[Regulations nonsense] How does Codeberg handling EU DSA user number reporting, if at all? #2040

ell1e commented 2025年07月21日 22:24:38 +02:00

Comment

There's this unwieldy thing the EU made, the Digital Services Act. I'm not a lawyer, this isn't legal advice, and everything I say could be wrong. However, it seems like Codeberg would be an online platform under the DSA, but the DSA seems to basically exclude online platforms that aren't big companies from most obligations, based on revenue. But the one thing remaining to do apparently would be tracking monthly active users to somehow prove that it's not one of the extra regulated very big platforms.

3. Providers of online platforms or of online search engines shall communicate to the Digital Services Coordinator of establishment and the Commission, upon their request and without undue delay, the information referred to in paragraph 2, updated to the moment of such request.
   [Source]

Now for anybody hosting e.g. forgejo locally for themselves who reads t his, I guess they're wondering the same: if the EU wants this from random small code hosters, does forgejo track this number, and how?

Because apparently, this number is meant to include unregistered users. But I imagine if some install scripts somewhere depend on something on Codeberg and starts hammering it with git clone or wget automatically, that can lead to a ton of requests. Should they just be grouped by IP? By IP and user agent? Is Codeberg handling this somehow already, and how?

Or does Codeberg have some sort of knowledge that these numbers don't actually need to be collected by random small gitea or forgejo instances?

### Comment There's this unwieldy thing the EU made, the Digital Services Act. I'm not a lawyer, this isn't legal advice, and everything I say could be wrong. However, it *seems* like Codeberg would be an online platform under the DSA, but the DSA seems to basically exclude online [platforms that aren't big companies](https://www.eu-digital-services-act.com/Digital_Services_Act_Article_19.html) from most obligations, based on revenue. But the one thing remaining to do apparently would be tracking monthly active users to somehow prove that it's not one of the extra regulated very big platforms. > 3. Providers of online platforms or of online search engines shall communicate to the Digital Services Coordinator of establishment and the Commission, upon their request and without undue delay, the information referred to in paragraph 2, updated to the moment of such request. [[Source]](https://www.eu-digital-services-act.com/Digital_Services_Act_Article_24.html) Now for anybody hosting e.g. forgejo locally for themselves who reads t his, I guess they're wondering the same: if the EU wants this from random small code hosters, does forgejo track this number, and how? Because apparently, this number is meant to include unregistered users. But I imagine if some install scripts somewhere depend on something on Codeberg and starts hammering it with git clone or wget automatically, that can lead to a ton of requests. Should they just be grouped by IP? By IP and user agent? Is Codeberg handling this somehow already, and how? Or does Codeberg have some sort of knowledge that these numbers don't actually need to be collected by random small gitea or forgejo instances?

Gusted commented 2025年07月21日 23:23:47 +02:00

@ell1e wrote in #2040 (comment):

Now for anybody hosting e.g. forgejo locally for themselves who reads t his, I guess they're wondering the same: if the EU wants this from random small code hosters, does forgejo track this number, and how?

This is better discussed in https://codeberg.org/forgejo/discussions.

@ell1e wrote in #2040 (comment):

Or does Codeberg have some sort of knowledge that these numbers don't actually need to be collected by random small gitea or forgejo instances?

I am not really sure what kind of knowledge you would expect here, but this would imply some legal guidance/advice which Codeberg does not have.

@ell1e wrote in #2040 (comment):

Because apparently, this number is meant to include unregistered users. But I imagine if some install scripts somewhere depend on something on Codeberg and starts hammering it with git clone or wget automatically, that can lead to a ton of requests. Should they just be grouped by IP? By IP and user agent? Is Codeberg handling this somehow already, and how?

Sorry, but this is asking how to comply with regulations and Codeberg cannot answer that for you. As far as I am aware Codeberg has not been requested to report such numbers, so there's no answer to that.

@ell1e wrote in https://codeberg.org/Codeberg/Community/issues/2040#issue-1958794: > Now for anybody hosting e.g. forgejo locally for themselves who reads t his, I guess they're wondering the same: if the EU wants this from random small code hosters, does forgejo track this number, and how? This is better discussed in https://codeberg.org/forgejo/discussions. @ell1e wrote in https://codeberg.org/Codeberg/Community/issues/2040#issue-1958794: > Or does Codeberg have some sort of knowledge that these numbers don't actually need to be collected by random small gitea or forgejo instances? I am not really sure what kind of knowledge you would expect here, but this would imply some legal guidance/advice which Codeberg does not have. @ell1e wrote in https://codeberg.org/Codeberg/Community/issues/2040#issue-1958794: > Because apparently, this number is meant to include unregistered users. But I imagine if some install scripts somewhere depend on something on Codeberg and starts hammering it with git clone or wget automatically, that can lead to a ton of requests. Should they just be grouped by IP? By IP and user agent? Is Codeberg handling this somehow already, and how? Sorry, but this is asking how to comply with regulations and Codeberg cannot answer that for you. As far as I am aware Codeberg has not been requested to report such numbers, so there's no answer to that.

ell1e commented 2025年07月22日 00:08:40 +02:00

I was simply curious if Codeberg handles this already and how, apparently it doesn't.

For what it's worth, if this applies to Codeberg (which I obviously don't know), it seems like the expectation might potentially be that these numbers are tracked even if they haven't been requested yet. Not that I would know, clearly I'm not a lawyer.

I was simply curious if Codeberg handles this already and how, apparently it doesn't. For what it's worth, **if** this applies to Codeberg (which I obviously don't know), it seems like the expectation might potentially be that these numbers are tracked even if they haven't been requested yet. Not that I would know, clearly I'm not a lawyer.

ell1e commented 2025年07月25日 12:00:16 +02:00

I made a forgejo issue here now: forgejo/forgejo#8668 I'll close this one here. But feel free to reopen if somebody at Codeberg has something to say on this, it would be interesting to hear given Codeberg is larger than random hobbyist forgejo or gitea instances.

I made a forgejo issue here now: https://codeberg.org/forgejo/forgejo/issues/8668 I'll close this one here. But feel free to reopen if somebody at Codeberg has something to say on this, it would be interesting to hear given Codeberg is larger than random hobbyist forgejo or gitea instances.