redundant, when I posted it when there were 3 other comments? And how was it off-topic? Plenty of people thought it was funny...
I smell a new round of moderators shortly. Let's here it for metamoderation...
Please help metamoderate.
SourceForge started in the first place.
Its always been run by the business types; it was never a pure OS/hobbyist site; they always hoped to generate funds by harnessing the good will of the community.
Back in the heyday, advertising was sufficient. Now that reality is harder, they need people like you to fill their coffers.
You can force this into a more secure mode by reading the global variable (from _GET, _POST, etc), unsetting it, and THEN reading the config, which will override the unset global.
There are secure ways to write PHP code, GForce ignores them.
#3 is very important! I can't believe that Slashdotters don't seem to care about this issue. VASoftware is actively selling SourceForge as an "offshoring" tool (not even "outsourcing", but OFFSHORING).
/.ers may not care because of apathy or hypocracy, but there are other alternatives. Given that VA hasn't actually managed to sell much of anything, I don't think they are a threat, but also, as a professional software developer, I don't think "offshoring" is much of a threat, either.
You seem to be very interested in this subject, so I'll respond.
I have always felt that, rather than having a single mass community site, like a master sourceforge or Savannah site, where most projects congregate, it would be much better to have a lot of little "xforge" sites scattered about and that can then be more specialized to the needs of different groups and projects over time; that individual universities, companies, and even individual project maintainers, could easily setup and deploy locally or through common hosting services; and then to have specialized master search or index sites that could locate and aggregate projects easily from remote xforge's...
The problem of the single Sourceforge site or Savannah site is that it is a single point of failure. Many projects will be down if sourceforge or Savannah, for example, are down for extended periods of time. Having smaller project sites will at least mean failures will be far more localized and far less disruptive to the community as a whole.
The problem in the original sourceforge code is that it was impossible to easily customize or deploy, and this remained fairly true even after the heavy hacking done on the Savannah branch. If gforge has finally solved this problem, and makes it relatively easy to deploy xforge-like sites, then I see this as a very promising development indeed.
Hmm.. it's an open source application, so viewing the source lets you do what exactly? Why not just download the whole lot instead?
Combination - fun iPhone puzzling
Turning on register_globals makes for more insecure code across the board. Yes they could have accounted for register_globals being on, but don't blame gforge for being insecure because of a "feature" of php. On a side note, who cares if you can read the source code of an open source project? The code is written in such a way as to not let you out of $_SERVER['DOCUMENT_ROOT'].
Also, I'd point out that GForge is released under the GPL....so if actions count...
Chris DiBona
Co-Editor, Open Sources
Open Source Program Manager, Google, Inc.
The problem as I see it is that if the system lets you set that variable via the query string, who says you can't elevate your permissions the same way...
jason
Have a good day?! Impossible! I'm at work!
That solution could be a bit problematic if e.g. $_GET has a key "_GET" or "GLOBALS" etc. But done right, it sounds like a decent workaround for PHP code that really depends on register_globals. The simplest fix if register_globals isn't needed would be to just die() if register_globals is on, though this would probably cause admins to remove that test if they need register_globals for something else, and then you're back to square one...
In most of my PHP code, I've used a prefix on variable names ("i_") to indicate that the contents are tainted, and only those variables are imported to $GLOBALS from $_GET and $_POST. And even though I warn if register_globals is on, I make sure never to assume that a variable is unset. I guess it all comes down to your overall level of distrust and paranoia. Which I have lots of.
This signature is not in the public domain.
Incredible, it's the same exact example that i found by following the link in the article.a h-hackers/ 2004-04/msg00191.html
http://mail.gnu.org/archive/html/savann
You must be its author!
Of course the ultimate solution to this particular "problem" is to use $_GET, $_POST, or $_REQUEST, instead of relying on register_globals, and in the case of source.php that would be what, a 2 minute fix?
It's also one of the worst examples of web app coding practices I've ever seen. This spaghetti crap-app is a nasty mess of hell. It would have to be open sores software, because no one would pay for code like that.
> what's the GForge license?
GPL.
The Army reading list
Replying to yourself?
That's pretty low, even for an opinionated, short-sighted, bigoted asshold like yourself.
I am sure they have choice comments about administrators restricting your right to access and modify the source of websites you are using.
The thing is... different states have different minimum wages... or do you suggest we go with the lower Federal min. wage? I suppose that would still be a nice chunk of change overseas for certain people.
I've lately partially switched to http://developer.berlios.de/ which
provides SVN and CVS (it's a sf.net spin off). Then http://tigris.org/
is also a valueable alternative (which there are more of) to sourceforge.
In fact tigris.org is where subversion is developed. *hint*
Any developer should at least consider moving to one of the alternative
OSS project and development hosters out there. And believe it or not,
there is more alternatives than just Savannah and sourceforge.
not intializing your variables (especially permissions-related variables) is insecure. It's the fault of the author, not the language.
Since when has the "community" been restricted to citizens of the USA only? In case you missed it, the USA has been siphoning jobs and people away from the rest of the world for DECADES now. But I guess when it is India losing people to the USA everything is fine, hmm?
So you're saying it's morally wrong for people to move out of India if they can make a better living in the US?
Because there are files that contain usernames and passwords, specifically, to the backend databases.
Nobody can trust it again.
Let it go dudes, and let's start afresh with something that's got security built in from the ground floor.
--I'd like to see micropayments. I'm pretty low income but I wouldn't mind doing a micropayment to the various projects/apps I use. I also think that the big distro vendors need to do a micropayment system to every app they include, and that a minimum fee be established for the downloading service. Pays for the brick and mortar expense of the servers and the bandwith etc, with some more going to the micro payments to the app developers. Kind of a place between traditional shareware and "no payment whatsoever even though it costs to distribute" like it is now.
From the gforge faq, on why it doesn't support Mysql (see http://gforge.org/docman/view.php/1/24/faq.html)
"You could do it, but why bother? To quote Tim Perdue - "GForge could not be made to run on the primitive MySQL database without serious hacking, and I won't accept those kinds of changes back into the system. For the amount of work involved in such a project, you'd be better off taking an hour to learn postgres. It's a superior database in every way, with the only point of debate being speed on simple 'hello world' type applications".
It'd be a lot of work because:
1. GForge uses Postgres stored procedures, so you'd have to convert those into PHP functions
2. GForge uses Postgres functions like pg_connect, so you'd have to replace those with the MySQL equivalents
3. GForge uses subselects, so you'd have to rewrite those to use temporary tables or whatever (MySQL 4.1 supports subselects, so once it becomes production-ready, this won't be a barrier anymore)
"
So what they are telling me is that this thing is hard coded around PG specific routines..... That's NOT a good thing, I don't care what they think about Mysql (ditto applies to DB2, SapDB (Now MaxDB), Informix or Sybase).
Someone call me when these guys get a clue.
Bugs Bunny was right.
Ah, now I see what you're saying. The quote clearly distinguishes between the "ethical" and the "practical" points of view. The practicality of the no-password plan was due to the community.
I've read the biography, but I certainly don't know exactly how RMS works. His history seems to indicate that he prefers ethics to practicality most days of the week. That was the thought that inspired my original comment... that he seemed to now accept a violation of his own ethics.
Let's face it, Open Source projects are classically Marxist...
No, they aren't.
Marxism was an 19th-century economic theory. 19th-century economics treated the existence of scarcity as an axiom. Because of this and other reasons, neither it nor classic capitalism can explain what's going on in the open source movement. (Leaving aside Marxism's other glaring weaknesses...)
I could decide to understand quark behavior by bouncing tennis balls against each other, on the theory that all my physics books represent subatomic particles as little colored balls. Is this any less valid than equating Marxism and open source based on superficial similarities?
Libre, Gratis, and Commercial. If there is some person actively managing the software, good for them if they can actively control the development instead of it being an uncontrolled free-for-all. More people will want to use a small, well-built system than one with hundreds of poorly-tested features donated and used by only one developer.
-- Too lazy to get a lower UID.
Go look for yourself. VA is pimping SourceForge off as a tool to help companies ship jobs overseas. They don't even hide the fact.
Another tool that's helping companies "ship jobs overseas" is Linux. gcc is a big help in these endeavors, as well.
Oh, and don't forget about the Internet.
Is this a linux problem or php problem? If it is a linux problem, they should switch to windows. If it is a php problem, switch to java or asp.net.
Only point 2 refers to PG specific routines ...
... and not about recoding functionality they feel should reside in the DB.
... if you really want them to support MySQL then start contributing to MySQL and get 5.0 to release ASAP.
Since they are accepting patches for Oracle it seems they are willing to support other databases as long as it is just about replacing "PG specific routines"
So the solution seems simple
So... how is being able to view the source files of open source projects insecure?
Outsourcing is different from offshoring. Offshoring is specifically moving jobs overseas, those people may still be employees of your company. Outsourcing is contracting a function to another company, however the company you outsource to might be across the street, it needn't be an overseas company.
-----BEGIN PGP SIGNED MESSAGE-----
.org
S OW HOoAlkoACgt4RR
- ----END PGP SIGNATURE-----
Hash: SHA1
Yes, we are currently struggeling at Savannah. We are in need of some
good volunteers who are willing to spend a couple of hours a day
helping us.
Someone with good knowledge of Perl and PHP is welcome. The first
task would be to get the approval of projects working again. That
means, among other things adjusting the current code to make cvsroots.
Rudy Gevaert
rudy @ gnu
Savannah-hacker
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQFAfFrUHlNnY/z8cn0RArUSAKDBAaPH4H1tIgJZmSV
0BvB0sCydF2DYv3+c6oEDv8=
=PKRP
register_globals is a braindead misfeature, especially in a web environment pitched to newbie programmers.
The authors of "Personal Home Page" should just disable this permenantly, fuck legacy apps.
Move along now, there's nothing to see.
I was momentarily interested in GForge but when I saw that it was designed for small projects, then less so. Where are the task-to-release views? Management of releases? The tracker view goes near but so far...Task assignments for testers, developers and approvers? How do you map tasks to code? So close yet so far...if this project could beef up some of it's features, then it could really be a killer app for small and large companies.
h.
Patriotism is a virtue of the vicious
I might take that as a valid comparison if either gcc or the Internet were proprietary products explicitly advertised as being tools for shipping work overseas.
DNA just wants to be free...
"I consistently try to use Open Source technology whenever possible (I fully support the sociology behind the movement)" doesnt she mean ideology, surely?' the first time i ever try to read an article and i am defeated in the first paragraph!
I develop applications which I release under ethical licenses such as the Hacktivismo license which prohibits using the software to violate human rights and the like. The source is open and available and you are free to distribute and modify the source, as with any other open source license.
However I do believe Savannah and Sourceforge required their projects to stick to the Open Source Initiative's definition of "Open Source", which prohibited use restrictions (and therefore condoned human rights violations); so, these sites would not allow software with such ethical licenses, despite the software being otherwise completely "open".
So my question is: are there any other Sourceforge/Savannah-like sites that would allow such projects to be developed using the tools on their sites? How does Gforge fit in to this? Does it require people to use the GNU license or only licenses fitting the Open Source Initiative's strict definition of what makes for "Open Source"?
I dont quite see how that helps if you are dead set on designing your DB access around stored procedures.
The US has been siphoning JOBS? You're saying, that instead of hiring people locally, overseas companies are hiring expensive Americans to do long distance telecommuting!?
I've never heard of such a thing. Links please.
Democrats or Republicans. They are both taking us to the same place and they are not afraid of us anymore.
So? A good many people on /. live outside the US, and no doubt some of them are the beneficiaries of offshoring of jobs.
The files contain usernames and passwords for the backend databases.
w00t! Preach it brother!
Look at non-US companies using Windows, with Intel or AMD processors, maybe using Netware or Solaris servers and HP printers. None of those are locally developed - every one of them represents work being done in the US (and sometimes other countries), thus "siphoning jobs overseas". Call centres move jobs one direction, plenty of things move them in the other - and so far, the US has been on the receiving end of most of those jobs, overall.