A report this week from Hacker News spotlighted the launch of Tangled, a new "code forge" — the category of platform that includes GitHub, GitLab, and Gitea — built on top of the AT Protocol, the same federated, open standard that powers the Bluesky social network. Unlike GitHub, which is owned by Microsoft and hosts an estimated 100 million repositories serving over 100 million developers worldwide, Tangled operates without a central corporate owner. Any server operator can run a node, and repositories can exist across multiple independent servers rather than under a single company's roof.
The AT Protocol, developed by Bluesky PBC, uses a decentralized identifier system so that user accounts and their associated data are not tied to one host. Tangled applies that same architecture to code repositories, pull requests, and issue tracking — the core workflows that software development teams use daily. The project is open source, and its launch post describes it as early-stage but functional, with the development team actively using it for their own work.
The timing is notable. GitHub experienced a significant outage in January 2024 that lasted several hours and disrupted CI/CD pipelines for companies globally, and a separate incident in 2023 involved a compromised token that briefly exposed private repository metadata. Centralized forges have also become flashpoints in geopolitical disputes: Microsoft-owned GitHub has been compelled to restrict access for users in sanctioned countries, including Iran and Crimea, effectively cutting developers in those regions off from years of their own work. Tangled's federated model does not eliminate those risks, but it distributes them — a node operator in one jurisdiction going offline or complying with a government order does not necessarily take down repositories hosted elsewhere.
What a general technology outlet is unlikely to flag is that code forges sit at the base of nearly every piece of software that runs critical infrastructure — water treatment SCADA systems, hospital networks, grid management tools, and the open-source firmware that runs routers in homes and small businesses. The supply chain attack on the XZ Utils compression library in 2024, which nearly compromised SSH authentication on millions of Linux servers, propagated almost entirely through a single centralized repository and its maintainer trust system. A world where foundational software libraries are distributed across federated nodes with no single point of compelled removal or covert modification is meaningfully more resilient than today's arrangement, even if federation introduces its own coordination complexity. For anyone tracking long-cycle risks to the digital systems that underpin physical-world logistics and communications, the question of where code lives and who controls access to it deserves attention well before any specific crisis makes it urgent.
Tangled does not yet publish user or repository counts, and the project acknowledged in its launch post that federation between independent nodes is still being finalized. It is, by its own description, a working beta. But the Hacker News thread generated several hundred comments within hours of posting, with a notable share of contributors who maintain open-source packages that millions of downstream projects depend on expressing interest in self-hosting options.
