Cue the age old argument chain about outsourcing responsibility vs having control of downtimes.
I’m tired of them now, anyone using hosted solutions should know this by now and they’ve made that choice.
Personally I believe people underestimate how easy it is to host your own services.
But I’m sick of having the conversation over and over, if people aren’t willing to investigate then, what’s the saying: “you can lead a horse to water but you can’t make them drink”
But the argument isn't static. GitHub has become much more of a target to large-scale attacks as it's grown in popularity and has become mission critical to so many companies and projects.
Security risk isn't a one-and-done decision. It's a changing landscape and, arguably, there are far too many eggs in the GitHub basket for this not to be something people might want to think twice about now.
GitHub also arguably just has a good product that's a good fit for a lot of use-cases, regardless of if there's better options.
Yeah, you might be able to self-host gitlab/gitea/etc but their free offering for organizations is so good that for my 30 commits/week open source project, I can deal with half an hour of downtime once in a while.
Combined with free hosting, it's really not that much of a stretch that people are willing to put up with this, especially as there have been periods of time with less outages before, though that's been a while now.
The UI is much nicer than gerrit (or at least the gerrit UI I knew from 5-6 years ago not sure if they have changed). It’s more “GitHub”-y. It’s a bit confusing at first but once you get into it it’s pretty damn powerful.
Side note, I honestly seriously think we need much better tooling than just these 2 for code reviews.
I'm building a much better code review for tool for GitHub, check out https://codeapprove.com
It combines concepts from GitHub, Gerrit, and other good review tools out there to make it easy and fast to reach consensus (which is what it's all about).
If you want to hear more you can email me at sam at habosa dot com
Gerrit has gotten a new UI in the last few years as far as i know. I wouldnt nesecarily describe it as pretty, but its my personal favourite review system
self hosted won't insulate you from your VCS instance failing.
I used to work at a medium-sized company with Gitlab 8 years ago, it was running into several issues and required frequent maintenance.
Well going all in on GitHub / GitHub Actions now really sounds like a bad idea. Even some others had issues [0] and had no external backup plan to counter GitHub's regular outages.
The best example to learn from is ReactOS who while has moved to GitHub they at least have a self-hosted backup just in case GitHub falls over. [1]
For the ones who are not on GitHub and are self-hosting (OpenBSD, Mozilla, Linux Kernel Project, GNOME, xfce, wireguard) I don't hear any complaints from them.
To give another data point, in my company we're running Gitlab (we started 3,4 years ago maybe?) with some pretty heavy use of CI and we've had no issues, even with automatic upgrades enabled (we have tested backups, we're not crazy).
Confirmed, on a ubuntu host GitLab is actually the product that I have the best self hosted experience with. Apt packages running their Chef Cookbooks always impressive!
Not even that necessarily, control of downtime is also worth something. i.e. lots of downtime is tied to system changes/updates, especially in a conservative setup, which you can schedule as appropriate on a self-hosted setup.
Someone said the same thing to me more than a year ago [0] and here we are the same issues once again.
This is why it makes no sense to go 'all in' or try to "centralize everything to GitHub". At least (if you're a company or an organisation) have a self-hosted backup and don't jump into the 'goin all in' hype train.
I completely agree with you, to reiterate what I said last time we had this discussion 3 months ago:
> I wouldn't call it prudent to go all-in on any cloud service [0]
I've never used Github as anything more than a managed git service with a nice web interface. At work, any time the topic of moving our CI/wiki/project management/issue tracking onto GitHub has come up, I've been vocally opposed.
If GitHub went down, and didn't come back up, it would be trivial to migrate to Gitlab/CodeCommit/Bitbucket. The most time consuming thing would be setting up new web hooks for our CI.
Time to reset the counter once again. Now everything there is degraded performance. Oh dear.
Consider a self-hosted alternative or have one as a backup like I have said before.
[0] https://news.ycombinator.com/item?id=27192869
[1] https://news.ycombinator.com/item?id=27172443
[2] https://news.ycombinator.com/item?id=26666843
[3] https://news.ycombinator.com/item?id=26667101