Important open source projects should not use GitHub (2020)
unixdigest.com
unixdigest.com
Maintaining my own servers and chasing ideological purity doesn't improve my project. Any time I dedicate to setting up infrastructure is time I'm not dedicating to making the code better.
The nature of Git means Microsoft can't really do much harm. Every developer and contributor has a copy of the repo, should the worst happen setting up home elsewhere isn't that difficult. But until it is, why spend time on it?
Famous last words
Issues and PR comments are another story though
I think it is great that people use GitHub as it has a low barrier of entry, if anything happens the stuff can quickly be moved elsewhere. Until then we can piggyback on the free platform. Using some other company does not make it immediately safer anyway.
The challenge here is more about archiving, especially those rarely used repos. In any case GH is safe as MS is focussing more on AI now and they do not have a good alternative to GitHub to think about turning it off like Skype yet.
You could just use codeberg. But you immediately had to jump to the most difficult alternative.
Basically avoid the vendor lockin functionality.
Actually there was one mentioned in a different post. You're at the mercy of Microsoft (and random US sanctions) not only for your project, where you have a copy of the source and are the canonical source for further updates, but also for your dependencies.
Anyone remember Microsoft calling Linux a "cancer"? Or Microsoft threatening open source developers for violating 200 patents? Or their official stand where they whould threaten and fear Linux devs? The secretly funded lawsuits against Linux? They even threatened lawsuits at companies for just using Linux.
This company is rotten by the executive level.
Now there's VSCode, TypeScript, WSL, Dapr and .NET, all open source.
VSCode is "open source" with a walled garden of a marketplace. A quick look at how Microsoft is trying to kill competitors like Cursor (within the last week) by squeezing them out of the walled garden is... telling.
These moves by Microsoft are not made in the spirit of open source. It's in the spirit of EEE.
Having said that, the alternatives they mention aren't realistic. Precisely those things that make GitHub dangerous, are the things that make it worth choosing. In particular: network effects, issue tracking and PRs.
00:00: “You must leave the world’s biggest software website to go to this random Germanic non-profit because MS was bad 20 years ago”
If not, maybe it's very valid to be critical of our over reliance on such an actor, specially when alternatives are present.
I was mad they forced me to upgrade to 11 for new WSL features, and now refuse to let you set up 11 without a Microsoft account.
It was taking screenshots and storing them locally - the (justified) anger about it was that anyone with physical access to your machine (eg an abusive spouse) could see what you had been doing, and it was to be turned on by default.
By trustable 3rd parties?
> last year
But this year it has MORE "AI" doesn't it?
Yes, that thing was hacked to pieces by privacy researchers.
I haven't been following updates on Recall since June last year: https://simonwillison.net/tags/recall/
There are many important Free Software projects such as GNU and Linux, and they've always stayed away from GitHub.
All the important stuff is not on github. The open github is mostly used by unfinished test projects.
The crux is in the former. Should important projects be on GitHub? Should any projects be on GitHub?
I just had my GH account "flagged" (basically all interaction over web or API is locked, all open PRs wiped). No explanation.
Opening a support ticket is blocked by SMS verification. Which 429s. No idea if and how this will be sorted. Trust with some collaborators will definitely be hurt after the ban/flag even if lifted.
Really should have worked more on assigning another owner to the managed org...
So yeah, in case anyone who cares at GH sees this, account name profile.
If github annoys you you can concievably create a new repo elsewhere, change origin locally, push.
The real question is how long until they annoy you. And how easy it would be to set up an automatic mirror beforehand.
GitHub json data is horrible but not intractable to work with.
More than ever since github broke for good noscript/basic (x)html support under the guidance of... msft not that long ago (I am a noscript/basic (x)html user).
This will attract the fire of msft "trolls" (AIs or humans)... strap on for impact...
- convenience (everyone already has a GitHub account and is familiar with the platform) - discussions platform (issues, prs, discussions) - CI (GitHub Actions)
It's already there, and it's free for the most part. Why would I bother hosting my own?
It highlights an impact of concentrated wealth on technological development in general, the third option: If a competing technology can't just be ignored, or crushed, the final veto is to simply purchase it.
Which is what M$ has been doing for the last 1/2 decade due to the ever increasingly crappy nature of their OS product.
To slightly modify the article's conclusion: no one should host anything on github...
Because it was made by coders. Old school coders. Backend coders.
>I know that's not what really matters for a git server, but I just can't take such a project seriously. "Who knows what else they didn't really care about?" in the back of my head...
Yes, a nice looking website, that epitome of project maturity and quality /s
(as if there's a shortage of barely working vaporware FOSS projects with great looking websites, because their creators are more into the whole hussle culture / fancy launch page / web design than coding)
That's how we got to use a payment provider that had absolutely no documentation and was located on the other side of the world, so queries to their support team would take 24h.
We never managed to actually get any money via that provider.
- Lessons from open source in the Mexican government [1]
- Europe as a software colony (documentary) [2]
The TL;DR is: If a diplomat from the US is at your doorstep and wants to doxx, eh... talk to, your CEO, you're doing exactly the right thing.
Another important factor is that gov workers rarely have enough skills to run OSS software, they are understaffed. And, it is difficult to integrate OSS with the existing systems.
Finally there is a question about responsibility and control. If you get a 0-day in OSS, who will patch it and who has the rights to push that patch? It is about managing risks.
If you think large entities always do the efficient and rational thing, can you explain why governments of countries that are not the USA depend on software that is controlled by a hostile superpower?
By no means I would call them "good", but what they can do?
Delete your repo? Firstly, why would they do that? Secondly, just a backup.
>Selfhost your repo, that's not that hard.
Maybe this was true a few years ago (spoiler: no), but now, in the era of AI, shitstorm it became extremely hard.
Crawlers will constantly DDoS your servers and AI-powered not will continuously try to register to your platform.
See, for example, this: https://outage.sr.ht/ or this: https://drewdevault.com/2025/03/17/2025-03-17-Stop-externali...
When they are in a position of power, they can also gatekeep access to other people's repositories, not just your own.
"probably some contributor was geolocated in a sanctioned region" - https://mastodon.social/@organicmaps/114155428924741370
Well, he's not a fan of GitHub pull request as per the last decade.
https://github.com/torvalds/linux/pull/17#issuecomment-56546...
> But other parts are done really really well.
> I think github does a stellar job at the actual hosting part. I really do. There is no question in my mind that github is one of the absolute best places to host a project. It's fast, it's efficient, it works, and it's available to anybody.
> That's wonderful. I think github is absolutely lovely in many respects.
> And that then makes me really annoyed at the places where I think github does a subpar job: pull requests and committing changes using the web interface.