Whonix source code in self-hosted git

[Patrick]

@grass

there is no organization of threads except the type: Development

Saw Bug Reports, Software Development and Feature Requests chapter Forum Tags in Whonix wiki? Forum tags… But maybe also not very usable, unsuitable, messy.

On the other hand, when there was phabricator, there’s always been lower activity there and then duplication in forums vs phabricator. So the ideal issue tracking which would imo be a forum with easily usable tags/components would be best but that doesn’t seem to exist.

@grass

I think that if the forum implements a good tracking of
issues, merge requests per repository, then maybe git server with
“issues” functionality is not necessary?

I don’t know any forum that can really provide a unified experience for all of that.

@grass

Could try that, but can’t attach a patch to the forum right?

In theory could just dump the patch’s plaintext into code tags. That however might fail in case there’s any binary data (lets say an icon, image, etc.).

@grass

one thread is one topic, meaning that every new patch is a new topic

Yeah. That what was I had in mind. Just the patch. No discussion. Discussion happening in other forum threads. But that might spam lots of forum threads.

@grass

With a big
enough patch, dumping everything makes it hard to review?

A git patch can express multiple commits.

But, yeah… Only if a separate forum thread per patch. And then in the main discussion just link to it.

The more I think about it, the posting patches directly to the forums should probably stay the exceptional cases. If used a lot, might quickly trash the forums. And if patches are posted elsewhere (such as on paste websites) and only links to patches posted in forums that might be marginally better. But then paste websites expire. Then web archiving these would be required. Getting more and more messy.

@grass

no dependency on third-parties servers rules and logging

At time of writing, Whonix server - just as any other server for any other project - is also “hosted in the cloud” at a root server (or VPS server) provider. The server provider could also do logging without my consent and/or knowledge. Related:
Placing Trust in Whonix ™ chapter Self-Hosting vs Third Party Hosting in Whonix wiki
So all of the perfection, a lot of the advantages of no logs for example by self-hosting discourse and not using the hosted version by discourse cloud might actually go out of the window due to the server provider at least in principle having the power to log.

That’s might be why why Qubes concluded it’s not worth to even try to optimize for self-hosting:

• Frequently asked questions (FAQ) | Qubes OS
• Frequently asked questions (FAQ) | Qubes OS

@Mycobee

This is not reality. Where is it going to be hosted? My house? No the internet is not good enough here

A cloud provider? Thats a third party.

Indeed. Hence written about that here:
Placing Trust in Whonix ™ chapter Self-Hosting vs Third Party Hosting in Whonix wiki

@Mycobee

• potential reputational loss if a hack occurs. I am not a terrible sysadmin by any means, but I am a human and much more specialized on infra automation as my day job. Security is something I have learned a good bit, but could still spend a lifetime and not know it all. I could make a mistake, a hack would be embarrassing to the project.

How much effort is worth spending on a "perfect webserver for whonix.org"?

Another great point I wish I had in mind when writing above bullet points. Self-hosting doesn’t have good incentive structures. If all goes well, it’s invisible effort. If it gets hacked, it’s probably resulting in FUD (related: Placing Trust in Whonix ™ chapter Server Security in Whonix wiki) and ridicule. If using third-party hosting such as github and github gets hacked, then it’s just a third party that got hacked and the reputation of the project that was using github remains stainless. …