423
700+ self-hosted Git instances battered in 0-day attacks with no fix imminent
(www.theregister.com)
this post was submitted on 10 Dec 2025
423 points (99.5% liked)
Selfhosted
53582 readers
886 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
-
No low-effort posts. This is subjective and will largely be determined by the community member reports.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
If i remember correctly on my gitea (now forgejo) the default is open registration which really shouldn't be the case for projects that are targeted towards self hosters.
My inital install was a long time ago so I don't remember for sure
Reading between the lines I feel like when you say “Targeted towards self hosters” what you mean is “John Q Hobbyist who doesn’t know any better”
And in response to that I would contend that Gitea is not actually targeted at those folks, though they obviously use it. Gitea is FOSS but it’s still “targeted” at professionals.
Yeah in my project open registration is behind an option called
yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuselolHonestly, this is always more effective than a comment in the config because it can get removed. All it would take is a popular guide having the config with that option on and the comment gone.
I'm a current gitea user.. should I be moving to forgejo?
Yes, even without this current news.
https://forgejo.org/compare-to-gitea/
Thanks! I'll add it to the todo list.
I just did it not long a ago. Gittea -> Forgejo10 -> Forgejo11 LTS, in Docker. Surprisingly quick, painless and smooth.
(My only issue was not Forgejo, but MySQL. Because the hardware is ancient and Docker compose pulled down a new version of mysql8 at the same time as pulling forgejo. New version of mysql8 didnt support my CPU architecture. Easy fix was to change the label mysql8oraclelinux7 in Docker compose and pull that image. There is a issue with solutions in the MySQL Docker GitHub repo)
Doesn't Forgejo support SQLite as a backend?
To be honest I don't remember why I set up gitea with MySQL instead of sqlite (or MariaDB), its quite a few years ago. And sqlite would probably be fine for my single-user instance
Yes, although MySQL/MariaDB or PostgreSQL are the more robust options.
If MySQL is more robust than SQLite of all things, something is going seriously wrong.
Then again, it's 2025. I no longer bet on what to expect from reality. Next someone points me to a mail indicating linux kernel will move its bookkeeping to MongoDB.
Depends how they define robust. MySQL has a myriad of features SLQite doesn't have and won't ever have. If they mean something like user configuration then SQLite is just out by default.
(Coming from a SQLite fan.)
Doesn't seem like Gitea has that issue, and just keep registrations disabled if possible and if your projects allow, avoid symlinking.