23:59: “No one donates money to OSS”
00:00: “You must leave the world’s biggest software website to go to this random Germanic non-profit because MS was bad 20 years ago”
replies(3):
If not, maybe it's very valid to be critical of our over reliance on such an actor, specially when alternatives are present.
By no means I would call them "good", but what they can do?
Delete your repo? Firstly, why would they do that? Secondly, just a backup.
>Selfhost your repo, that's not that hard.
Maybe this was true a few years ago (spoiler: no), but now, in the era of AI, shitstorm it became extremely hard.
Crawlers will constantly DDoS your servers and AI-powered not will continuously try to register to your platform.
See, for example, this: https://outage.sr.ht/ or this: https://drewdevault.com/2025/03/17/2025-03-17-Stop-externali...
- Lessons from open source in the Mexican government [1]
- Europe as a software colony (documentary) [2]
The TL;DR is: If a diplomat from the US is at your doorstep and wants to doxx, eh... talk to, your CEO, you're doing exactly the right thing.
Maintaining my own servers and chasing ideological purity doesn't improve my project. Any time I dedicate to setting up infrastructure is time I'm not dedicating to making the code better.
The nature of Git means Microsoft can't really do much harm. Every developer and contributor has a copy of the repo, should the worst happen setting up home elsewhere isn't that difficult. But until it is, why spend time on it?
I think it is great that people use GitHub as it has a low barrier of entry, if anything happens the stuff can quickly be moved elsewhere. Until then we can piggyback on the free platform. Using some other company does not make it immediately safer anyway.
The challenge here is more about archiving, especially those rarely used repos. In any case GH is safe as MS is focussing more on AI now and they do not have a good alternative to GitHub to think about turning it off like Skype yet.
Having said that, the alternatives they mention aren't realistic. Precisely those things that make GitHub dangerous, are the things that make it worth choosing. In particular: network effects, issue tracking and PRs.
Well, he's not a fan of GitHub pull request as per the last decade.
https://github.com/torvalds/linux/pull/17#issuecomment-56546...
Another important factor is that gov workers rarely have enough skills to run OSS software, they are understaffed. And, it is difficult to integrate OSS with the existing systems.
Finally there is a question about responsibility and control. If you get a 0-day in OSS, who will patch it and who has the rights to push that patch? It is about managing risks.
Basically avoid the vendor lockin functionality.
If you think large entities always do the efficient and rational thing, can you explain why governments of countries that are not the USA depend on software that is controlled by a hostile superpower?
When they are in a position of power, they can also gatekeep access to other people's repositories, not just your own.
"probably some contributor was geolocated in a sanctioned region" - https://mastodon.social/@organicmaps/114155428924741370
I just had my GH account "flagged" (basically all interaction over web or API is locked, all open PRs wiped). No explanation.
Opening a support ticket is blocked by SMS verification. Which 429s. No idea if and how this will be sorted. Trust with some collaborators will definitely be hurt after the ban/flag even if lifted.
Really should have worked more on assigning another owner to the managed org...
So yeah, in case anyone who cares at GH sees this, account name profile.
Because it was made by coders. Old school coders. Backend coders.
>I know that's not what really matters for a git server, but I just can't take such a project seriously. "Who knows what else they didn't really care about?" in the back of my head...
Yes, a nice looking website, that epitome of project maturity and quality /s
(as if there's a shortage of barely working vaporware FOSS projects with great looking websites, because their creators are more into the whole hussle culture / fancy launch page / web design than coding)
If github annoys you you can concievably create a new repo elsewhere, change origin locally, push.
The real question is how long until they annoy you. And how easy it would be to set up an automatic mirror beforehand.
GitHub json data is horrible but not intractable to work with.
> But other parts are done really really well.
> I think github does a stellar job at the actual hosting part. I really do. There is no question in my mind that github is one of the absolute best places to host a project. It's fast, it's efficient, it works, and it's available to anybody.
> That's wonderful. I think github is absolutely lovely in many respects.
> And that then makes me really annoyed at the places where I think github does a subpar job: pull requests and committing changes using the web interface.
More than ever since github broke for good noscript/basic (x)html support under the guidance of... msft not that long ago (I am a noscript/basic (x)html user).
This will attract the fire of msft "trolls" (AIs or humans)... strap on for impact...
Anyone remember Microsoft calling Linux a "cancer"? Or Microsoft threatening open source developers for violating 200 patents? Or their official stand where they whould threaten and fear Linux devs? The secretly funded lawsuits against Linux? They even threatened lawsuits at companies for just using Linux.
This company is rotten by the executive level.
- convenience (everyone already has a GitHub account and is familiar with the platform) - discussions platform (issues, prs, discussions) - CI (GitHub Actions)
It's already there, and it's free for the most part. Why would I bother hosting my own?
Actually there was one mentioned in a different post. You're at the mercy of Microsoft (and random US sanctions) not only for your project, where you have a copy of the source and are the canonical source for further updates, but also for your dependencies.
That's how we got to use a payment provider that had absolutely no documentation and was located on the other side of the world, so queries to their support team would take 24h.
We never managed to actually get any money via that provider.
It was taking screenshots and storing them locally - the (justified) anger about it was that anyone with physical access to your machine (eg an abusive spouse) could see what you had been doing, and it was to be turned on by default.
Now there's VSCode, TypeScript, WSL, Dapr and .NET, all open source.
VSCode is "open source" with a walled garden of a marketplace. A quick look at how Microsoft is trying to kill competitors like Cursor (within the last week) by squeezing them out of the walled garden is... telling.
These moves by Microsoft are not made in the spirit of open source. It's in the spirit of EEE.
Yes, that thing was hacked to pieces by privacy researchers.
I haven't been following updates on Recall since June last year: https://simonwillison.net/tags/recall/
It highlights an impact of concentrated wealth on technological development in general, the third option: If a competing technology can't just be ignored, or crushed, the final veto is to simply purchase it.
Which is what M$ has been doing for the last 1/2 decade due to the ever increasingly crappy nature of their OS product.
To slightly modify the article's conclusion: no one should host anything on github...
Issues and PR comments are another story though
I was mad they forced me to upgrade to 11 for new WSL features, and now refuse to let you set up 11 without a Microsoft account.
But when it did gain a lot of developer attention, MS's true nature took hold and gradually converted it into the walled garden we see today. It was more subtle in the beginning - a few useful extensions were proprietary and wouldn't work on non-MS builds of vscode for some unspecified reason. It was like a gentle nudge to the developers to migrate to their opaque proprietary builds. Of course, we have seen that before, haven't we?
As an aside, if you like vscode but hate the manipulation, you should give the Eclipse Theia editor [1] a try. It's an almost complete reimplementation of vscode and is compatible with the extensions from OpenVSX. I believe that they have fairer alternatives for collaborative editing, etc. At least, they will spare you the manipulation.
On the other hand, network effects is a big problem - especially for open source projects. There isn't a good way to find projects that are scattered over thousands of small git hosts. There should be a project listing and search service (like freshmeat), but for hosted projects.