News for hackers. Stuff that matters.
Re:Gitlab Critical Security Release by boleary-gl on Saturday February 26, 2022 @02:03PM (#30480668)
Looks like it shipped in 14.8 (4 days ago)

https://docs.gitlab.com/ee/user/admin_area/reporting/spamche...

Re:Gitlab Critical Security Release by jancsika on Saturday February 26, 2022 @06:22PM (#30483124)
Wait a sec... this is from the feature request[1]:

> Just because I don't think I said it explicitly anywhere above: Because we are using an obfuscated, non-free component (the preprocessor), we can't include spamcheck in CE (users of CE expect no proprietary code to be included in the pacakge), but only in EE.

So... is it available in the current version of gitlab-ce or not? I don't want to waste time trying to get it running only to find out you've only made it available for enterprise editions and gitlab.com.

1: https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/6259

Re:Gitlab Critical Security Release by dnsmichi on Sunday February 27, 2022 @05:44AM (#30487072)
Non-free obfuscated code cannot be included in the community edition unfortunately. https://gitlab.com/gitlab-org/gitlab-foss/-/blob/master/LICE... The architecture in https://gitlab.com/gitlab-org/spamcheck#architecture-diagram shows the spam detection, where the ML training models remain obfuscated to not give spammers an advantage.

You can run EE without license, it provides the same features as CE. Maybe that is an option for you: https://docs.gitlab.com/ee/update/package/convert_to_ee.html I've created an MR to help clarify the docs: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/81751

Re:Gitlab Critical Security Release by jancsika on Sunday February 27, 2022 @11:29AM (#30489847)
If I didn't care about the open source license I'd simply use github. (Which, unfortunately, may be the only solution that doesn't continue eating more and more of my time.)

Anyhow, this sounds like a death knell for gitlab-ce. My GSoC use case isn't fringe (there are 100s of GSoC orgs), and Gitlab wouldn't have spent money on the ML approach for EE if it weren't generally important.

Re:Gitlab Critical Security Release by jancsika on Saturday February 26, 2022 @02:10PM (#30480736)
Oh wow, thanks!

I'll have a look.