I'm getting unicorns.
I've been unwilling to host any personal projects on GH after Copilot launched and it because clear that GH/MS doesn't really respect the authors of the code they host. Honestly open source in general has gotten a little less compelling to me after Copilot. The recent security issue at GH has also turned me off even more on Git hosting services.
For closed source projects maybe it's just best to store encrypted backups off site and spin up a self hosted option whenever collaboration is needed. Seems pretty inefficient though.
Self-hosting Gerrit is easy[1] because all its internal state is fully transactional, including reviews and configs, and is simply stored as normal Git commits inside the Git repos on the filesystem.
In fact, our instance had much better uptime over the past year than GitHub despite being migrated to another server once!
[1]: ... unless you need a complex high availability setup or replicas. But 99% of projects are fine with just a single instance and backups.
[1] https://gitea.io
Then use Renovate and Google OSV scanner as a replacement for Dependabot and Github Advanced Security.
I like it, self-hosting bare git repos has been pretty painless for me in the past on LANs. You could still add a hook to encrypt the repo and backup whenever you merge to dev or something as well.
You pretty much only lose the hosted diff/review/ticketing tools which I've never enjoy much regardless.
I really like how the author is open about both the development and the business side.
At the new work we use BitBucket, but for reviews its UI is strictly worse than Critic. And on top of it it is strictly more expensive than self-hosting experience including paying for a competent sysadmin.
I understand that cloud allows to offload a lot of headaches, but I really see no point in using cloud services for development. Even for a small company a dedicated server with another to spare in case of failures will be cheaper and it’s administration will be trivial.
Recent developments have only reinforced my feelings on this matter.
1. check my internet connection
2. check HN
3. check official statuspage
1. the status page is unavailable too
2. the status page reports the service as green/available even though it's red/down (maybe it's still accessible to the service pinging its health status, maybe it's "accessible" but not actually functional, maybe the engineers were too busy fixing the problem to click the button to update the status page, maybe not updating the status lets them pretend they're within SLAs or KPIs)
that said, HN is also down a lot lately, but that the kind of outage that makes more more productive actually!
How do you do that?
HN though comes with all the commentary.
I have to wonder if Git could somehow report this better. I guess it depends on exactly how GitHub is down, but "fatal error in commit_refs" made me worry that my local repo was somehow hosed.
If it can’t even connect it’ll tell you that, but I would assume on github the client will always manage to connect unless their entire network is down.
AWS is basically never down.
WhatsApp is basically never down.
Time for GitHub to grow up?
My point was not about similar scale though. How hard is it to keep a system up? AWS is a whole universe compared to GitHub, yet it doesn't go down as often as GitHub.
It is so frequent and unreliable, you just might as well self-host at this point. You would likely have better up time than GitHub over the past three years since this prediction. [0]
However, saying "degraded performance" when you know it's "down for everyone" is an industry phrasing thing that's irritating. AWS also has "elevated response times" when everyone is seeing 5xx errors, or infinite response times.
Another popular one is "elevated API error rates" when the error rate is 1.
Have backups for critical systems, people. In my case, it's building docker containers locally and luckily deploying to one server via ssh.
btw, I hope none of your CI system relies on build steps that might include pulling code from GitHub or downloading packages from GitHub Package registry. Often when GitHub is down, my CI system on GitLab is broken too.
https://research.kudelskisecurity.com/2023/03/06/polynonce-a...
"...The next major issue that people encounter is that they need to collaborate with developers on other systems. To deal with this problem, Centralized Version Control Systems (CVCSs) were developed. These systems (such as CVS, Subversion, and Perforce) have a single server that contains all the versioned files, and a number of clients that check out files from that central place. For many years, this has been the standard for version control."
"...However, this setup also has some serious downsides. The most obvious is the single point of failure that the centralized server represents. If that server goes down for an hour, then during that hour nobody can collaborate at all or save versioned changes to anything they’re working on. If the hard disk the central database is on becomes corrupted, and proper backups haven’t been kept, you lose absolutely everything..."
"...This is where Distributed Version Control Systems (DVCSs) step in. In a DVCS (such as Git, Mercurial, Bazaar or Darcs), clients don’t just check out the latest snapshot of the files; rather, they fully mirror the repository, including its full history. Thus, if any server dies, and these systems were collaborating via that server, any of the client repositories can be copied back up to the server to restore it. Every clone is really a full backup of all the data...."
Normally a Git remote is just an ssh-accessible machine, and so pretty resilient. But GitHub is a lot more complex, so apparently that simple service went down, along with all the features they built on top of it
One wonders sometimes if that’s the goal.
First, it was the RSA key leak in [1][3], then the site's key expired causing down time again [2] and now this.
I don't think anyone can tell me with a straight face that GitHub was any more reliable or better when Microsoft acquired it. It is now worse off.
Nothing has changed except for more outages and downtime.
So so reliable. /s
[0] https://news.ycombinator.com/item?id=35004629
[1] https://news.ycombinator.com/item?id=35295216
[2] https://news.ycombinator.com/item?id=35003741
[3] https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-k...
It's apparant that it wasn't without issues prior to acquisition (e.g. a quick search for GitHub issues prior to 2018 gives this: https://techcrunch.com/2017/07/31/github-goes-down-and-takes...) - reporting issues in 2017, 2015, and 2012.
I don't have the data to comment on whether it was better before or after MS acquisition, but would suggest this isn't the best sample size to base any conclusions on.
That's something I love about Fossil.
Everything with Fossil (wiki, issues, code) is replicated as well.
My intuition aligns too closely with my known biases here for me to be satisfied with that alone.
1: https://statusgator.com/blog/has-github-been-down-more-since...
The pros who maintain git uses email(!), but I think that would take more time than just waiting out the outage.
From github status