Mastodon VS gitlab

Through the Fast Forward program, we give free services and support to open source projects and the nonprofits that support them. We support many of the world’s top programming languages (like Python, Rust, Ruby, and the wonderful Scratch), foundational technologies (cURL, the Linux kernel, Kubernetes, OpenStreetMap), and projects that make the internet better and more fun for everyone (Inkscape, Mastodon, Electronic Frontier Foundation, Terms of Service; Didn’t Read).

Mastodon DMs have absolutely no privacy: https://github.com/mastodon/mastodon/issues/18079

For a decentralized protocol doing things right is much more important than doing things fast, it is very difficult (and in a lot of cases impossible) to break backwards compatibility.

Fixed in Mastodon v4.2.5 https://github.com/mastodon/mastodon/releases/tag/v4.2.5

Mastodon is free and open-source. Go ahead and add the flag:

https://github.com/mastodon/mastodon/blob/main/CONTRIBUTING....

Thank you for your write-up, I ran into similar issues a couple of months back.

Another gripe with the technical implementation of mastodon is the CORS headers required to access the ActivityPub API [0].

Because of this issue, an activitypub-aware frontend for mastodon has to have its own mastodon server running, which adds a whole bunch of hurdles.

[0]:https://github.com/mastodon/mastodon/issues/10400

Mastodon - Open Source Alternative to Twitter

If you're looking for YouTube alternatives, you might be interested in PeerTube. PeerTube is to YouTube what Mastodon is to Twitter. (Plus PeerTube and Mastodon use the same federation technology. You can follow PeerTube accounts from inside Mastodon and vice versa.)

The goal was also to have it look exactly like the audio-player that mastodon uses.

Mathstodon ( https://mathstodon.xyz/about ) integrates this, forking/extending Mastodon to support inline LaTeX in Mastodon posts and equations, which get rendered by MathJax on the client side. I think that's neat.

- "This is important, since several math-based instances exist (such as https://mathstodon.xyz ,https://types.pl) and produce math-based posts. However, when these posts federate to other instances they cannot be rendered, since other instances do not have MathJAX installed. Thus, a more portable version based on open standards is necessary."

https://github.com/mastodon/mastodon/issues/19806

(Side note: Issues are usually hash-prefixed like #1234 both on GitLab and GitHub. However, commit messages must not begin with a hash, they would be considered a comment and ignored. Therefore, GitHub has introduced the alternative prefix GH- and I've contributed a similar prefix GL- to GitLab a while ago.)

and its "oh, you want multi-arch, do you?" friend. While prosecuting this <https://gitlab.com/gitlab-org/gitlab/-/issues/339567> I learned that https://hub.docker.com/layers/multiarch/qemu-user-static/7.2... actually mutates the binfmt_misc in buildx's context in order to exec the static copy of qemu in it https://github.com/multiarch/qemu-user-static/blob/v7.2.0-1/...

and, that the buildx plugin itself has some qemu magick in it, which got addressed in a minor version bump but I couldn't track down the relevant GitHub issue this second (I've flushed it from my mind, only recalling that there were a lot of actors in that tire fire)

For folks who wanna see what led to this exploit in a Rails codebase, here’s the commit where the exploit is fixed:

https://gitlab.com/gitlab-org/gitlab/-/commit/c571840ba2f0e9...

> "RecoverableByAnyEmail"

Added 8 months ago [1]. And then one month later:

> "password_reset_any_verified_email"

Was removed. 7 months ago [2], *note* __verified__ word here.

No blaming or conspiracy intended in this post, just listing links to relevant commits.

1 - https://gitlab.com/gitlab-org/gitlab/-/commit/94069d38c9cd63...

2 - https://gitlab.com/gitlab-org/gitlab/-/commit/a935d28f3decf8...

This doesn't look like the actual fix but rather a follow-up refactor. I believe the fix is here: https://gitlab.com/gitlab-org/gitlab/-/commit/abe79e4ec43798...

    - recoverable.send_reset_password_instructions(to: email) if recoverable&.persisted?

This is actually a follow-up refactor, the fix is here: https://gitlab.com/gitlab-org/gitlab/-/commit/abe79e4ec43798...

This made me curious. Having never read the gitlab code before, and on mobile, took all of about 30 seconds to find https://gitlab.com/gitlab-org/gitlab/-/blob/master/config/ro...

Those are some pretty clean routes!

If you want to know why GitLab decided to replace ArgoCD with Flux, you can refer to this issue: https://gitlab.com/gitlab-org/gitlab/-/issues/357947.

> ruby has just RubyMine which doesn't have a community edition and also isn't very good

I have a great deal of sympathy for RubyMine (and shudder at working for the CLion team, whew) because Ruby isn't doing the IDE author any favors. Given:

https://gitlab.com/gitlab-org/gitlab/-/blob/v16.5.0-ee/lib/g...

- what types are client_email and private_key? they are whatever type they're called with lolol

- the symbol Google::Auth::ServiceAccountCredentials just materializes; was it required in some containing context and thus is in scope by _this_ required file? are those symbols visible in every context from one of the various Gemfile lines? a hard-core rubyist knows

- where did the symbol StringIO come from? well, from require 'stringio' obviously, which is on .. err, which line exactly? I guess that lends weight to the 'this file is obviously running as a child context of some other file' theory

I think half of it is the culture of Rubyists and half of it is "productivity hacks" of "if it runs, then it must be correct"

I also recognize that I'm very clearly a static typing snob, and firmly in the camp of "please import symbols you use," but that doesn't stop me from having a great deal of sympathy for anyone who has to implement an IDE for such a monkey-patch friendly language