Investigating GitLab [LWN.net]

Investigating GitLab

Posted Dec 8, 2018 16:11 UTC (Sat) by marcH (subscriber, #57642)
In reply to: Investigating GitLab by farnz
Parent article: Investigating GitLab

Email identity is distributed but it's not "managed" or "proven", that's why spam for instance exists.

For actual distributed identity management look at OpenID, Oauth2, LaunchPad, Facebook connect, late Persona, etc. already in use in some places like github, openstack etc.

to post comments

Investigating GitLab

Posted Dec 9, 2018 5:34 UTC (Sun) by daniels (subscriber, #16193) [Link] (1 responses)

Exactly - freedesktop.org's GitLab instance offers GitHub, Google, gitlab.com, and Twitter, for external identity provision. One of the benefits of using these services is that they have much better spam prevention than we could ever offer.

You can also register locally using email verification, which does at least have a higher bar to preventing spam sign-ups than an external OAuth hook. So far for us, it's been fairly easy to spot and blacklist individual domains which have been used for spam accounts. I don't think the same would be true of decentralised HTTP-based identity systems.

Investigating GitLab

Posted Dec 10, 2018 8:49 UTC (Mon) by diconico07 (guest, #117416) [Link]

Those authentication method are good, but still creates an account on every instance, so you then have to comply GDPR for storing those account related information.

Thinking over this again, it also brings another issue (not really for the authentication part though):
Using a centralized system also brings the need to maintain it, and to host it, with enough horsepower to handle everyone.
Moreover, you need to carefully choose your provider if you want to be available from everywhere (see https://about.gitlab.com/2018/07/19/gcp-move-update/ for what I mean by this)