Running arbitrary code on a distributed network of end user PCs with network access is a recipe for a bot net. Yes it’s doable but it’s not a magic wand to claim that an open platform will solve it.

The magic of Travis was that with a couple clicks of OAuth you were signed up and running builds for your own PRs. My first thought upon seeing this years ago was “How many people are using this to mine crypto?!“.

> My first thought upon seeing this years ago was “How many people are using this to mine crypto?!“.

Having worked at a Travis CI competitor that also offered open-source credits. The answer is "many" if you don't do anything about it...

What is the state of the art in doing something about this? Has anyone tried using CPU perf counters to see if the workload looks like hashing?

Indeed, that is why Travis said they were changing the way they handled open source, because people were using it to mine crypto. They just weren't clear that the "change" was basically "not anymore providing free services to open source".

> Running arbitrary code on a distributed network of end user PCs

It's a bit more complicated than that.

I run gitlab and gitlab runners for a living, I can tell.

First thing first, you'd have to register a runner with a specific project. So no "arbitrary code".

Second thing, unless you can push a branch to the project main repository, no pipeline is ran. So for your own personal forks you'd either rely on gitlab.com-provided free minutes or you run your own runner (and tbh, it's fairly easy).

Last thing: you should not think of regular end-users. Think of middle to advanced users, that have a home server or something like that (homelabbers?).

> First thing first, you'd have to register a runner with a specific project. So no "arbitrary code".

This isn't what "arbitrary code" means.

> The magic of Travis was that with a couple clicks of OAuth you were signed up and running builds for your own PRs.

With GitHub Actions it's even simpler, and no OAuth required at all.

I especially like the auto-suggested template-types based on what kind of project the repo hosts (Node, Python, etc).

Saw the note about GitLab (I work there) and thought I'd chime in.

For those who don't know, we have a GitLab for Open Source program which gives our top tiers and 50K CI minutes/month for free to OSS projects: https://about.gitlab.com/solutions/open-source/

Hope this helps!

Thanks for chiming in! I like gitlab so much I couldn't miss this opportunity to recommend it.

The nice thing about Gitlab is that you can mix on-prem and saas according to your need.

For example I am now running my own gitlab instance at home but I'm thinking of switching to the gitlab.com offering while keeping runners at home. By pairing gitlab with Hashicorp Vault I could keep encrypted stuff in my repo and decrypt them when they are checked out on the (local on-prem) runner.

Super cool, so much flexibility!