Hacker Newsnew | past | comments | ask | show | jobs | submit | sarki_247's commentslogin

(GitLab Team member here) You can learn more about the disclosure from GitLab, the security releases made and the recommended actions at https://about.gitlab.com/releases/2024/01/11/critical-securi...


How does the attacker introduce the controlled email as secondary email of the user they want to take over?


Am I missing something or does the security release recommend updating to the latest version without saying what that latest version is (at time of writing)?

Come to think of it, how can you find what version of Gitlab is being run? (through the web interface on a CE instance)


It says it three times in the first three sections.

For example

> Today we are releasing versions 16.7.2, 16.6.4, 16.5.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).


>how can you find what version of Gitlab is being run? (through the web interface on a CE instance)

It's up the top at gitlab.example.com/help


> "It would make sense if they had a "newest only", where if you have one deployment running and 10 pending, by the time the current deployment finishes, gitlab would cancel all deployments except for the latest one. This way you don't have to wait for old deployments, and you're free to do a rollback at any time."

Hi, GitLab Team member here. This is exactly how GitLab functions when you use "newest first" process mode [1] with Prevent outdated deployment jobs enabled [2]. By default, pipeline job retries for deployment rollback is enabled, you can rollback to any of the failed old deployments, except where its disabled. [3]

[1] https://docs.gitlab.com/ee/ci/resource_groups/#process-modes

[2] https://docs.gitlab.com/ee/ci/environments/deployment_safety...

[3] https://docs.gitlab.com/ee/ci/environments/deployment_safety...


Thanks for getting back to me!

That's amazing, I always had this problem in my head about how to solve people stepping on each other's toes with high volume CD workflows.

This should solve it nicely, thanks again!


GitLab team member here. With GitLab Ultimate, users with the guest role do not consume a seat. To learn more, see https://docs.gitlab.com/ee/subscriptions/self_managed/index....


But there's no way to have an actual "developer" role that isn't using non-ultimate seat right?

I get why in some sense, because once you use ultimate you switch to using a EE install instead of the CE. But I think even having the choice between ultimate and normal paid tiers would be great, even if it means no free users on the instance.


Hi, GitLab team member here. We offer the Open Source program for qualifying projects giving them access to top-tier features for free. See https://about.gitlab.com/solutions/open-source/join/


thanks, i wasn't aware of this. that's even more than i was looking for, except, the no commercial activity rule seems a bit limiting:

Not seek profit: An organization can accept donations to sustain its work, but it can’t seek to make a profit by selling services, by charging for enhancements or add-ons, or by other means.

so i can't sell services to sustain the project? there is a large difference between earning some money to help fund the project, making barely enough to be able to work on the project fulltime and actually making enough of a profit to afford commercial services.

if i am employed and work on a FOSS project on work time, then i am not selling any services, nor am i making a profit.

if i do exactly the same but as a contractor, then i am selling a service.

you may want to elaborate how you interpret and verify this rule.

also i'd rather have less free services but a more liberal allowance on commercial activity. like a regular free account but without the user limit.

user limits are very frustrating because they prevent me from managing all potential contributors, even if they are not very active.


Apparently you must be open source and a charity, not just open source.


GitLab team member here! This feature is currently being worked on. You can follow the progress in https://gitlab.com/gitlab-org/gitlab-web-ide/-/issues/72


GitLab team member here. No, it's not. This service will not be replacing our self-hosted versions.


GitLab team member here! User Limits will not apply to a public group as a top namespace and as at this time, no limit on private groups within a public top namespace group. See the 6th Q&A entry in the FAQ page (https://about.gitlab.com/pricing/faq-efficient-free-tier/#us...), excerpt here:

> Q. Do these changes apply to private projects within a top-level namespace with public visibility? A. User limits are currently applied based on the visibility of the top-level namespace. We will monitor how top-level namespaces with public visibility are using private projects to identify whether any limits on such projects are needed.


Great news!!!


Hi, GitLab team member here. Due to a number of factors, which includes high applicant volumes, the talent acquisition team may not be able to provide detailed decline feedback. You can get more details on our handbook page: https://about.gitlab.com/handbook/hiring/interviewing/#rejec...


> it may not be possible for the talent acquisition team to provide detailed decline feedback

That sounds like the exception, but ok, what happens when it is not possible?

Like you know, send a message "Dear candidate, unfortunately the talent acquisiton team did not manage to provide decline feedback because of xxxxxxx[0] , sorry."

Or "nothing"?

And in how many cases does this happen?

Like 1%, 5%, 35% or 99%?

IMHO it would be much simpler to directly write in your handbook something like:

"No decline feedback will be provided. No exceptions."

This way the candidate won't be expecting it.

[0] Examples:

my dog ate the feedback

the feedback was stored in a cabinet that got flooded

the hard disk where the feedback was stored failed before a backup was made


I think the "If people argue with the feedback..." section is more telling. The fact that there's a SOP for this means it happens a lot.


But you already have the detailed decline feedback (it's bullet point #2 [1]). The only effort on your part would be a simple copy-paste.

I have to imagine that something else in the "number of factors" matters much more than "high applicant volumes".

[1]: https://about.gitlab.com/handbook/hiring/interviewing/#rejec... > Everyone who interviews a candidate must complete a scorecard and are required to input pros and cons as well as an overall recommendation.


idk about Gitlab specifically but its a slap on the face after dedicating 6 hours to jumping through hoops just to get ghosted.


There was no ghosting in this case, just a template rejection, two days later.


GitLab team member here, Our pricing model page (https://about.gitlab.com/company/pricing/#annual-pricing-is-...) details our pricing strategy and why we prioritized monthly over annual pricing.


A minor correction above, the last phrase is supposed to read "why we prioritized annual over monthly pricing", as described on the linked GitLab handbook page.


At first look that page is a mess.


GitLab team member here! This implementation will be client-side only, with a selection of extensions allowed. Self-hosted instance admins will be able to enable or create an allow-list of extensions on their instance. You can learn more in this epic: https://gitlab.com/groups/gitlab-org/-/epics/7683


Ahh. So users cannot open terminal on your servers, or run a test?


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: