2013-09-24 22:23:34 d33tah is there any way I could help Nmap transistion to Git? it kind of feels inevitable.
2013-09-24 22:24:03 d33tah fixing one's own ones is something impossible to avoid
2013-09-24 22:24:31 yyzfp1 The biggest obstacle to me is having some way to do access control for whetever is the main repository.
2013-09-24 22:24:46 d33tah well, need some scripts?
2013-09-24 22:24:57 d33tah or research?
2013-09-24 22:25:04 yyzfp1 Right now, you define an svn-authz file, which is nice because you can easily create virtual users with commit access, and control what they may commit to.
2013-09-24 22:25:13 yyzfp1 I'm sure there is something similar for git, but I haven't done the research.
2013-09-24 22:25:22 d33tah on git, IIRC, you give users the shell accounts
2013-09-24 22:25:23 yyzfp1 Research I think is needed.
2013-09-24 22:25:34 d33tah they've got git-shell as their shell
2013-09-24 22:25:39 yyzfp1 It should be something that doesn't require actual Unix accounts for each committer.
2013-09-24 22:25:43 d33tah and you need to configure SSH to cut away stuff like tunneling
2013-09-24 22:26:01 yyzfp1 Or if that's not possible, instructions for running in an isolated sandbox separate from what else may be running.
2013-09-24 22:26:01 bonsaiviking yyzfp1 gitosis is a decent solution
2013-09-24 22:26:24 d33tah okay, I could play with that and let you know.
2013-09-24 22:26:25 bonsaiviking each user provides you a public ssh key
2013-09-24 22:26:29 yyzfp1 Yeah, so if you have some recommendataions or you see what has worked well in the past, that might be helpful.
2013-09-24 22:26:36 d33tah hm
2013-09-24 22:26:49 d33tah Daniel just said some. makes me think that perhaps we could use a nmap-dev topic
2013-09-24 22:26:51 bonsaiviking access is over ssh, but it's locked and you can't run shell commands. And there's only 1 user (gitosis) on the server
2013-09-24 22:26:59 d33tah IIRC Henri also liked the idea
2013-09-24 22:27:27 bonsaiviking otherwise github has decent access control, as far as I can tell from metasploit
2013-09-24 22:27:49 bonsaiviking but I know you (yyzfp1) are opposed to github because of maintaining an external account
2013-09-24 22:27:52 d33tah but you lose control over the server then.
2013-09-24 22:28:19 bonsaiviking d33tah: with git, the server is just another copy of the repo. Everyone has the full copy with full commit history
2013-09-24 22:28:28 yyzfp1 Well, I don't want particularly want to be a github sure, but that's not an ovverriding concern.
2013-09-24 22:28:31 bonsaiviking So what's authoritative is whatever copy you like best.
2013-09-24 22:28:45 yyzfp1 I think fyodor is worried about github becoming the next sourceforge (me too).
2013-09-24 22:28:59 d33tah you mean not alive anymore?
2013-09-24 22:29:01 bonsaiviking If, e.g. fyodor decided github's copy was bad, he could start over with his own copy.
2013-09-24 22:29:39 bonsaiviking since the id of each change is a sha-1 hash, you get some integrity control, too.
2013-09-24 22:30:07 d33tah and you get svn for free on github, still i'm anxious about external hosting as well.
2013-09-24 22:30:14 bonsaiviking yyzfp1: which aspects of sourceforge do you fear in github?
2013-09-24 22:32:29 yyzfp1 I think we can agree that sourceforge's glory days are behind it.
2013-09-24 22:32:35 d33tah 22:28:59       d33tah $ you mean not alive anymore?
2013-09-24 22:32:36 bonsaiviking absolutely.
2013-09-24 22:32:37 d33tah so I guessed ;)
2013-09-24 22:32:51 d33tah and google code's never happened xP
2013-09-24 22:33:07 yyzfp1 There's a danger of it becoming old and crufty and unmaintained, actually the bigger danger is perhaps that the operators' intereests no longer align with those of the deleopers that use it.
2013-09-24 22:33:39 yyzfp1 Not that I think the sky is falling or anything.
2013-09-24 22:33:58 yyzfp1 I don't think the risk is that high, or that the cost of moving away would be too great if it happened.
2013-09-24 22:33:58 d33tah hm, perhaps it's a good idea to start a nmap-dev thread so the rest could throw some ideas as well?
2013-09-24 22:34:15 bonsaiviking true. I think the flexibility with git means that you can just pull up stakes and move if you don't like your host any more.
2013-09-24 22:34:27 bonsaiviking biggest complaint I've heard from metasploit devs is that the bugtracker isn't fully-featured. So they run an external bugtracker (redmine)
2013-09-24 22:34:31 yyzfp1 But speaking generally, it is a bit spooky that github has become a big single point of failure for many free software projects, and it's not free osftware itself.
2013-09-24 22:35:06 d33tah well, git adds a bit of redundancy here.
2013-09-24 22:35:32 yyzfp1 It's true, but search Twitter for "github down" and see what havoc it causes when it happens.
2013-09-24 22:35:52 d33tah i personally don't like posting releases and main websites there, that's for sure.
2013-09-24 22:36:18 d33tah markdown readme as the homepage sucks and i won't say how badly because i'm trying not to curse anymore :P
2013-09-24 22:36:45 d33tah but as the git repository, I personally like it. though self-hosting definitely has its own upsides.
2013-09-24 22:37:32 d33tah so, mind if I'll throw the idea to the general public?
2013-09-24 22:37:39 yyzfp1 Go ahead.
2013-09-24 22:37:48 yyzfp1 I think you will also have to do some evangelism with fyodor.
2013-09-24 22:38:09 d33tah okay. I was thinking of summarizing the discussion that took place here as well, but it'd take some time
2013-09-24 22:38:13 d33tah I could as well attach the IRC log
2013-09-24 22:38:27 d33tah okay, I could try evangelising The Boss. :)
2013-09-24 22:39:02 d33tah btw, I was thinking if I'd ask you before/instead asking Fyodor...
2013-09-24 22:39:20 d33tah could I get a VPS close to nmap.org so I could play with stuff like websvn?
2013-09-24 22:39:45 d33tah i tried to host it on my box but it's dead slow
2013-09-24 22:40:16 yyzfp1 I dunno, you could try to get a linode in the same datacenter.
2013-09-24 22:40:57 d33tah what do you think about the idea?
2013-09-24 22:41:35 yyzfp1 I think you're better off making a deep git clone of the nmap svn repo, and running a gitweb instance locally.
2013-09-24 22:41:52 d33tah the step one here is "buy a new HDD".
2013-09-24 22:42:15 d33tah anyway, the point is to make it public
2013-09-24 22:42:28 d33tah so it's more easily browsable/linkable in mailing list talks
2013-09-24 22:42:43 yyzfp1 You can, to a certain degree.
2013-09-24 22:43:02 d33tah i understand it should run as an anonymous SVN user
2013-09-24 22:43:18 yyzfp1 https://svn.nmap.org/nmap/CHANGELOG
2013-09-24 22:43:25 yyzfp1 https://svn.nmap.org/nmap/CHANGELOG?p=20000
2013-09-24 22:43:33 d33tah and i'd prefer to be separated from Nmap infrastructure so I could play without worrying about breaking stuff
2013-09-24 22:43:41 yyzfp1 But it's not nice because it doesn't show you commit diffs and such.
2013-09-24 22:43:46 d33tah yeah.
2013-09-24 22:43:55 d33tah github solves it a bit, but it doesn't speak r31337.
2013-09-24 22:44:12 yyzfp1 There is a command for that.
2013-09-24 22:44:13 d33tah (damnit, sophron, why did you take the number? :<)
2013-09-24 22:44:26 d33tah i know, but you can't link a command over nmap-dev :P
2013-09-24 22:44:45 yyzfp1 git svn find-rev r32384
2013-09-24 22:45:00 d33tah not applicable on github.
2013-09-24 22:45:02 yyzfp1 Right, and I think our local commit digests are different.
2013-09-24 22:45:27 d33tah i personally did git log and there was some @r31337 stuff
2013-09-24 22:45:46 d33tah commit f968c9122e766d9565b22b5922ce9f9e11aaef1d
2013-09-24 22:45:46 d33tah Author: d33tah <d33tah@e0a8ed71-7df4-0310-8962-fdc924857419>
2013-09-24 22:45:46 d33tah Date:   Wed Sep 18 18:24:07 2013 +0000
2013-09-24 22:45:46 d33tah     Apply my color-input.diff patch I published here:
2013-09-24 22:45:46 d33tah     http://seclists.org/nmap-dev/2013/q3/586
2013-09-24 22:45:46 d33tah
2013-09-24 22:45:46 d33tah     git-svn-id: https://svn.nmap.org/nmap-exp/d33tah/ncat-colors@32357 e0a8ed71-7df4-0310-8962-fdc924857419