#cgit
LightNews LightNews
nube.verse.averagedood.xyz.ap.brid.gy
Aventuras tontas: Nube git.

Una pequeña instancia de cgit, para mi uso local, ¿por qué? pos, a veces para mirar commits y así en repos locales, me da flojera, so, me pareció buena idea hacer esto anoche, fue fácil de instalar y demás, solo compilar […]

[Original post on verse.averagedood.xyz]
Una instancia de Cgit: Nube Git, en la captura puede verse el repositorio git de mi blog, sus commits y así.
September 30, 2026 at 1:45 PM
hrbrmstr.mastodon.social.ap.brid.gy
It is stupid amazing what you can do with cgit with a teeny bit of C (and python – ugh – mostly for the syntax higlighting plugin) source hacking.

yep. this is a cgit interface complete with light/dark mode support, "modern" "forge-like" layouts/ops and […]

[Original post on mastodon.social]
A screenshot of a dark-themed webpage titled "hrbrmstr's Forge." At the top are navigation links for "index" and "about," followed by a search bar with a "Sort by default" dropdown. The main content displays a list of software repositories organized into three categories: "golang," "mirrors," and "personal." Under the "golang" category are go-weatherflow and typesafe-sdk-go. Under "mirrors" are data-centers, doer-fuel-prices, and pathwren. Under "personal" are brew-sploits and censys-cli-skills. Each repository entry includes a brief description of the project, the owner "hrbrmstr," the time since the last update, and three navigation links: "summary," "log," and "tree." A screenshot of a dark-themed code repository page for a project called "Goja — JA4 / JA4T fingerprint monitor" within "hrbrmstr's Forge." The top section shows navigation breadcrumbs, a branch selector set to "main," and repository statistics: 1 commit, 1 branch, and 0 tags. Below this is a commit bar showing the user "hrbrmstr" with the commit message "chore: initial commit" from 18 hours ago. A file browser list shows the repository contents, including folders for "deploy," "src/goja," and "tests," and files such as ".gitignore," "README.md," "goja-monitor.py," and "pyproject.toml." Each file entry lists its permissions, size, and links for "log," "stats," and "plain." The bottom half of the page displays the README.md file. The text explains that Goja uses eBPF/XDP to monitor network interfaces and fingerprint TLS clients, recording combinations of source IP, JA4, and JA4T into an SQLite database. It specifies that JA4T is captured from the TCP SYN packet and JA4 is captured from the ClientHello. At the very bottom, there is a "How it works" section featuring a technical flow chart that begins with a box labeled "ClientHello segments" pointing down to a box labeled "XDP."
September 30, 2026 at 1:39 AM
vikanezrimaya.xyz
Also how are all GNU/FSF websites unreachable *again*? One of the most famous software advocacy groups has a worse uptime than my personal cgit instance. Despite both running free software- ah, wait, my Linux kernel probably includes non-free firmware and so they'll think it's tainted~
September 28, 2026 at 11:17 AM
hrbrmstr.mastodon.social.ap.brid.gy
looks like I am def on track to win the AI-bot cgit scraping whack-a-mole battle (a.k.a., the "clone wars").

Truly this was my crawl of duty.
This image contains two bar charts under the title "**Status of the /git/* wars**," tracking the number of requests over a period from September 14 to September 28. Both charts use the same Y-axis scale, ranging from 0 to 25,000+ requests. ### Chart 1: Slipped Through Bot/Legit Humans This chart shows requests that were not blocked by bots or were made by legitimate humans. * **Trend:** There is a significant peak around September 18, followed by another rise peaking around September 25. * **Daily Values:** * **Sep 14:** ~7,800 * **Sep 15:** ~7,200 * **Sep 16:** ~10,000 * **Sep 17:** ~20,000 * **Sep 18:** ~26,000 (Peak) * **Sep 19:** ~20,000 * **Sep 20:** ~11,000 * **Sep 21:** ~13,500 * **Sep 22:** ~16,000 * **Sep 23:** ~15,500 * **Sep 24:** ~19,000 * **Sep 25:** ~21,000 * **Sep 26:** ~17,500 * **Sep 27:** ~7,500 * **Sep 28:** ~3,500 ### Chart 2: Server Forced Abort This chart shows requests that were forcibly aborted by the server. * **Trend:** For the first several days, there were almost no forced aborts. A massive surge occurred between September 25 and September 27. * **Daily Values:** * **Sep 14–19:** Negligible / Near 0 * **Sep 20:** ~500 * **Sep 21:** ~500 * **Sep 22:** ~800 * **Sep 23:** ~500 * **Sep 24:** ~500 * **Sep 25:** ~2,000 * **Sep 26:** ~22,000 (Peak) * **Sep 27:** ~14,500 * **Sep 28:** ~3,800
September 28, 2026 at 10:47 AM
hrbrmstr.mastodon.social.ap.brid.gy
mid-day check on the [c]git crawler mitigations suggest the config is def working.

Update config in alt txt.
An image containing two side-by-side bar charts under the main heading "Status of the /git/* wars." Both charts share an X-axis showing dates from September 14 to September 28 and a Y-axis representing the number of requests, scaled from 0 to 25,000+. **Left Chart: "Slipped Through Bot/Legit Humans"** This chart shows a high volume of requests throughout the period with significant fluctuations. * Requests start around 8,000 on Sep 14. * There is a sharp increase starting Sep 16, reaching a peak of approximately 26,000 requests on September 18. * Numbers dip and then rise again, with another peak of around 21,000 on September 25, before dropping sharply to around 4,000 on September 27. **Right Chart: "Server Forced Abort"** This chart shows almost zero activity for the first ten days. * From Sep 14 to Sep 23, the bars are nearly flat at the baseline. * A sharp upward trend begins on September 24 (around 2,000 requests). * It spikes dramatically to a peak of approximately 23,000 requests on September 26. * It drops to around 12,000 requests on September 27. Caddy config snippet. # --- /git: cgit proxy + crawler blocks --- handle /git/* { @rotator_egress client_ip 47.82.48.0/21 47.82.14.0/23 47.82.12.0/23 47.82.8.0/23 47.79.8.0/21 47.79.48.0/21 85.137.96.0/20 152.163.164.0/22 104.164.250.0/23 104.252.0.0/16 104.253.0.0/16 189.81.4.0/23 189.81.70.0/23 94.228.16.0/20 94.228.24.0/21 38.237.240.0/24 38.237.241.0/24 38.237.242.0/24 38.237.243.0/24 87.232.152.0/21 94.228.22.0/24 94.228.27.0/24 94.228.28.0/24 87.232.159.0/24 172.252.0.0/16 40.223.0.0/16 142.252.0.0/16 192.177.0.0/16 2a03:cfc0:8000:2d::/48 172.121.0.0/16 87.232.144.0/20 45.112.0.0/16 104.164.101.0/24 104.164.118.0/24 104.165.187.0/24 43.163.64.0/18 43.134.0.0/18 43.128.64.0/18 43.156.128.0/18 43.134.64.0/18 43.156.0.0/18 129.226.128.0/18 43.135.0.0/18 81.70.192.0/18 43.143.192.0/18 101.43.128.0/18 101.42.0.0/18 43.138.0.0/18 152.136.128.0/18 82.156.128.0/18 140.143.192.0/18 116.204.0.0/18 116.204.64.0/18 113.44.64.0/18 1.92.192.0/18 121.37.64.0/18 abort @rotator_egress # distributed fetch fleet, spike 2026-09-24 (4,445 req / 4,335 IPs) @fetchfleet_ua header_regexp fetchfleet User-Agent `^Mozilla/5\.0 \(Macintosh; Intel Mac OS X 10_15_7\) AppleWebKit/537\.36 \(KHTML, like Gecko\) Chrome/142\.0\.0\.0 Safari/537\.36$` abort @fetchfleet_ua @ai_crawler header_regexp User-Agent (?i)(gptbot|chatgpt-user|oai-searchbot|claudebot|claude-web|bytespider|perplexitybot|amazonbot|petalbot|mj12bot|reflectionbot|sofyabot|applebot|exasearchbot|aionbot) abort @ai_crawler defender drop { ranges aliyun openai } rate_limit { zone git_burst { key {http.request.remote.host} window 1h events 60 ipv4_prefix 24 ipv6_prefix 64 } } reverse_proxy 127.0.0.1:8191 }
September 27, 2026 at 4:52 PM
cyfar.ca
~Cisa~
Double-free in lwIP 2.0.1–2.2.1 may enable crashes, DoS, memory corruption, or code execution.
-
IOCs: cgit[.]git[.]savannah[.]gnu[.]org
-
#CVE-2026-91018 #ICS #ThreatIntel
lwIP Double-Free
www.cisa.gov
September 22, 2026 at 4:09 PM
aeriavelocity.dev
I am *begging* people to get off of GitHub *if you can*
Go to Codeberg
Host your own GitLab or Forgejo or cgit or whatever instance
GitHub has just become so slop-encrusted that it's genuinely started to annoy me that so many things depend on it
September 22, 2026 at 2:47 PM
hrbrmstr.mastodon.social.ap.brid.gy
The cgit code is super well organized and maintained, so I just finished up from some work I started over the weekend to add dynamic OG tag generation to cgit web views.

Need to now make it an optional feature in the Makefile and see if the maintainers are up for an old-school PR.
A screenshot of a web application titled "OpenGraph Tags Renderer". An input field labeled "Enter full URL*" contains the link "https://rud.is/git/gists.git/". Below the input is a preview card showing how the page would appear as a social media link. The card features a header "Git repository browser", a dark central graphic with "gists.git" in large cyan text, "hrbrmstr" and "hrbrmstr's gists" in smaller white text, and a footer with "rud.is" and the date "2026-09-21". Below the graphic, the card displays a title "hrbrmstr/gists.git - summary" and a description "hrbrmstr's gists"
September 21, 2026 at 1:12 PM
hrbrmstr.mastodon.social.ap.brid.gy
dang.

i just did one toot about the atom feeds my self-hosted cgit expose (and also sub'd to them in inoreader), and Amazon (who I 429 blocked to the direct cgit paths) saw it (somehow) and started the daily slamming again.

my bad for being too precise w/429

temp fix in place

*cracks […]
Original post on mastodon.social
mastodon.social
September 19, 2026 at 6:50 PM
mhatta.org
The agents are coming for the web and the web isn’t ready.
The agents are coming for the web and the web isn’t ready.
How Varnish and ESI can cache git.kernel.org's commit pages once instead of 922 times — cutting AI crawler load and speeding up cgit by 20x.
info.varnish-software.com
September 17, 2026 at 12:30 PM
crawler.baldanders.info
＞ USN-8757-1: cgit vulnerability
https://ubuntu.com/security/notices/USN-8757-1
USN-8757-1: cgit vulnerability
It was discovered that cgit incorrectly handled repository paths when HTTP cloning was enabled. A remote attacker could possibly use this issue to access files outside the repository and obtain sensitive information.
ubuntu.com
September 14, 2026 at 9:40 PM
hrbrmstr.mastodon.social.ap.brid.gy
Speaking of AI cgit crawlers and whack-a-mole, ran some #duckdb over the logs and pplx, claude, and others took some turns too. Added them to the blocker config for the git dirs.
Dark-themed table of daily web request counts by user agent, Aug 22 through Sep 14. Columns cover GPT, ChatGPT, OAI-Srch, Claude, ClaudeUser, ByteSpider, Perplexity, Amazon, Petal, Google, Baidu, Sogou, Yandex, Dotbot, Meta, Cohere, You, MJ12, DataForSEO, Serpstat, other bots, and human traffic. Nearly every cell is a dash or a single digit, with a few large bursts: GPT hits 119,301 on Sep 5 and 62,282 on Sep 6; Claude hits 116,889 on Sep 7, 132,491 on Sep 8, and 101,612 on Sep 9; Perplexity hits 10,523 on Sep 10, 28,702 on Sep 11, and 5,051 on Sep 12. Human requests stay between roughly 150 and 1,900 per day the entire time, several orders of magnitude below the crawler spikes.
September 14, 2026 at 8:49 PM
hrbrmstr.mastodon.social.ap.brid.gy
Rly cool innovation happening for cgit in the wake the the massive git crawlers killing the linux kernel cgit site as well as many, many others.

I still think preventing the various training org from getting the git contents to begin with wld be better, but whack-a-mole gets tiresome after a […]
Original post on mastodon.social
mastodon.social
September 14, 2026 at 8:22 PM
hrbrmstr.mastodon.social.ap.brid.gy
TIL cgit web has per-repo atom feeds.

e.g. https://rud[.]is/git/gists.git/atom/ is a feed of all commits to main for that repo. can target other branches.

need to write this up (it's been "a thing" since 2008).
September 14, 2026 at 4:21 PM
samtherapy.net
My personal cgit server keeps getting bombarded by scrapers but now they're all just pretending to be browsers, they now come from all sorts of ASNs that when I look up a batch of 25 I get 24 unique ASNs
No, there's no scraping problem whatsoever stop asking
September 13, 2026 at 5:46 PM
sam.froth.zone.ap.brid.gy
My personal cgit server keeps getting bombarded by scrapers but now they're all just pretending to be browsers, they now come from all sorts of ASNs that when I look up a batch of 25 I get 24 unique ASNs
No, there's no scraping problem whatsoever stop asking
September 13, 2026 at 5:44 PM
libremelon.com
I now understand QtQuick's QRhi scenegraph better now compared to a week ago.....

Thanks to code.qt.io/cgit/qt/qtde...

Next up for Plankton I'll try to load up a static image and then eventually our first web page 🫡
A desktop screenshot showing C++ code in VS Code alongside a window titled "Plankton Browser" rendering a vibrant, color-interpolated RGB triangle using Qt Scene Graph.
September 9, 2026 at 6:31 PM
daudix.one
My website's source code finally has a real home!

tangled.org/daudix.one/d...

Codeberg didn't want me to see due to size limits, GitHub steals yo shiz, and selfhosted Forgejo is as useful as cgit. Tangled hits a sweet spot where I'm in control of my data, while retaining collaborative features.
daudix.one/daudix.one
Personal website powered by Zola and Ametrine.
tangled.org
September 8, 2026 at 10:15 PM
forum.artixlinux.org.web.brid.gy
Re: ublock-origin and chromium, the begining of the end ?
Quote from: athov on Today at 19:35:42 > I only use brave and will use brave origin when it comes out. > brave-origin is already available via AUR : wget https://aur.archlinux.org/cgit/aur.git/snapshot/brave-origin-bin.tar.gz tar...
forum.artixlinux.org
September 8, 2026 at 8:09 PM
hrbrmstr.mastodon.social.ap.brid.gy
Prior to me starting to self-host web-vies of git repos again, my primary domain saw ~10-40 hits/day for things probing "/git".

Since Sept 5th, 74.7.227.155 (GPTBot/1.4) — confirmed in OpenAI IP ranges — has slung (and is not stopping) 176,858 GETs to the […]

[Original post on mastodon.social]
Line chart titled "Hourly Requests to /git/*" with the note "I enabled the first cgit repo on ~Sept 5th." Hourly request volume stays flat near zero from Aug 21 through early Sept 5, then spikes sharply to roughly 7,000–7,500 requests per hour. Traffic holds at that elevated level with minor fluctuations through Sept 6, before dropping steeply to about 4,200 at the end of the plotted data.
September 6, 2026 at 8:36 AM
eli.sc
cgit doesn't seem to respect .mailmap, may be about time to look into something else
September 5, 2026 at 3:22 PM
joyeecheung.bsky.social
There was a bit of a shock for me when navigating in the GCC codebase and the git blame annotation in my editor said the code was as old as myself.

GCC commit
gcc.gnu.org/cgit/gcc/com...
Making sure you're not a bot!
gcc.gnu.org
September 5, 2026 at 2:29 PM
fack.bsky.social
this genuinely answers the "why are they enumerating every single web rendered file on every single branch of the Linux kernel cgit instance" conundrum raised by that blog post the other day.
September 4, 2026 at 4:58 PM
hrbrmstr.mastodon.social.ap.brid.gy
I had forgotten how much i loathe cgit, but since the options for hosted git repos are, essentially, gone thanks to fascists and performative outrage, the only way to do it is one's self and I refuse to use the FOSS projects joining hands with the outrage performers.
September 4, 2026 at 4:54 PM
falls.foryou.fast
sorry im busy reinventing cgit and constellation rn but reinventing keepass after is gonna go crazy
September 3, 2026 at 7:41 PM