I guess there was an attempt to move away from the email flow, to allow more people to contribute (I read that was part of the motivation), perhaps that made sourcehut (although it's in their plan, it hadn't become their highest priority) not an option, however both can be self hosted (that's what I would have expected from an organization as the Guix one, so that there's no dependency on a cloud service, as good as it might be), and both have really good TOS and are non profit. But cloud services are still something its users/clients do not really own. Perhaps as I understood, savannah will still be used as a mirror, but not just temporally, rather for good, so that if something happens on the cloud, there's plan B available... That's why for such big and important project I would have preferred a self hosted service. But oh well, I'm not part of the decision, and not an user yet, hopefully to become one later on when getting some minimal understanding of both guile and guix configuration (still guile but I believe simpler), because no matter the distro I always have to write and maintain a few packages myself. Hopefully at some point doesn't become never having the time to do so, hehe.

So all in all yes, the two best cloud options by far, but I'm surprised a Guix instance was not chosen, not sure if even considered.

Thank you for mentioning SourceHut as another option - I didn’t know about it. In my opinion, it doesn’t matter whether Void Linux or other distributions choose Forgejo or another platform, as long as they move away from Microsoft-controlled GitHub. Doing so would reduce the risk of corporate influence and give them greater independence, even if I fully understand that it would also mean more work.

That spam was a troll who found a loophole in the notification system. It was obviously not a data breach. That's clear to anyone who's worked with software databases or web servers.

I thought it was just bots spamming comments on issues. See https://blog.codeberg.org/we-stay-strong-against-hate-and-hatred.html Also I would believe that since codeberg is run by volunteers in a non-profit organization.

How was it an obvious data breach? The attack was done via Codebergs notification system. It's no different from the notification you got from me writing this comment.

How is that an obvious databreach? It was just bot spam, something every single public site has had issues with.