I like the idea of a distributed issues/PR tracking platform, but I am skeptical about this one. I would have expected something simpler, that leverages the existing paradigm of push/pull remotes (and then building an optional live-sync daemon on top of that). Radicle appears to be built on the concept of a single global network, completely without any location-based addressing.
I'm also suspicious about moderation. Even with tools to blacklist peers, it seems like this design is vulnerable to "hostile takeovers" where a repo is forked but the new maintainers don't change the repo's did, instead just get more nodes to follow them than the original.
where a repo is forked but the new maintainers don't change the repo's did
A DID is a public key. If you don't know the corresponding private key you won't be able to make any updates. All you'll be able to do is mirror it.
instead just get more nodes to follow them than the original
This is like saying "but I can fork Verisign's Root CA certificate and get more nodes to follow me than Verisign!". No, you don't have the private key that goes with that root certificate. So everybody will ignore you.
Thanks for the reply. I see that "repository delegates" is a git-versioned list of public keys corresponding to approved maintainers. So it looks like a fork taking over an abandoned repository would have to use a slightly modified URL to access [0] (until the original maintainer comes back and adds the new maintainer to the delegates list, then the new maintainer can merge the repositories). My confusion (your so-called "popularity contest") came because I read how the "canonical branch" is determined based on consensus of signatures, and I didn't realize that only the pre-approved keys could contribute those signatures.
So, anyone can make commits and seeds will accept the commits from anyone, but the "canonical branch" will only update (on a given seed) if it's signed by repository delegates. The "next strictest" level of control is private repositories, which simply means that Radicle will only send its commits to a peer in the repository's allow list.
My next big moderation-related question is what redaction looks like. Obviously an unwilling peer would diverge from the signature chain at this point, but does Radicle provide any tools for, say, permanently redacting an issue comment? It's obviously possible (but painful!) to do this in regular git for commits.
Overall it's very disappointing that Github didn't decide to embed issue tracking (and also PR discussions) inside the repository (in another branch perhaps). Issue discussion is part of documentation IMO, and not distributing it alongside the repository causes lock-in
its a shame this sounds so monolithic. we really need integrated issues, identity and discussions but no one will run a gossip protocol and p2p stuff on their machine to replace servers.
> Radicle does not use any blockchain or cryptocurrency technology.
Which is also my experience from playing around with it recently.
> Git by itself is decentralized
This is true, but people very rarely lean into that. I personally run my own cgit for all of my public repositories, and I have collaborated with people who run their own git servers by managing multiple remotes - fetching from their remote and pushing to mine to share. I've also collaborated on projects that use email-based workflows. This works really well, but it also requires us to have the infrastructure to do that. Radicle reduces that infrastructure requirement to running a daemon on your desktop (as is common with p2p technologies).
I'm also suspicious about moderation. Even with tools to blacklist peers, it seems like this design is vulnerable to "hostile takeovers" where a repo is forked but the new maintainers don't change the repo's did, instead just get more nodes to follow them than the original.