Pain points in Git's patch flow

[Konstantin Ryabitsev]

On Mon, Apr 19, 2021 at 07:54:37AM +0200, Sebastian Schuberth wrote:
> > of these proposed alternatives involve moving away from something that's
> > a distributed system today (E-Mail infrastructure, local clients), to
> > what's essentially some website run by a centralized entity, in some
> > cases proprietary.
> 
> That's a good point, I admit I haven't thought of that. Probably
> because I also don't care much. So *does* it really matter? What
> exactly concerns you about a "centralized entity"? Is it the technical
> aspect of a single point of failure, or the political / social aspect
> of being dependent on someone you do not want to get influenced by? I
> guess it's a bit of both.

It's all of the above, and really should not be discounted. Let's take what
Russian government is doing lately as an example. In its effort to control
social dissent, Russian censorship organization RosKomNadzor (RKN) has taken
steps to deliberately break internet operation -- in a very ham-fisted way.
Just a month ago they tried to "slow down" Twitter by blocking DNS queries for
any domains containing the substring "t.co" -- which, hey, broke
gihubusercontent.com among many other sites. There's every reason to believe
that this won't be the only time they do something idiotic like that, so as a
result it is increasingly difficult for Russian contributors to justify
participating in projects that are hosted on GitHub -- one day they may not be
able to reach it reliably (or at all).

(If you think the answer to that would be "just use a VPN", it's one of those
recommendations that are easy to make for someone not worried about their ISP
reporting "sketchy encrypted traffic" to "the authorities.")

Patches sent via email remain immune to this. Even if vger falls over, it's
merely a list service -- there are alternative ways of transmitting RFC2822
messages that don't involve a central host (such as via a NNTP gateway,
publishing a public-inbox "feed", etc). Email remains one of the few protocols
that are designed ground-up to be decentralized and I'm afraid that we are
again finding ourselves in a world where this is increasingly relevant.

> While these concerns could probably be addressed somewhat e.g. by
> multiple independently operated Gerrit servers that are kept in sync,
> I was curious and quickly search for more fitting "truly
> decentralized" solutions, and came across radicle [1]. Just FYI.

I know Radicle folks -- I was on their technical board. A lot of what they
have implemented is very similar to my initial thoughts expressed in
https://people.kernel.org/monsieuricon/patches-carved-into-developer-sigchains

I have high hopes for the project, but it's not ready to take on the world
until they implement code collaboration aspects (issue tracking, change
requests, etc). It's going to be tough and I really hope they succeed.

-K