Critical Gitlab vulnerability let attackers take over accounts
I actually recently moved over to using self-hosted Gitea, Nexus and Drone CI to cover most of the use cases that i needed GitLab for: <a href="https://blog.kronis.dev/articles/goodbye-gitlab-hello-gitea-nexus-and-drone" rel="nofollow">https://blog.kronis.dev/articles/goodbye-gitlab-hello-gitea-...</a><p>GitLab is actually pretty good: the UI is nice, the feature set is pretty complete and GitLab CI is still one of the best CI solutions that i've used and probably a noticeable step up from Jenkins, or at least the Jenkins instances that i've seen, but self-hosting it and keeping it up to date certainly takes a bit of care, especially if you ever want to have it be publicly available.<p>That's not to say that Gitea or any other piece of software couldn't have similar vulnerabilities, but rather that GitLab is a pretty large and complex piece of software that's also moving ahead rapidly, so situations like this are inevitable (also things like the EXIF vulnerability a while back <a href="https://gitlab.com/gitlab-org/gitlab/-/issues/327121" rel="nofollow">https://gitlab.com/gitlab-org/gitlab/-/issues/327121</a>). Perhaps even something as simple as basicauth in front of it can be helpful for cases like this (or just making things available only through a VPN, though that's likely to be too limiting in some cases, e.g. non-enterprise settings).<p>Edit: Actually, here's a question for the lovely people here: suppose that you want to self-host a platform with a web UI for working more easily with Git repos, something like GitHub, GitLab or other platforms like that, to collaborate on a project with some friends and/or like-minded strangers. What do you, a single person with a VPS and a bit of spare time pick for the most successful outcome? Or is the only viable advice nowadays: "Don't. Just use the cloud."?