GitLab nonfree JS code

[Richard Stallman]

[I sent this message a few weeks ago but did not get a response.
I think this issue is very important.  We should stop praising GitLab
if it has done this]


[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

I've read that GitLab now requires nonfree software both to make an
account (recaptcha) and to do various operations once you have an
account.  I'm told that gitlab.torproject.org makes it impossible to
communicate with the developers from the free world.

Thos needs to be tested, but assuming it is true, we need to downgrade
our evaluation of GitLab ASAP.  For our evaluation to be incorrect in
such an important way is an embarrassment as well as steering people
wrong.

I suggest making an announcement about GitLab's change for the worse.
The announcement could also say that GitHub is no better tham it was.

It would be nice to evaluate another site, if there is one that is better.


Date: Wed, 10 Feb 2021 09:00:22 +0000
From: BTD Master <btdmaster@disroot.org>
To: rms@gnu.org
Subject: Re: Gitlab
Message-ID: <20210210090022.3ee08659@disroot.org>
In-Reply-To: <E1l9i8e-0001LK-8k@fencepost.gnu.org>
Content-Type: text/plain; charset=US-ASCII

> Whose is that web site?  Is it run by gitlab?  Is it run by the Tor
> Project?
It is run by the Tor Project, using GitLab's open source Community
Edition self-hosted by them. Hence the https://torproject.org root in
https://gitlab.torproject.org.
> What job does the site do?  Is it the source repo for the Tor Project?
> If so, is it the PRINCIPAL source repo for the Tor Project?
It is the principal source code repo for the Tor Project, but there are
read-only mirrors of git commits. However, these are nearly pointless
for reporting bugs or contributing; they only have the source code. Both
https://github.com/torproject/tor
and https://gitweb.torproject.org/tor.git/ suggest making contributions
and creating issues on https://gitlab.torproject.org; although to some
extent I can maybe understand why making a contribution or creating an
issue would require running some client-side JavaScript (and even this
is not always necessary, see https://sr.ht or even better
https://try.gitea.io), reading what issues others created requiring
this is simply unacceptable in any project supposed to be accessible.
> Does that JS code carry a free license?  Does LibreJS accept it?
I do not use LibreJS personally, however I think the source code of all
of GitLab Community Edition is available under MIT. This means that
non-premium GitLab users running the open source core CE are running
free JavaScript, even though this is not mentioned per-file as I think
LibreJS requires. This is good, but does not solve any of the
accessibility issues I presented above.
> Is this true for _all_ Gitlab repos now?  Or does each project
> have a choice?
The GitLab devs have confirmed this is intended. Self-hosted instance or
not, doing anything on GitLab requires JavaScript and this will
probably not change as issues are being closed regardless of scope
(e.g. simply being able to read a specific issue from a direct link) as
duplicates.
>   > I guess very few people
>   > have the hardware restrictions to consider running leaner options
>   > (server-side and client-side) such as Gitea or will complain the
>   > Codeberg does not have the CI/CD necessary,  
> 
> I can't make any sense of that -- it depends on a lot of background
> knowledge and I know none of it.
> 

There are other options, but it seems that everyone is complaining
about the development experience on other platforms rather than anything
else. For example, someone on Hacker News (I can't cite this, I forgot
where this was; here's something mostly unrelated I found instead
https://news.ycombinator.com/item?id=24363397) has praised GitLab for
their CI/CD as rivaling that of GitHub; hence, self-hosting Gitea
(https://gitea.io) or using a public Gitea instance (personal favorite
is Codeberg, https://codeberg.org) is impossible due to these
requirements. I understand the requirements of a large project, and
maybe this is justified when GitHub is centralised and someone wants to
have the ability to self-host, but what I am most annoyed is when
someone uses those features to justify this argument when they're not
actually using the same features.
Either way, I am really annoyed by the direction the Web is going, and
I find it really sad that commercial open source seems to be happy with
that direction (for the most part).





-- 
Dr Richard Stallman
Chief GNUisance of the GNU Project (https://gnu.org)
Founder, Free Software Foundation (https://fsf.org)
Internet Hall-of-Famer (https://internethalloffame.org)