Radicle: Peer-to-Peer Collaboration with Git | Hacker News Reader

Radicle: Peer-to-Peer Collaboration with Git

lwn.net

94 pointschmaynard10 comments

I like the idea of a distributed issues/PR tracking platform, but I am skeptical about this one. I would have expected something simpler, that leverages the existing paradigm of push/pull remotes (and then building an optional live-sync daemon on top of that). Radicle appears to be built on the concept of a single global network, completely without any location-based addressing.

I'm also suspicious about moderation. Even with tools to blacklist peers, it seems like this design is vulnerable to "hostile takeovers" where a repo is forked but the new maintainers don't change the repo's did, instead just get more nodes to follow them than the original.

where a repo is forked but the new maintainers don't change the repo's did

A DID is a public key. If you don't know the corresponding private key you won't be able to make any updates. All you'll be able to do is mirror it.

instead just get more nodes to follow them than the original

This is like saying "but I can fork Verisign's Root CA certificate and get more nodes to follow me than Verisign!". No, you don't have the private key that goes with that root certificate. So everybody will ignore you.

Cryptography is not a popularity contest.

Thanks for the reply. I see that "repository delegates" is a git-versioned list of public keys corresponding to approved maintainers. So it looks like a fork taking over an abandoned repository would have to use a slightly modified URL to access [0] (until the original maintainer comes back and adds the new maintainer to the delegates list, then the new maintainer can merge the repositories). My confusion (your so-called "popularity contest") came because I read how the "canonical branch" is determined based on consensus of signatures, and I didn't realize that only the pre-approved keys could contribute those signatures.

So, anyone can make commits and seeds will accept the commits from anyone, but the "canonical branch" will only update (on a given seed) if it's signed by repository delegates. The "next strictest" level of control is private repositories, which simply means that Radicle will only send its commits to a peer in the repository's allow list.

My next big moderation-related question is what redaction looks like. Obviously an unwilling peer would diverge from the signature chain at this point, but does Radicle provide any tools for, say, permanently redacting an issue comment? It's obviously possible (but painful!) to do this in regular git for commits.

[0] https://radicle.xyz/guides/protocol#git-url-scheme

I love this! Unfortunately I missed the previous discussion. Looking forward to catching up in this.

Link: https://radicle.xyz/

Previous HN discussion: https://news.ycombinator.com/item?id=39600810

That top comment has some points I'd like to see addressed by the maintainers:

https://lwn.net/Articles/967157/

Update: A reply has been added since posting this.

Note that if you just want to provide a issue tracker within Git rather than relying on centralized web services like Github or Gitlab, there is

https://github.com/MichaelMure/git-bug

https://github.com/dspinellis/git-issue

https://sciit.gitlab.io/sciit/ (this one has a list of alternatives here https://sciit.gitlab.io/sciit/#other-distributed-issue-track...)

Overall it's very disappointing that Github didn't decide to embed issue tracking (and also PR discussions) inside the repository (in another branch perhaps). Issue discussion is part of documentation IMO, and not distributing it alongside the repository causes lock-in

Unfortunately github appears to be actively breaking the ability to use git-bug on repositories with large numbers of pull requests (like nixpkgs):

https://github.com/MichaelMure/git-bug/issues/749#issuecomme...

They really don't want you to leave their walled garden.

its a shame this sounds so monolithic. we really need integrated issues, identity and discussions but no one will run a gossip protocol and p2p stuff on their machine to replace servers.

I liked the description, but do we really need blockchain bs for that?

Git by itself is decentralized, and peer-to-peer technologies existed long before too.

According to the article:

> Radicle does not use any blockchain or cryptocurrency technology.

Which is also my experience from playing around with it recently.

> Git by itself is decentralized

This is true, but people very rarely lean into that. I personally run my own cgit for all of my public repositories, and I have collaborated with people who run their own git servers by managing multiple remotes - fetching from their remote and pushing to mine to share. I've also collaborated on projects that use email-based workflows. This works really well, but it also requires us to have the infrastructure to do that. Radicle reduces that infrastructure requirement to running a daemon on your desktop (as is common with p2p technologies).

Reply on news.ycombinator.com