This service update only applies to people who self-host. Servers managed by gitlab are patched by gitlab staff. If you're going to self-host I think you should at least --consider-- self-hosting something with a tiny attack surface instead of a complicated product with many dependencies and "casual" security practices.
You're in a thread about an update to the self-hosted Gitlab offering. They aren't saying "use this instead of the service", but "if you self-host you can also self-host a simpler thing", so your response really doesn't fit the topic at hand.
Re:Gitlab Critical Security Release
by isbvhodnvemrwvn on Saturday February 26, 2022 @12:50PM
(#30479852)
There is a point where "simpler" is so laughably inadequate when compared to the alternative that dismissing the comment makes sense. You lose code review, integrated CI, and will need quite a lot of time to manage this entire solution anyway.
If you want to make a different argument agains the comment, feel free to do so, but I'm not sure how that's relevant to my comment or the comment I replied to?
I'd love to see the same effort that is going into avoiding managing a service go into contributing better tooling to that service or to the OS package/configuration so it's not 30 minutes of work. I'd love it if it worked more like this: apt install myservice and maybe one or two tweaks/decisions to configure for use. A lot of the issues here are that dynamic language based services (python/ruby/js) don't play nice with OS provided interpreters. This is a problem that really needs to be solved, if we'd like to continue to have nice things.
The tooling is already there. All the "not playing nice" issues are largely solved by using Docker. Installing a local Docker instance of Gitlab is literally four commands. Mkdir three directories and docker run to get it started.
> All the "not playing nice" issues are largely solved by using Docker
Not really. Now any integration has to be done inside the container or with other containers... which adds lots of extra steps. I do agree using Docker makes a simple deployment easier, though.
Re:Gitlab Critical Security Release
by mmsbdjjkvjj on Saturday February 26, 2022 @12:22PM
(#30479592)
In this case though, gitlab is a self hosted product
And sure - self hosting might not be terribly complicated but that's one more thing that now you've got to worry about and keep track of. One more thing that you've got manage and keep up to date. There is a lot of value in convenience, ease of access, and simple scalability.