>
> Your individual personal or repository data will not be shared with third parties. We may share aggregate data learned from our analysis with our partners.
That's very concerning wording... I guess even private repositories are being fed into AI, at least that's what that policy explicitly allows.
Every service and utility gets enshittificated sooner or later, it's a given at the moment. I deleted all my private repos, github and all other MS services should be avoided in the future.
The only solution is to self-host. Gitea is good.
I don’t understand your thinking and gitea’s marketing. They say in the same breath that it’s “self-hosting” and that they do “Git hosting… similar to GitHub, BitBucket, and GitLab”. — https://docs.gitea.com/
Gitea is an open source alternative to GitHub, that you run yourself.
I use Gitea with Drone CI and it works pretty well: https://www.drone.io/
Some might also prefer the Woodpecker CI fork due to the license: https://woodpecker-ci.org/
I setup Drone as a part of my migration away from GitLab Omnibus and have no complaints so far: https://blog.kronis.dev/articles/goodbye-gitlab-hello-gitea-...
Here's the Drone example in particular: https://blog.kronis.dev/tutorials/moving-from-gitlab-ci-to-d...
Gitlab is a crazy setup full of services, with elaborate interdependence, absurd hardware requirements, iffy performance, and all the lack of confidence on security that comes from this (and it only ever running if you use their docker images and don't touch anything).
But yeah, it got everything.
it is functioning like Open Source should, there was a disagreement in how the project was run so it gets forked
This used to be more common place when projects were run by people not companies. I wish the practice would come back we need more forks in Free Software
Upgrades have been painless. Doesn't tax the server.
Was using Gitea when that fork happened and didn't see a reason to migrate. Looked very much like poor communication on the behalf of Gitea causing a misunderstanding.
Gitea project hosts its code on GitHub: https://github.com/go-gitea/gitea. You must admit that is a bit ironic.
> age of massive ever-growing out of control tech monopolies that do whatever the fuck they want
GitHub is not the only option for source code hosting. There are alternatives like GitLab, Bitbucket, and numerous smaller ones.
git init --bare /path/to/repo.git
It does not have any visual MR or enterprisey features, but it works.
The features are basic and managed by editing text files and git-pushing them to a control repository: create repositories, add users and their keys, readonly or readwrite. There is no GUI but once you have a copy of the repo on your machine you can use one of the several git GUIs available for any OS.
Bare repo on a server is exposed to people exactly like Github: a remote URL you put in once and forget about it.
How people use their local git repository is their business, command-line, Sourcetree, GitKraken, what have you, but any of those work with any remotes.
(Sure, git by itself does not provide the other features from the hosting services like issue tracking and pull requests, but not every workflow requires those to be linked directly to the SCM)
Heck I think even the Github Desktop application also works with non-Github repositories, and they would be the only ones that would have any interest in locking people in.
Unless you mean specifically the UX of having a URL you can copy to a specific line of a specific commit in a repository, which indeed is not possible without a standard URI scheme (which does not exist) or a web client.
It is not a personal criticism to you. I find it interesting git gave us all this efficiency and the enterprise removes it by adding complexity back because employees supposedly cannot be bothered to learn their tools (or cannot be mandated) or plainly prefer a nicer ui. Not a crime, but I can see how big corporations become inefficient with this type of thinking, when appliend to hundreds of tools and processes.
Looks like they're working on migrating to a Gitea instance: https://github.com/go-gitea/gitea/issues/1029 .
https://github.com/go-gitea/gitea/issues/1029#issuecomment-1...
The fork was established at the time that Gitea got entepreneurial and founded Gitea Ltd. with plans for an enterprise version. https://codeberg.org used to run on Gitea, but switched to Forgejo, and Forgejo project is hosted on Codeberg at https://codeberg.org/forgejo
It's a sad situation that if you desire exposure and community building you must maintain a fork on Github, but that's how it is for smaller projects. I am in a similar situation, with some of my projects with main repos hosted on sourcehut, but most of external engagement comes from clones on github. It is what it is, and we do what we must. :)
How does it look from the potential users' perspective when the product they market is not the product they choose to use for themselves?
Google's commitment to privacy? Google's leadership in AI?
O how I love marketing, you can say just about anything
The people are on github, so it is really enticing.
Maybe the reddit and twitter drama creates a viable enough community for federated logins to become useful.
For any other project, sure. But when building an alternative to GitHub.. there is value in dogfooding.
Every time someone parrots this, I have to wonder if they did more than 5 minutes of reading - it's one of the top issues on the issue tracker and they've outright stated they will move once Gitea is at a spot where they are not losing functionality and history.
I did not care enough to open their issue tracker. I still don't. It is ironic, not a bit, a lot. That statement was a bit sarcastic.
I hope that put the end to your wondering.
The other solution is political. There's a reason that governments regulate and define economic rules of the road. This is a good example of where governments need to step in. The link between generative AI and the data it is trained on needs to be carefully thought through and properly handled especially given the capitalist nature of our economy.
This is what is crazy to me. You can agree to terms, build infrastructure around terms you agreed to, then those terms can completely change. Don't like it? Click disagree and we'll close your account, no problem!
And, thanks to politics around social media censorship, we have way too people willing to say, "Don't like the terms, don't use the platform!" to the point of normalization. Sad.
Slippery slope, yes, but in reality there is a legal framework and a ToS in place as well.
Use of data for AI training is a big deal. Implicitly allowing it under this definition will be enough cause for a lawsuit.
That doesn't give a lot of comfort. ToS can change at any time.
>data from public repositories, and also... data from private repositories when a repository's owner has chosen to share the data with GitHub by enabling the dependency graph
So if you don't enable the Dep Graph feature, your private code is treated according to the standard terms of service.
You are not giving them an inch, you are receiving an inch (and a whole lot more). And if you don't want that, you can turn the feature off.
What would you want instead? Them not offering the feature at all?
That might still be too much for you, everyone's line is at a different place. Dependabot works better the more data it has, so personally I'm fine with that level of detail being returned to an aggregated service, for that very specific purpose.
There are other private providers of dependency scanning out there. I'm fairly sure they all work the same way Github does, just with smaller datasets.
As for this aggregate stats, why not limit the scope to access to the build status instead? They don't need anything more to provide this service...
For companies & people not willing or able to surrender that level of access, it's still possible to use the dependabot API, dissociated from any github repository (for example if you have an Atlassian git repository). You just send it a list of dependencies and an enum indicating its current build status, and they'll reply with a list of suggestions.
And to be clear I'm not saying Github or Windows is doing this, I'm just saying either you trust them to keep their word or you don't
1. Click your avatar
2. Settings
3. Security / Code security and analysis
4. Dependency graph [Disable all]
You're welcome
…and “automatically disable for all new private repos” is not set unless you explicitly opt in.
I'm sure github legal prefers your description, though.
It's like giving a party some of your possessions to store, and signing a form saying you don't consent to them snooping through them, then worrying "what if they change and forge the contract later?". They wouldn't need to. Either you trust them to keep their word or you don't trust them with your possessions at all
I'm assuming I want to definitely not check that if I dont want my code stolen?
But I dunno, they have worded this all so confusingly, this is some dark pattern shit. Do I check the box or not?
If I make my own image of Spider-Man or some similar IP, that image is still a derivative and subject to copyright claims. Even if I claimed “I never knew about a character like this before”, I’d still get hit with a massive infringement claim.
How is predictive AI any different? If you feed in copyrighted or trade secret material, how are you not responsible for suspect output?
How would you know the LLM used your work specifically and then prove that in court?
Breach of licence and copyright laws is still illegal even if its very well concealed.
Lots of their customers' code is requiring attribution, or specifies acceptable uses (notably, what kind of license the product built with your code is allowed to have). Beyond simple copyright to which anyone can pretend, they're also concealing this.
From a practical standpoint, I don’t see how that is true.
In order to establish (civil) liability in the United States, someone would have to file suit, survive the inevitable standing challenges, and demonstrate on the preponderance of the evidence that they had been harmed by this conduct.
If you can’t prove your code was reproduced by this model, I don’t see how you can successfully do that.
GitHub is a Californian company they are beholden to US regulation that requires them to hand over data upon legal request, and they can be prohibited from telling you they did. These requests happen frequently.
https://github.blog/tag/github-transparency-report/
> In 2022, GitHub received and processed 432 requests to disclose user information, as compared to 335 in 2021. Of those 432 requests, 274 were subpoenas (with 265 of those subpoenas being criminal or from government agencies and 9 being civil), 97 were court orders, and 22 were search warrants.
Concerning national security letters:
> We’re very limited in what we can legally disclose about national security letters and Foreign Intelligence Surveillance Act (FISA) orders. We report information about these types of requests in ranges of 250, starting with zero. As shown below, we received 0–249 notices from July to December 2022, affecting 250–499 accounts.
Seems like we can increase the lower bound ever so slightly: It couldn't have been zero, otherwise it would affect "0-249 accounts".
I do have a codeberg account so will consider moving my repositories again, although it's probably too late and has all been sucked up by Google already.
True, assuming that GitHub/MSFT/OpenAI's stance is correct. Just because they have that stance doesn't mean it is[1].
In the end, these gray areas will be decided in court.
[1] I personally think it probably is, which is why I removed all of my stuff from the open web and these sorts of services -- I see no other way to prevent this use of my data.
AIUI the AI can't be used to answer any questions based knowledge from training that included private repositories, since (still AIUI) there's no guarantee that contents from the training won't appear in the output.
But there seems to be a loophole for yes/no questions. An AI that answers only yes/no could be trained on private repositories, or run on them. So they could, say, train an AI to recognise repos that require working hours from their legal staff, or from their support staff, and then run that AI on all repos to locate repos that cause expense in the future. Things like that seem possible.
And an AI might answer questions like this: "Does any repo contain the string 845fjkef5urwejf in a Kotlin file?"
I love how they say that as if it's a meaningful distinction in some way.
OpenAI is a third party..?
My employer (one of the largest in the world) has fully migrated to Office 365 and a lot of the new source code is on private Github repositories. But no worries, the humans working at Microsoft will not analyse the data. This is only done by AI.
Next people will be surprised that GitHub has the right to show your source code on a website....
i strongly doubt that this language would support the use of private repositories for training generative systems.