this post was submitted on 10 Dec 2025
442 points (99.6% liked)

Selfhosted

53636 readers
1234 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

  7. No low-effort posts. This is subjective and will largely be determined by the community member reports.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz
442
700+ self-hosted Git instances battered in 0-day attacks with no fix imminent (www.theregister.com)
submitted 3 days ago* (last edited 3 days ago) by festus@lemmy.ca to c/selfhosted@lemmy.world
87 comments fedilink hide all child comments
 

By 'Git instances' they mean Gogs instances that allow open registration. I know most of the community moved from Gogs to Gitea, and then to Forgejo, but thought this was still worth noting.

top 50 comments
sorted by: hot top controversial new old
[–] bort@sopuli.xyz 114 points 3 days ago (1 children)

Here are the steps:

  • The attacker creates a standard Git repository.
  • They commit a single symbolic link pointing to a sensitive target.
  • Using the PutContents API, they write data to the symlink. The system follows the link and overwrites the target file outside the repository.
  • By overwriting .git/config (specifically the sshCommand), the attacker can force the system to execute arbitrary commands--

amazing.

[–] addie@feddit.uk 28 points 3 days ago (5 children)

Especially since any version of Git from the last view years has a passionate hatred of symlinks for this reason, which is a bit annoying if you've a legit usecase. They're either very out-of-date, or have done some very foolish customisation...

load more comments (5 replies)
[–] 1984@lemmy.today 71 points 3 days ago* (last edited 3 days ago) (8 children)

People have open registration on those things... Thats.. Brave...

I have my own gitea instance in my homelab but of course its not accessable from the internet.

[–] quick_snail@feddit.nl 12 points 3 days ago (11 children)

Well that kinda kills collaboration

[–] 1984@lemmy.today 18 points 3 days ago (1 children)

Yeah. If I needed collaboration, I would just whitelist their ips or require everyone involved to use Wireguard vpn, Tailscale or other solutions that allows access without being publically exposed.

[–] quick_snail@feddit.nl 6 points 3 days ago (1 children)

That kills collaboration from new people who just, like, discovered your project on some Lemmy thread

[–] Natanael@infosec.pub 7 points 3 days ago

They can still collaborate old school way. You can publish static mirrors of git, then take email patches lol

[–] Jason2357@lemmy.ca 2 points 2 days ago

You can git pull a repo to your machine, make your changes and then use git to submit a patch via email. Its not pretty, but it works. Hopefully federation is built soon and you will be able to submit a pull request from your own forge.

load more comments (9 replies)
[–] Lightfire228@pawb.social 8 points 2 days ago (4 children)

I wonder if it'd be feasible to make a fediverse github

[–] JackbyDev@programming.dev 6 points 2 days ago (1 children)

Git is already a distributed version control system.

[–] Lightfire228@pawb.social 2 points 2 days ago* (last edited 2 days ago) (1 children)

But it doesn't have any built-in concept of users, write permissions, or authentication (except for commit signing)

Hosting an unauthenticated git repo would be the equivalent to an open ssh port with no password required

Not to mention collaborative things like issue tracking, PRs, forums, etc

[–] JackbyDev@programming.dev 2 points 2 days ago (2 children)

Forgejo has all that, and then you can achieve "federation" by virtue of pushing to whatever remote. I wasn't suggesting people use git itself (which is possible). I just meant that it's distributed as opposed to centralized like Subverison is.

[–] WhyJiffie@sh.itjust.works 1 points 23 hours ago (1 children)

no, forgejo doesnt have "all that". you are totally missing the point. git is federated, of course, but the added features of forgejo or any other known git forge is not (yet).

[–] JackbyDev@programming.dev 0 points 22 hours ago* (last edited 22 hours ago) (1 children)

concept of users, write permissions, or authentication

collaborative things like issue tracking, PRs, forums, etc

Forgejo has those, yes.

[–] WhyJiffie@sh.itjust.works 0 points 20 hours ago (1 children)

and where does forgejo support federation for issues, PRs?

[–] JackbyDev@programming.dev 0 points 20 hours ago (1 children)

Never said it did, and the comment replying to didn't say it did either.

[–] WhyJiffie@sh.itjust.works 0 points 19 hours ago (1 children)

seems right. actually you were just not responding to the questions of anyone in this chain, but always responding with irrelevant things. and thanks for the downvotes! please bring some more.

[–] JackbyDev@programming.dev 1 points 11 hours ago

"never said it did" was a response to where Forgejo supports federation for issues and PRs.

[–] hikaru755@lemmy.world 5 points 2 days ago

Well but distributed != federated. Which is why Forgejo is currently working on a federation feature.

[–] dariusj18@lemmy.world 1 points 2 days ago

An interesting similar idea is https://github.com/gitsocial-org/gitsocial

"Decentralized open-source Git-native social network"

load more comments (1 replies)
load more comments (6 replies)
[–] scrubbles@poptalk.scrubbles.tech 140 points 3 days ago (2 children)

Good note, and good callout, we should always call out these things.

But yes if you're self hosting and you both have a public facing instance and allow open registration, you are a much much braver person than I.

[–] jeena@piefed.jeena.net 30 points 3 days ago (2 children)

I'm not allowing random people hosting their git repos on mine but it's public and they can fork my own stuff on it in theoretically upload some bullshit.

[–] Jason2357@lemmy.ca 3 points 2 days ago (1 children)

Any time you have a server willing to process random data uploaded from randos, just expect it to be compromised eventually and prepare for the eventuality by isolating it, backing it up religiously, and setting up good monitoring of some sort. Doesnt matter if its a forge, a wiki, or like nextcloud or whatever. It will happen.

[–] Jason2357@lemmy.ca 2 points 2 days ago (1 children)

To anyone afraid of the above conclusion, a dedicated $5 VPS with automatic snapshots get you a long way.

[–] WhyJiffie@sh.itjust.works 1 points 23 hours ago

if the server is compromised, all the data it stores is at risk of getting drleted or modified. so I don't think a VPS really solves the problem.

[–] null@piefed.nullspace.lol 13 points 3 days ago (6 children)

Got curious and lurked your profile. You might want to update your about from Lemmy to PieFed 🙂

load more comments (6 replies)
load more comments (1 replies)
[–] GreenKnight23@lemmy.world 15 points 2 days ago (1 children)

this is what I'm talking about when it comes to the selfhosted communities.

if you don't know how to properly segment and vlan your network, you have no business exposing your shit to the internet.

[–] Jason2357@lemmy.ca 11 points 2 days ago

While good, network security isnt the issue. Its running a web service with open registration allowing randos to upload content that gets processed by the server.

Throw this up on a dedicated $5 VPS and you still have a problem. The default should be manual registration by admins.

[–] Lem453@lemmy.ca 23 points 3 days ago (13 children)

If i remember correctly on my gitea (now forgejo) the default is open registration which really shouldn't be the case for projects that are targeted towards self hosters.

My inital install was a long time ago so I don't remember for sure

[–] Jason2357@lemmy.ca 2 points 2 days ago

This absolutely. Anyone who actually wants open registration will be configuring their own SSO or whatever backend. The default should be safe for testing and/or hobbyists.

[–] JadedBlueEyes@programming.dev 8 points 3 days ago (1 children)

Yeah in my project open registration is behind an option called yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse lol

load more comments (1 replies)
[–] EncryptKeeper@lemmy.world 5 points 3 days ago

Reading between the lines I feel like when you say “Targeted towards self hosters” what you mean is “John Q Hobbyist who doesn’t know any better”

And in response to that I would contend that Gitea is not actually targeted at those folks, though they obviously use it. Gitea is FOSS but it’s still “targeted” at professionals.

load more comments (10 replies)
load more comments
view more: next ›