Radicle: peer-to-peer collaboration with Git
Radicle: peer-to-peer collaboration with Git
Posted Mar 29, 2024 14:26 UTC (Fri) by atnot (guest, #124910)Parent article: Radicle: peer-to-peer collaboration with Git
Immutability of data: Having an everlasting, unchangable, signed database anyone can write to is rarely actually desirable. Among other things like dire consequences for pasting the wrong thing from your clipboard, it opens up endless vectors of abuse and harassment. That immutability might seem a lot less nice when someone starts posting pictures of your front door or CSAM and other illegal imagery to your issue tracker when you merge something they don't like. People do also change things like names for a variety of reasons and usually really appreciate those names not lingering in old issues forever or having to nag hundreds of repo maintainers to change them. That's not to say that none of these issues can't be narrowly fixed individually, but that the real world is usually far more mutable than this type of model allows.
Git security: Git has had a relatively constant stream of security issues that allow compromising local machines with malicious git archives. Usually this isn't a huge issue, because the people who can commit to repos are relatively trusted and/or the repo contains executable code anyway. But when everyone is constantly pushing and pull from git repos just for issue tracking, that becomes a lot more risky.
Data size: Similarly to the other two issues, one might imagine a situation where two users get into an endless offtopic argument, or some jokester posts the entire bee movie script or a uuencoded version of the shrek movie as a comment. Even non-maliciously, one might want to show a screenshot of some buggy behavior, or upload some long logs. This is now part of the eternal record, so it must be downloaded forever by everyone who wants to look at your issue tracker now and into the future. Lore.kernel.org rotates git archives regularly for this reason, but that's only possible because it's just an achive of emails sent and not the entire current and historic state of a working issue tracker.
Moderation: again, see everything above. Having this floating cloud of contributor nodes without seemingly any mechanism for proper moderation is just negligent and a non-starter for public collaboration. This might work in a scenario where everyone is trusted in the first place, but in that case there's really not any need for this rigmarole in the first place. And if fully public collaboration is out of scope, it's not a fit to replace any of the centralized services.
Given the existence of a cryptocurrency token behind this, I suspect the solution to this is supposed to be tokenized aligned incentives whatever. I'll just nip that in the bud and say that cryptocurrencies have all of these issues even by themselves and paying in some wildly fluctuating crypto token to open a bug report instead of just, say, sending an email will not sound appealing to anyone who isn't current hungry to dump said token on someone else.