Hacker News Reader

Comment by MollyR | Hacker News Reader

I'm a little paranoid about my code. I want to like github's private repos, but I don't want my code to be stolen by github's internal employees.

I've heard that their employees do shady things on occasion (2nd hand knowledge).

View on HN

Employees of any company in the world can do shady things.

You need to trust your server hosting company, your server OS vendor, your own workstation's software, your OS, all your firmware...

If GitHub employees stole proprietary code from you, and commercialized it, proving "prior art" and theft should be extremely easy for you. IANAL, but it's not something I'd worry about with most companies hosting on Github.

> proving "prior art" and theft should be extremely easy for you

If you even find out, and if you do it would cost a lot of time and money to reclaim what is yours. It's not hard to setup your own servers, it's becoming a lost art in today's cloud microcosm but its really not hard to do yourself and do it right.

I agree that self-hosting can be cheaper than lawyers. I self-host all my own stuff, but I still understand how it's better for some businesses to pay for cloud services, instead.

> your server OS vendor, your own workstation's software, your OS, all your firmware

They all stake their reputation so in theory they have checks in place to minimize rogue behavior (in practice though they are often clueless, see starfish). Also they put their code/hardware into public so they normally can't target individuals without fearing others to discover their attempts.

Contrast this to rogue employees at Github who can copy repositories for their old colleagues from college to give them an edge and the only difference you will ever see manifested is competitors seemingly always having timely answers to any new features you are about to unveil in your solution, because they were too smart to copy/paste your code directly.

If you want a similar solution to GH instead of just a bare Git installation, you could look into running your own GitLab instance. Their software is open source and freely available. Of course, that way you would have to trust your hoster unless you are running your own in-house server.

Thanks for mentioning GitLab this_user. I would be happy to answer any questions about GitLab.

Just a quick question: why are the git-annex and branch protection available only in EE SKU?

Branch protection is also available in the open source GitLab CE. We made git-annex an enterprise feature because it is one of the few things that came up more from larger organizations, smaller ones tend to use a shared Dropbox.

Oops, sorry for confusion, I've meant to ask about the Rebase merge requests before merge feature, not branch protection.

We're pretty comfortable with rebase before merge being part of EE only. Someone suggested making an option to select the type of merge you want (ff, no-ff, log, rebase or squash). If someone would submit a good implementation of that and reference this comment we can open source everything. Edit: removed the work probably to make this a firm promise.

Anecdote: I am an independent game developer who views git-annex as unproven, but who would also love to get away from Perforce. However, Perforce is free for up to 20 users, and right now my side project has one other person working on it - $400 for a year of GitLab is a non-starter.

More generally, I am curious how many of the "larger organizations" to which you refer in this context (clients interested in git-annex) are in the games industry, and how seriously interested your company is in trying to cater to that industry's needs? (Lots of game engines enjoy built-in first class support for Perforce due to how established it is in that vertical.)

Some of the larger organizations interested in git-annex in GitLab are in the game industry but most are not.

I wonder whether something like [0] would work, where the repository is encrypted on push and decrypted on pull. Might be against Github's terms of use, though.

[0]: https://rovaughn.github.io/2015-2-9.html

that's a really cool idea.

Why would that be against github TOS? Encrypted files in git are not exactly unusual.

My thinking was that it's effectively a private repository (albeit publicly visible), so it would subvert their business model.

they were talking about it being a private repo anyway that they were worried about.

Well, it'd be pretty shitty. Diffs would be binary and practically useless; merges would have to be entirely manual. Github would lose more in brand trust than they would gain in saved costs on those repos (or lost revenue).

Or perhaps

    https://github.com/AGWA/git-crypt

Statistically speaking, without knowing anything about you, your code is probably not "omg this code is so awesome I will risk losing my job/business because I must possess this code" kind of awesome.

If it is, what are the chances of somebody figuring it out when there are literally several million git repos on github.

Just be careful. Don't name your repo something like "Cure for Cancer" or "Warp Drive Firmware", etc. and you will probably be in good shape.

> I've heard that their employees do shady things on occasion (2nd hand knowledge).

Care to elaborate?

But this is why they offer Github Enterprise. AFAIK it's hosted on your own servers.

Reply on news.ycombinator.com