Hacker News Reader

Comment by dandotway | Hacker News Reader

In the 1970s-80s we managed with email lists and tarballs on multiple mirrors. Git itself decentralizes source control, and yet we all want to use single-point-of-failure Github.

Anyone remember when Github took down youtube-dl?

I wonder how much Big Brother data Microsoft is gathering on Github developers. "Oh, as part of our hiring process, just like we scan your FB and Twitter, we also scan your Github activity to evaluate your performance as best as our machine learning overlords can assess it. Do you create Github projects and then abandon them when unfixed issues accumulate? Our algorithm thinks you're a bad hire."

View on HN

> Anyone remember when Github took down youtube-dl?

I would blame the law (DMCA), not those forced to abide by the law (Github)

Especially because they worked to try and make sure this wouldn't happen again.

The law also permits content to be restored immediately upon receipt of a counternotice. Somehow the data silos never get around to supporting that.

twitch actually does do that IIRC, not sure about others

GitHub can't, until at least the the public support is in their favour, because legally it's a hot water. This is not your ordinary copyright DMCA Complaint, this is the section 1201 concerning circumvention, which is held to a different standard. This is essentially RIAA telling GitHub "if you're not stopping this, we'll see you (not the YT-DL developers) in court".

> GitHub can't, until at least the the public support is in their favour

Public support on which grounds?

I can’t see any evidence a counter notice was filed until the EFF got involved, at which point GitHub immediately reinstated YouTube-dl.

Did GH ignore a counter notice?

It was an unfortunate situation. I don't entirely know how GitHub handled things before the Microsoft acquisition but it also wouldn't surprise me if Microsofts legal department is more risk adverse compared to GitHub internal.

> I would blame the law (DMCA), not those forced to abide by the law (Github)

It seems even in the context of US-based companies that some companies are a little more "trigger-happy" with DMCA and other claims compared to others.

Laws need teeth to be enforced. It used to be illegal to harbor runaway slaves, or to be a Catholic priest in Protestant England. So people built cleverly hidden Priest Holes[1] in houses to hide. But you can't really build the equivalent of a Priest Hole within Github, because Github is not your house, but rather your lord's castle.

[1] https://en.wikipedia.org/wiki/Priest_hole

> blame the law (DMCA), not those forced to abide by the law (Github)

What about those abusing [a misrepresentation of] the law (the RIAA) and the members who pay their dues (Microsoft)?

There was actually a movie about this very thing. Miguel De Icaza had a cameo. The villain company was a thinly veiled replica of Microsoft, and the CEO looked like Bill Gates. ( https://www.imdb.com/title/tt0218817/ )

In another thread a few weeks ago about code signing, I mentioned we should just hand Apple Source code for the apps it distributes in the store, to make review more thorough and reliable. Replies objected "Why would you give your source code to another company?" ........ and github is still a thing? ( https://news.ycombinator.com/item?id=28794243)

Some of the features in that movie would work nowadays, such as paintings detecting a visitor and changing based on the visitor or their mood or sound input (don't remember exactly). Wasn't there also something with satellites?

Also, ironic De Icaza ended up working for... the company he wanted to work for all along, ...Microsoft. Though Friedman left Microsoft (or at least stepped down as GitHub CEO).

De Icaza was also featured in the Finnish movie The Code [1].

[1] https://en.wikipedia.org/wiki/The_Code_(2001_film)

It was still rad back in the 1990s and 2000s, then came in people who think that if they repeat a bullshit sentence loudly enough and pushily enough, people at large will equate it with truth: "Email is too inconvenient to use".

I'd say those people do have a point about how manipulation tactics work, but email being inconvenient is bullshit.

What's inconvenient is using proprietary Electron apps just for communicating, while not being able to communicate on my phone without downloading and installing a proprietary app.

On the other hand, you have email: open-source clients are available for virtually every platform, it doesn't turn my laptop into an electric bar fire, it doesn't drain my phone's battery (or if it does, I could just install another client!), etc.

It's quite sad how something as beautiful as email is being replaced by corporate garbage like Teams, which comes bundled with Office 365 (and that's a whole 'nother crapfest). Uch.

> Do you create Github projects and then abandon them when unfixed issues accumulate? Our algorithm thinks you're a bad hire."

This data is public and to be honest I’m amazed we haven’t yet seen a YC startup promoting that they do exactly this.

Shhhh. The former Klout folks are probably listening.

Don't create a Github account with your name then?

Yeah seems like this would be a simple workaround if companies did start adopting this practice

> Git itself decentralizes source control, and yet we all want to use single-point-of-failure Github.

This is pretty much why many organizations out there, as well as i personally for my homelab use self-hosted GitLab instances: https://about.gitlab.com/

Though in practice there are a lot of other options out there, like Gitea (https://gitea.com/) and GitBucket (https://gitbucket.github.io/), though maybe less so for alternative source control systems (e.g. SVN has been all forgotten, however that's a personal pet peeve).

Not only that, but i also utilize my own Sonatype Nexus (https://www.sonatype.com/products/repository-oss?topnav=true) instances to great success: for doing everything from mirroring container images that i need from DockerHub (e.g. due to their proposed removal policies for old images and already adopted rate limits), to mirroring Maven/npm/NuGet/pip/Ruby and other dependencies, so i don't have to connect to things on the Internet whenever i want to do a new build.

That not only improves resiliency against things on the Internet going down (apart from situations where i need something new and it's not yet cached), but also improves performance a lot in practice, when only the company servers need to be hit, or my own personal servers in the data center for my cloud hosted stuff, or my own personal servers in my homelab for my own stuff.

Admittedly, all of that takes a bit of setup, especially if you happen to expose anything to the web in a zero trust fashion (permissible for my own stuff, as long as i'm okay with manually managing CVEs just to probably get hacked in the end anyways, but definitely not something that any corporation with an internal network would want to do), but in my eyes that's still worth the effort, if you value being in control of your own software stack and the ecosystem around it.

It's probably much less worth it, if you don't see that as a benefit and don't want to be the one responsible for whatever project you're working on getting hacked, e.g. if you'd fail to patch out the recent GitLab CVE where exiftools could execute arbitrary code, which is probably the case if you don't have the resources to constantly throw at maintenance, in comparison to companies with 100x - 1000x more resources than you have for that sort of stuff.

but that data is avaliable to everyone cuz it's mostly public?

Reply on news.ycombinator.com