It is best to keep the dependency on GitHub low and optional.
Using GitHub for issue tracking should be avoided. GitHub’s abuse prevention systems are overzealous, and when accounts or organizations are affected, support responses can take weeks or months. [1]
I have personal experience with this involving one of my GitHub organizations.
Org owner says their GitHub organization was flagged, support ticket opened, no response; later comment says still not unbanned, then later “Unbanned.”
I take your point, though I must confess I wasn’t aware the code was hosted elsewhere like on a mirror, no less. That rather explains why I suggested GitHub Projects in the first place. The only other platform I’m acquainted with that offers anything remotely similar is GitLab, however, that would entail further expense and rather a lot of fluff. Which rather piles on top of the infrastructure already maintained across both the Kicksecure and Whonix projects, I’m afraid. One does try to avoid making more work for oneself.
Personally, I rather think it could be laid out in a more organized fashion n tidied up a bit without getting all bloody OCD about it, mind you. No need to go overboard.
Well as it relates to GitHub and this project, maybe the current Bitchat debacle is another reason to move away from github as a main source and use it as a mirror like other orgs do.
GitHub does allow Tor currently if you have 2FA setup (use keepasxc on desktop) and a ssh key. IMO ever since Microsoft acquired them it hasn’t been the same. Blocking accounts that use private email domains and has domain blacklist. Some might call it a necessary evil like a having a smart phone.
Code is code at the end of the day so code on other git platforms or hosting can still be verified if you can read it.
I personally don’t see a good reason to move off of GitHub and use it as a mirror, as opposed to using other sites as a mirror (like GitLab, which we already do). We use GitHub’s features pretty extensively, since they help us develop better code faster. The worst that could happen if GitHub kicked us as a project off the platform is we’d just pick up where we left off somewhere we already mirror to.
Beyond that, it doesn’t look like GitHub even obeyed the takedown request (or if they did, they reversed it pretty quickly thereafter or implemented it as a geoblock). Bitchat is still available on my end:
We use AI heavily for security review and for general development purposes. While all AI-generated code that runs in trusted contexts is heavily reviewed and often entirely rewritten, our use of AI tools may make our project ineligible for hosting on Codeberg. See:
It’s not guaranteed that we wouldn’t be welcome there, but it’s not guaranteed that we would be. LLMs are an important part of how we get secure code (since the mistakes humans and LLMs make are often different and thus the end-result of a project written with heavy involvement from both humans and AI is often better than the end result of either one working alone), so we will probably continue using them.
Yea I already knew about this policy of Codeberg with which I agree.
But I think they refer mostly to ghost projects, that consume a lots space, energy and server resources (for CI/CD) but the community is extremely small or doesn’t exist. It’s not the case for Kicksecure and Whonix, both have a stable community, maintainers and is actively developed.
If your work fits into these cases, it is unlikely that you are affected at all:
Projects who have an active community that cares about and maintains the software
….
However, we also need to be honest about certain use cases that might no longer be welcome on Codeberg.
Projects where the amount of resources (e.g. storage, CI/CD) is significantly larger than what the involved amount of people could have created by hand
Both projects are well documented by his wikis and have a public AI policy so I don’t think neither Kicksecure nor Whonix couldn’t be hosted or mirrored in Codeberg.
They aren’t vibe coded projects with 2 random users and without community. They don’t have all the developers and maintainers that he would like to have, but it’s a project used by a lot’s of people, mostly whonix, I would say. But Whonix depend on Kicksecure so