Slashdot Mirror
FSF Migrating From Savannah to Gforge
bluestrain writes "It's been almost 4 months since Savannah was hacked. The site is still not completely functional, no new projects have been accepted since December 2003. Now it seems that the FSF is abandoning Savannah in favor of Gforge. RMS himself has
confirmed the plans. A few developers are questioning the change. Hopefully the dust will settle and savannah can start accepting projects again."
...already. Savannah moving over is certainly a big one, though.
Stuff like this is why we're continuing to optimize GForge's SQL...
The Army reading list
If you just need a good (and free) public CVS server, what other options are there besides sf and gforge?
Do you even lift?
These aren't the 'roids you're looking for.
Seems like Stallman has lost sight of his roots!
Anyone know if they can get subversion support in their as long as they are going through the effort to switch? I'd really like to see a free OSS hosting solution using all the latest and greatest tools. That and I'm not to sure about trusting the future of SourceForge, given VA's seemingly complete retraction from the open source community.
-- Fighting mediocrity one bad post at a time.
Gforge may be great for high traffic sites like Savanaah, but for low traffic 1-10 project sites I use Xoops+MyXoopsForge or Novell Forge. I think Savanahh made a good choice here, but they are stuck once they port. Novell Forge is the other choice.
GForge uses some highly optimized transaction stuff and database functions inside postgres that probably should be in the PHP layer.
Reminds me to port MyXoopsForge to postnuke to take advantage of ADODB! Compatibility or speed?
-Electrawn
Go look for yourself. VA is pimping SourceForge off as a tool to help companies ship jobs overseas. They don't even hide the fact.
Have a look for yourself: VA Software
1) Savannah is insecure.
2) GForce is nice.
3) VA advertises SourceForge as a tool to help companies ship jobs overseas. Go look at their website for yourself if you don't believe it. They're not even bashful about it. I'm not surprised people are leaving it in droves, if not for sucking, but for the fact they're (the developers) are getting dicked as well.
What's so wrong with using the techinical tools for outsourcing. If you don't like this trend, I understand you. But the best way to fight IMHO is to promote a law that requires paying the US (or watever country's corporation is outsourcing) minimal wages to the workers in India, Russia, etc. This will not allow them (us) compete only on price.
The very next words I quoted said, "according to Richard Stallman". Well, I guess you see that as him throwing his hands up in the air and giving up. You don't know Stallman very well, do you? If you recognized the way RMS works, you'd know that on religious differences like this, he is very pedantic and doesn't stop.
I mean, read the following made up quote to realize that I'm right: "The decision to move to MS IIS was made by Bradley Kuhn and the system adminitrators, according to Richard Stallman. They considered Apache could not be made secure enough."
Sure, this comparison isn't exactly valid because GForge is GPL'd and Apache is way more secure than IIS, but Richard "St. Ignucius" Stallman's brain is not wired like most people's, and believe me, he has veto power on all religious issues.
Many of the previous savannah contributors have already moved to gna.org, which is sometimes referred to as savannah's successor.
I have already moved all my projects to gna a month ago. Gna is way more stable and way faster than savannah. I love it.
IIRC, back in the day (during the boom), SourceForge was released under the GPL. After the bust, they changed the license of the SF software to proprietary, and tried to sell it to the highest bidder.
I think that Savannah was forked from the GPL-based Sourceforge...
Doh!
I could be, but who uses slashcode? If you want blogging software you can use Moveabletype or livejournal.com / greatestjournal.com .
Oh? Slashdot a news site? Sorry. Xoops for Mission Critical stuff, Php-nuke, Post Nuke and any derivatives, tikiwiki or some other CMS derivative.
No one cares about Slashcode because no one uses it other than Slashdot.
-Electrawn
There are two reasons this decision is somewhat controversial for those of us maintaining FSF-related projects:
For example, GCC is under constant pressure by RMS to move from its own server (that happens to be hosted at Red Hat) and onto Savannah. But this pressure has been resisted for the same reasons, and it will continue to be resisted regardless of what "packaged development environment" Savannah is using.
With regard to the pair above, (1) the GCC maintainers have never been invited to share their concerns with the Savannah maintainers; when they speak up, they're ignored, and (2) Savannah gets fscked up on a regular basis, and complaints are ignored. For example, Savannah is supposed to be mirroring the GCC CVS repository, but it falls over constantly, leading to even higher load on the GCC servers as users switch over. The Savannah team has a long long way to go if they want to hold themselves up as a reliable open development site.
You cannot apply a technological solution to a sociological problem. (Edwards' Law)
It's unfortunate, because the code is insecure as hell.
u e& file=source.php
For instance, 'source.php' lets you view the source of files, but only if 'sys_view_source' (a global) is set in the config.
Of course, they don't check to see HOW it is set, but rather, allow you to pass it on the _GET global, which overrides the config, which, of course, lets you view the source of any file:
Compare:
http://gforge.org/source.php?file=source.php
http://gforge.org/source.php?sys_show_source=tr
Nice, eh?
--
Use Vobbo for Video Blogs
tperdue has the docroot in his home directory:
Insecure!
The PostgreSQL community is also migrating to GForge from GBorg. I'm pretty excited to see the outcome. There are some things I'd like to see in GForge, which can easily happen if enough people take the time to submit patches, such as modular support for revision control systems. Remember GForge is a fork of Sourceforge, maintained by one of the original architects and authors of Sourceforge.
You can force this into a more secure mode by reading the global variable (from _GET, _POST, etc), unsetting it, and THEN reading the config, which will override the unset global.
There are secure ways to write PHP code, GForce ignores them.
VA Software may be a for profit company, but SourceForge still "provid[es] free hosting to tens of thousands of projects." If that isn't sufficient to create a free rider problem and a bandwidth tragedy of the commons, nothing would.
And while VA Software may have "reaped millions from their IPO," one may wonder where all of that money is now.
Only Women Bleed (Sex, Sharia remix)
Only point 2 refers to PG specific routines ...
... and not about recoding functionality they feel should reside in the DB.
... if you really want them to support MySQL then start contributing to MySQL and get 5.0 to release ASAP.
Since they are accepting patches for Oracle it seems they are willing to support other databases as long as it is just about replacing "PG specific routines"
So the solution seems simple