6 ms·

All these ideas like "let's fetch our deps directly from github" sound good until github is not down.

ilghiro 11y ago
Yeh it's definitely preferable to have one of the two developers your small startup can probably afford spending a good portion of their time rolling out, securing and maintaining your own infrastructure
- biggestbob 11y ago
  Yeh cos those are two only two options available. Good thinking.
- bad_user 11y ago
  GitHub is not meant for distributing dependencies. Maven Central on the other hand is, the difference being that it is mirrored and if repo1.maven.org goes down, it's not a big deal and your project can still be built and deployed.
  - wereHamster 11y ago
    .. until they become a target of a DDoS. Also, if GitHub is down you can still fetch your dependencies from somewhere else.
    - JumpJumpJump 11y ago
      You have not understood the concept of 'mirrored'.
    - chopman 11y ago
      Well I guess all mirrors could get targeted. Also, what stops github from getting mirrors themselves?
- deleted 11y ago
  [deleted]
- satanrepents 11y ago
  An internal GitLab install isn't that time consuming to maintain. Also: dat false dichotomy.
- modarts 11y ago
  False dilemma much? Private versions of most dependency repos exist (npm, maven, etc)
Retr0spectrum 11y ago
You have to fetch them from somewhere. If you are fetching deps from multiple sources, there is a much higher chance of at least one source being down.
- raverbashing 11y ago
  You can fetch them. Once, then cache them
  - OJFord 11y ago
    As well you could if fetching from Github?
- JustSomeNobody 11y ago
  Not being able to fetch one is just as bad as not being able to fetch all.
  - Retr0spectrum 11y ago
    That was my point.
Spiritus 11y ago
That applies to an in-house solution as well.
- chinathrow 11y ago
  Inhouse DDoS seems less likely though, at least ;)
  - Spiritus 11y ago
    Sure, but I didn't specifically mean DDoS attacks, more of the human error kind. People tend to be more trigger happy with changes when it's "only" an internal system.
nadams 11y ago
Or "let's move our entire business workflow to github!". Doh! This is why you should run indefero/srchub/gitlab or any of the other self hosted source code control apps.
- tericho 11y ago
  I would argue from personal experience there's almost the same (or higher) likelihood of internal sources going down for other reasons since most people's IT departments aren't as efficient as GitHub's.
- bdcravens 11y ago
  For most, the cost of setting up and maintaining those systems than they lose when Github is down.
  - nadams 11y ago
    It all depends on your infrastructure. I once worked in a group that used SVN for SCM, mediawiki for wiki and Trac for tickets. I voiced my opinion about that setup many times but management felt that was the most efficient way to work... Products like indefero/srchub have all of that from a single interface and it's very easy to maintain. I don't know how easy gitlab is to install/maintain - perhaps sytse can pop in and go into detail about that. Assuming the system works the maintenance would be minimal.
    - sytse 11y ago
      You called me :) Anyway, installing GitLab should take under 5 minutes on a fresh Ubuntu 14.04 server with https://about.gitlab.com/downloads/ https://about.gitlab.com/downloads/ And then you can set a daily nightly cron for: sudo apt-get update sudo apt-get install gitlab-ce Don't forget to take snapshots of your server for backups.
      - nadams 11y ago
        > And then you can set a daily nightly cron for: sudo apt-get update sudo apt-get install gitlab-ce AHHHH!!!! Don't recommend doing that. Only those who are crazy do that. Imagine waking up in the morning and your SCM system is broken due to an update that was automatically applied - I wouldn't want a sysadmin (or developer) to see that before their first cup of coffee. When you update - does it automatically apply migrations or other database upgrades that might be necessary?
JustSomeNobody 11y ago
This was a controversial/contentious statement during the last DDOS attack. I wonder if any minds have changed.
bdcravens 11y ago
I'd venture to say that more downtime occurs via local issues (Internet, hardware, virus) than Github.

Yeh it's definitely preferable to have one of the two developers your small startup can probably afford spending a good portion of their time rolling out, securing and maintaining your own infrastructure

biggestbob 11y ago
Yeh cos those are two only two options available. Good thinking.
bad_user 11y ago
GitHub is not meant for distributing dependencies. Maven Central on the other hand is, the difference being that it is mirrored and if repo1.maven.org goes down, it's not a big deal and your project can still be built and deployed.
- wereHamster 11y ago
  .. until they become a target of a DDoS. Also, if GitHub is down you can still fetch your dependencies from somewhere else.
  - JumpJumpJump 11y ago
    You have not understood the concept of 'mirrored'.
  - chopman 11y ago
    Well I guess all mirrors could get targeted. Also, what stops github from getting mirrors themselves?
deleted 11y ago
[deleted]
satanrepents 11y ago
An internal GitLab install isn't that time consuming to maintain. Also: dat false dichotomy.
modarts 11y ago
False dilemma much? Private versions of most dependency repos exist (npm, maven, etc)

Retr0spectrum 11y ago

You have to fetch them from somewhere. If you are fetching deps from multiple sources, there is a much higher chance of at least one source being down.

raverbashing 11y ago
You can fetch them. Once, then cache them
- OJFord 11y ago
  As well you could if fetching from Github?
JustSomeNobody 11y ago
Not being able to fetch one is just as bad as not being able to fetch all.
- Retr0spectrum 11y ago
  That was my point.

Spiritus 11y ago

That applies to an in-house solution as well.

chinathrow 11y ago
Inhouse DDoS seems less likely though, at least ;)
- Spiritus 11y ago
  Sure, but I didn't specifically mean DDoS attacks, more of the human error kind. People tend to be more trigger happy with changes when it's "only" an internal system.

nadams 11y ago

Or "let's move our entire business workflow to github!". Doh! This is why you should run indefero/srchub/gitlab or any of the other self hosted source code control apps.

tericho 11y ago
I would argue from personal experience there's almost the same (or higher) likelihood of internal sources going down for other reasons since most people's IT departments aren't as efficient as GitHub's.
bdcravens 11y ago
For most, the cost of setting up and maintaining those systems than they lose when Github is down.
- nadams 11y ago
  It all depends on your infrastructure. I once worked in a group that used SVN for SCM, mediawiki for wiki and Trac for tickets. I voiced my opinion about that setup many times but management felt that was the most efficient way to work... Products like indefero/srchub have all of that from a single interface and it's very easy to maintain. I don't know how easy gitlab is to install/maintain - perhaps sytse can pop in and go into detail about that. Assuming the system works the maintenance would be minimal.
  - sytse 11y ago
    You called me :) Anyway, installing GitLab should take under 5 minutes on a fresh Ubuntu 14.04 server with https://about.gitlab.com/downloads/ https://about.gitlab.com/downloads/ And then you can set a daily nightly cron for: sudo apt-get update sudo apt-get install gitlab-ce Don't forget to take snapshots of your server for backups.
    - nadams 11y ago
      > And then you can set a daily nightly cron for: sudo apt-get update sudo apt-get install gitlab-ce AHHHH!!!! Don't recommend doing that. Only those who are crazy do that. Imagine waking up in the morning and your SCM system is broken due to an update that was automatically applied - I wouldn't want a sysadmin (or developer) to see that before their first cup of coffee. When you update - does it automatically apply migrations or other database upgrades that might be necessary?

JustSomeNobody 11y ago

This was a controversial/contentious statement during the last DDOS attack. I wonder if any minds have changed.

bdcravens 11y ago

I'd venture to say that more downtime occurs via local issues (Internet, hardware, virus) than Github.