443
700+ self-hosted Git instances battered in 0-day attacks with no fix imminent
(www.theregister.com)
this post was submitted on 10 Dec 2025
443 points (99.6% liked)
Selfhosted
53656 readers
763 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
-
No low-effort posts. This is subjective and will largely be determined by the community member reports.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
People have open registration on those things... Thats.. Brave...
I have my own gitea instance in my homelab but of course its not accessable from the internet.
Well that kinda kills collaboration
Yeah. If I needed collaboration, I would just whitelist their ips or require everyone involved to use Wireguard vpn, Tailscale or other solutions that allows access without being publically exposed.
That kills collaboration from new people who just, like, discovered your project on some Lemmy thread
They can still collaborate old school way. You can publish static mirrors of git, then take email patches lol
You can git pull a repo to your machine, make your changes and then use git to submit a patch via email. Its not pretty, but it works. Hopefully federation is built soon and you will be able to submit a pull request from your own forge.
I do the same thing. Anything I put on there isn't something that I would share with the Internet anyway. If it was a serious project, sure. It's just nice to have a personal git you can access over a VPN sometimes.
I can't understand why anyone would waste time writing code that won't be shared
Personal projects. Not everything has to be FOSS. My tiny little script to automate my lights turning green and my smart speaker playing All-Star by Smash Mouth at full volume, so I can jork it in peace? That shit doesn’t need to be public.
Home Assistant hs communities to share exactly that
My similar script has a very different goal: at midnight if someone is still up, it dims the family room light and announces on speaker”hey kids, it’s time for bed”
Yes, it needs to be public. The videos too.
Take my money.
For personal use? To automate tasks you do or solve a problem you have?
For personal use. As someone who has all my non-trivial creations, including dot-files and scripts I replicate between machines, in repos since CVS has a thing it’s a habit. Version control. This stuff is mostly private but not secret, why should I have it public?
Edit after spell check.
Dunno, I just don't believe my NixOS config files are particularly valuable. What is the benefit of sharing garbage code from a novice? I'd rather share things worth sharing, that could be useful to someone else.
Don't kink shame, man
I wonder if it'd be feasible to make a fediverse github
Its coming: https://codeberg.org/forgejo-contrib/federation/src/branch/main/FederationRoadmap.md
Git is already a distributed version control system.
But it doesn't have any built-in concept of users, write permissions, or authentication (except for commit signing)
Hosting an unauthenticated git repo would be the equivalent to an open ssh port with no password required
Not to mention collaborative things like issue tracking, PRs, forums, etc
Forgejo has all that, and then you can achieve "federation" by virtue of pushing to whatever remote. I wasn't suggesting people use git itself (which is possible). I just meant that it's distributed as opposed to centralized like Subverison is.
no, forgejo doesnt have "all that". you are totally missing the point. git is federated, of course, but the added features of forgejo or any other known git forge is not (yet).
Forgejo has those, yes.
and where does forgejo support federation for issues, PRs?
Never said it did, and the comment replying to didn't say it did either.
seems right. actually you were just not responding to the questions of anyone in this chain, but always responding with irrelevant things. and thanks for the downvotes! please bring some more.
"never said it did" was a response to where Forgejo supports federation for issues and PRs.
Well but distributed != federated. Which is why Forgejo is currently working on a federation feature.
There was a discussion on Forgejo and ActivityPub IIRC
Edit: this is what you’re looking for: https://forgefed.org/
An interesting similar idea is https://github.com/gitsocial-org/gitsocial
"Decentralized open-source Git-native social network"
I keep mine accessible from the internet, its just more useful to me like that. I do have registration disabled though and SSO is handled by Authentik so it could be worse (my personal goal has just been to not be the easiest target, perfect security is a myth in my mind).
Theres a HUGE difference between hosting it essentially read-only to the world, vs allowing account creation, uploading, and processing unknown files by the server.
I have thought of blocking access to the commit history pages at the reverse proxy to cut off 99% of the traffic from bots. If anyone wants to look at the history, its just a git clone away.
You could also throw it behind mTLS
I could, but then I would have issues getting to it from work; from the bit I've read about mTLS, it's not really indended for my use case, I think I'll just stick with TLS.
My motto is 'Users cause complexities and complexities cause problems'.
It is because it is the default