What happened to the pricing for self-managed instances? We rather like our onprem setup.

Some time ago they made the pricing for hosted and on-prem the same.

GitLab Team Member here. The pricing is the same for both our SaaS and self-managed products - and the tiers are now identical as well.

This is not clear from the pricing page, which talks about CI pipeline minutes and other SaaS only stuff.

GitLab team member here. Thanks for the feedback. I'll relay that to the team who owns our pricing page.

This page contains comparisons for the self-managed features: https://about.gitlab.com/pricing/self-managed/feature-compar...

What's the justification for the self-managed and SaaS products being priced the same? That isn't intended to be snarky but a legitimate question, by the way.

You can read a bunch about how we made that decision here: https://about.gitlab.com/handbook/ceo/pricing/#price-differe...

Its the same i guess!?

Which presumably only works if your site is using Cloudflare? Since you wouldn't be MITMing SSL in order to inject this header?

This is correct. It's significantly harder to inject the origin IP into a TCP stream. We have ways [1] of doing it, but it requires some coordination on both sides.

1- https://blog.cloudflare.com/mmproxy-creative-way-of-preservi...

Have you considered enabling this out of band? For example as a network administrator I could verify a CIDR block and receive a real time stream of 5-tuples (err, 7-tuples with the proxy?) destined to my network.

I've been trying to get Fi to resolve a billing issue.... I'm stuck in a loop with support where they keep asking me for a security code, then the next day they'll respond back saying it expired and they need another one. The codes only seem to be valid for 30m, so I don't have any idea why they keep asking for them...

PW requirements are defined by your company as well.

A human, again?!

RPKI, but it's barely used

This is currently used to sign ROA. A rogue actor can easily work around that by including the original AS in the AS path of the announce.

Nope, that does not cover certificate issuance for IP addresses in that range.

Just wait until you hear my life hack about using plastic to prevent things from getting wet.

Except many of the big upstream providers don't actually filter anything. HE.net for example, doesn't.

We forgot to create some IRR entries and GTT just accepted our prefixes.

There is essentially no security, it's fairly trivial to hijack whatever space you want. (Doing it undetected is more difficult though!)

It's actually a /64 at Vultr.

No 2FA on staff accounts?