If there was malicious code in a legitimate project hosted on #codeberg, would we remove access to it, including for security researchers?

Short: No!

We are considering how to prevent fetching malicious code by accident, though.

In any case, we are open to collaborating with security researchers. Interested? Help us build a malware hunting team: https://codeberg.org/Codeberg/Contributing/issues/44

Background: #GitHub locked access to source code of xz, which was background of active investigation from the community.

[Team] Malware hunting

### About the team This is an idea in case someone is interested to get involved with this topic. Codeberg is abused for spreading malware, like many other places. It is certainly interesting, because a lot of malware we see is either new.

^Codeberg.org

„GitHub Disables The XZ Repository Following Today's Malicious Disclosure“

#xz #GitHub #security

https://www.phoronix.com/news/GitHub-Disables-XZ-Repo

GitHub Disables The XZ Repository Following Today's Malicious Disclosure

Today's disclosure of XZ upstream release packages containing malicious code to compromise remote SSH access has certainly been an Easter weekend surprise..

^{www.phoronix.com}

Discord is a cancer, bruh.

Someone asked a question on #Github Discussions and someone else closed the discussion saying "(...) Questions can be asked through Discord 👍🏻".

For the love of god, stop using #Discord as a forum. The questions are undiscoverable.

So we are being sent to a #Cloudflare site to get coached on #privacy. #W3C only demonstrates need for being schooled on privacy themselves.

Anyone behind a #PrivacyMatters #EthicalWeb advocacy only demonstrates #hypocrisy or ignorance by simultaneously using a Cloudflare site that is configured to block the Tor community.

You get bonus hypocrisy points for telling privacy proponents to “get involved” by using MS #github.

@tag @jyasskin

"Starting on August 24th, we will no longer support the anonymous creation of rooms on meet.jit.si, and will require the use of an account (we will be supporting #Google, #GitHub and #Facebook for starters but may modify the list later on)."

https://jitsi.org/blog/authentication-on-meet-jit-si

Authentication on meet.jit.si

What’s going on? Starting on August 24th, we will no longer support the anonymous creation of rooms on meet.jit.si, and will require the use of an account (we will be supporting Google, GitHub and Facebook […]

^{Emil Ivov (Jitsi)}

Several years in the making, GitLab is now very actively implementing #ActivityPub! 🙌

https://gitlab.com/groups/gitlab-org/-/epics/11247

The end-goal is to support AP for merge requests (aka pull requests), meaning git.alice.dev can send a merge request to gitlab.com/Bob/project.git

First bite-sized todo on the implementation path there is ‘subscribe to project releases’.

Smart move by #GitLab; through ActivityPub they’re getting a distributed version of GitHub’s social layer.

@fediversenews #fediverse #GitHub #git

Support ActivityPub for merge requests (&11247) · Epics · GitLab.org · GitLab

Gitlab/ActivityPub Design Documents by @oelmekki The goal of those documents is...

^GitLab

Give Up #GitHub: The Time Has Come!

Specifically, we at Software Freedom Conservancy have been actively communicating with #Microsoft and their GitHub subsidiary about our concerns with “Copilot” since they first launched it almost exactly a year ago. Our initial video chat call (in July 2021) with Microsoft and GitHub representatives resulted in several questions which they said they could not answer at that time, but would “answer soon”. After six months of no response, Bradley published his essay, If Software is My #Copilot, Who Programmed My Software? — which raised these questions publicly. Still, GitHub did not answer our #questions.