Hacker News Reader

Comment by sli | Hacker News Reader

I say this every chance I get, but Github can and will hold your code ransom if your premium account lapses while you still have private repos. They do not give you the option to set those repos to public, they require you to pay money to regain access.

Maybe you can have them switch the repos to public if you go through their support, but Github doesn't offer that in their ransom note, and that would be an unacceptable solution, anyway.

Whether or not this is a risk to a given developer (or their company) is irrelevant to me, because they still have policy that allows them to hold code hostage for ransom, and that should make Github a complete non-starter when deciding on an SCM host.

View on HN

Calling it a randsom note is a tad dramatic. You pay them for the service of private repos. If you stop paying, you stop getting the service.

Just like every other business ever.

Generally you are correct: service is paid for -> stop paying -> stop service. However, Github has a free tier for public repositories. Why can one not convert the repository to public then?

I like how Dropbox handles this. If your paid membership is cancelled and you are using more space than the free tier, they don't delete your files, just make them read-only. You can view or download them, but if you want to upload or update something, you have to buy premium or bring your space use within free tier limitations.

People may put all manner of things in private repos that they don't want to be made public, so github shouldn't just expose them to the outside world.

That doesn't mean they couldn't just offer a button to make them public after the fact, I don't think anyone was suggesting to make them public automatically...

GitHub shouldn't make them public, for sure. But people should.

Because github can’t make that decision. It’s your responsibility to convert it to public. There could be sensitive information in the private repos.

...hence why they should give you that option if your paid account expires. It feels like people are being intentionally obtuse in this thread

Nope, that is exactly what it is. There is no reason not to give read-only or export-only access to private repos if your account is locked. Otherwise just delete the whole thing.

If anyone has ever cloned the project, Github cannot hold your code to ransom because you already have a copy of it and the whole history including commit messages. That is the beauty of git.

Github do have your issues and un-merged pull requests "to ransom", though. Make sure to back those up if they are important.

How can they hold your local clone of the code hostage?

A sane option is to deny GIT access while still allowing the primary account to download a copy of the repo for a set amount of days.

Instead they play "data roach motel" and hold your data hostage. Very uncool.

7 bucks a month is hardly ransom. it would be better than automatically making private repo's public when you stop paying

> 7 bucks a month is hardly ransom.

You do not know other peoples' situations. And strictly speaking, demanding money to access your data is ransom.

> it would be better than automatically making private repo's public when you stop paying

False equivalency. I already said that "disabling repo and allowing primary user to download" was acceptable. I said nothing about private->public.

This whole situation only reaffirms my distrust in all cloud services.

EDIT: Seriously, -1 ? The user's data is sacrosanct. You disable most functionality, but you never, I repeat never delete data or make it irretrievable within a envelope of time for recovery. The only exception to that is if the user explicitly requests a permanent deletion - then you do so after appropriate warnings.

You're being downvoted for they ridiculous hyperbole of using the terms "ransom" and "hostage" for the situation, when it's just that you didn't pay your bill, so you don't get access to the service. Any web host would do the same, as would any other business. You don't pay your bill, you don't get the service. Why is that so hard to comprehend?

I think that's because the service is hosting the data, not the data itself. Holding onto the data which you (expect to) own is pretty much akin to a person taking care of a pet for money and when the money is not paid, keeps the cat. It's the obvious solution - the cat-sitter doesn't have any other leverage here - but Github does have other options than holding onto the cat.

A better parallel would be storage lockers. And there, if you stop paying eventually they cut the lock off and sell your stuff.

Pay your bills. I cannot take the idea that they're holding anything "hostage" when the whole thing is that you're not paying your bill. If you don't pay your car bill, they'll take it back.

Reply on news.ycombinator.com