8 ms·

How Azure scaled to 2,000 employees on GitHub

157 points by us0r 11y ago

stephenr 11y ago
The "inviting a person to the org" issue sounds like a failing on the GH side. Why can't you just invite someone by email and let them choose the account to use the invite with (or create one)??
- jedberg 11y ago
  You send me an invite. I choose to use it with my account that I set up while working at your competitor. Now your competitor potentially has access. At least the way they do it now gives some control to the org as to who has access to their account. It's inconvenient but it biases towards making on boarding hard to make control and off boarding easier. Also, GitHub wants to avoid the same person having multiple accounts. Their focus is the developer, not the org. So they want all your work to be associated with you. I still have stuff on my account that is associated with Netflix and reddit. Because the account is tied to my personal account, those orgs can never "remove" my contribution.
  - adrianN 11y ago
    A malicious employee can simply send the code to the competitor. There is no need to set up an account that is controlled by the competitor to evade access protections.
    - johncolanduoni 11y ago
      I think the point is that in this way it can happen without the employee intending it to happen.
      - stephenr 11y ago
        How though? Can someone explain a situation where a GH organisation automatically gets access to another organisations' repos through a shared individual member?
  - crandycodes 11y ago
    This is pretty much the answer. GitHub identity <> Corporate identity. Jeff's portal helps join those two, so that permissions & legal can be handled automatically. If you ever contributed to a Microsoft Org owned repo, you'll get a bot asking you to sign the CLA and tagging your PRs DNM until you do. When I leave Microsoft, if I make any PRs later on (I'll probably end up using a few of these projects later on), they'll have removed me from Org and listed me as a non-MSFT, so I'd have to sign the CLA. This portal is really nice compared to the previous system, which was send an email to someone and wait for them to get to it. :)
  - stephenr 11y ago
    How does the competitor get access to your repo/org via a users account?
- eli 11y ago
  At least they fixed the invite interface so that you can search for someone by name or email address. Previously you could only add a user to your org by knowing their GH username. I was always paranoid I was going to typo and release my code to some random user.
- jeffwilcox 11y ago
  In the past GitHub had a more open workflow (you just added people directly), but I think that was problematic... For a while we hacked around this problem by letting third party associates "invite themselves" using a one-time use token in our portal, but we moved away from that since we no longer join externals to the org. We're thinking of bringing it back, though, for "Outside Collaborators".
nikolay 11y ago
Coming from a custom Gitolite [0] setup where I was able to protect branches and reject commits and do other basic or complex stuff with ease, GitHub looks like a joke. Their "improved" permissioning made me laugh. It doesn't even show signed commits, tags, and branches! Simply put, I like the "Hub", I hate the "Git" in GitHub. [0] https://github.com/sitaramc/gitolite https://github.com/sitaramc/gitolite
- menacingly 11y ago
  This is voted down, but my organization found the Github pricing system awkward as hell, and we were competent enough to use Git without a condom, so Gitolite was a great fit for us.
  - x1024 11y ago
    Yes, charging per repository is nothing short of predatory. It means that every scratch project and every prototype needs to be deleted - or paid for in perpetuity. It's even worse for agencies and contractors, since for them changing projects often is a natural part of business.
    - ryanjshaw 11y ago
      Even as a developer working on my first open source project I find the model a huge turn-off. I want to keep my repo private for now and it appears I have to pay. Instead I'm using Bitbucket which charges by the user -- far more reasonable model IMO.
      - jeffwilcox 11y ago
        Yeah, we're sort of in this odd space: GitHub has a lot of us "big tech" happy to be in a space with a lot of people collaborating, but we're having to spend pretty big in order to be productive.
    - wyldfire 11y ago
      Hmm. I had thought GH-Enterprise was monthly per-developer. Per repository sounds odd. So each fork is paid for independently?
abluecloud 11y ago
Slight digression but I find it a bit odd they've used Safari in their screenshots.
- allendoerfer 11y ago
  It's the new Microsoft, they do OpenSource, too, and make awesome Laptops.
- skyyler 11y ago
  They're selling how great Azure is, not how great Windows/Edge is. I don't find it all that strange.
- jmspring 11y ago
  When working with open source, sometimes it is best to use the tools appropriate to the projects you are working on or people you are working with. I work in DX/Evangelism at MSFT and a lot of work around containers, etc, at the moment is easier on *nix than it is on Windows (for me). I've got both machines as well as a Windows VM on the Mac if I need something there...
  - Alupis 11y ago
    > When working with open source, sometimes it is best to use the tools appropriate to the projects you are working on or people you are working with Which would be Chrome then (since it dominates browser share), instead of Safari. Perhaps the person making the screenshots wanted to use a *nix system, but didn't want to be caught showing off the competition's product.
    - jeffwilcox 11y ago
      I wasn't trying to make a browser politics statement in the post, but am glad to be able to work in the new Microsoft that is proud of whatever platform and tool works - including employees. Personally I use Safari when I'm on battery all day (coffee shops, etc.), Chrome when I need multiple profile support, and I tend to split Chrome/Edge when in my Windows VM.
deleted 11y ago
[deleted]
epaulson 11y ago
I've used this as an outsider to do some work with Microsoft and it's really slick. I wish the Visual Studio Online team would look a little harder at Github and steal more of its Issues experience, and have something more lightweight than the backlog monster they've got now. I think it's not uncommon for VSO users to keep a Github sync of their code so they can use GH for issues and day to day code and VSO for builds and deploys.
- partiallypro 11y ago
  I use VSO for the free private repos, but really it needs to be overhauled in a number of ways...a name change itself would go a long way. "Visual Studio Online" sounds like I'm actually going to be using an online version of VS like Office 365's online apps...but nope. It's a bit of a marketing nightmare. Even the guys from Microsoft were complaining about the naming making it hard to make people understand when I was at Build this year.
  - johngossman 11y ago
    We just renamed it to "Visual Studio Team Services" last week. Yeah, everybody assumed it was an online version of Visual Studio. https://www.visualstudio.com/en-us/products/visual-studio-team-services-vs.aspx https://www.visualstudio.com/en-us/products/visual-studio-te...
    - partiallypro 11y ago
      Christ that name is still bad. They need to drop the Visual Studio part. You don't even need Visual Studio to use it.
    - junto 11y ago
      Isn't it just a version of TFS online using a SAAS billing concept? Wouldn't "TFS Online" be a better description if you want to stock with the Microsoft unimaginative naming policy? At least it says exactly what it is. My personal opinion is that Microsoft should just go with the internal names. They are more interesting and memorable for customers. They are often one word, rather than five. Visual Studio Team System Online 2020 Developer Edition.... Sorry, started snoring after 3 words. https://en.m.wikipedia.org/wiki/List_of_Microsoft_codenames https://en.m.wikipedia.org/wiki/List_of_Microsoft_codenames
ossreality 11y ago
The tool is really well done and impressive. Yes, it exists to work around gaps in GitHub's functionality, but it's not like we're going to self host git repos and use gitolite...
- jeffwilcox 11y ago
  My hope is that I can delete this in the future. It's a scary place to be in when we're 1) dependent on a third party, 2) we have to follow GitHub and the API down the rabbit whole, and 3) we are just trying to enable our team to get going fast and hope in time GitHub can just give us all the right tools that check at least some boxes we need, i.e. very granular management to delegate decision making even more.
  - EvanPlaice 11y ago
    What's so scary about it? Any data that is stored on GitHub (ex issues, PRs) can be pulled down via the REST API. So, it should be relatively easy to build a migration tool or alternate UI if necessary.
- cat-dev-null 11y ago
  Oh man... reminds me of svn2git migration I did, an integration of gitolite, deploying on-prem AD, jenkins, JIRA, Confluence and all working together a couple years back. Getting the LDAP query just right is 90% of it. These days: - JIRA - for internal, complex project management because the plugins are really good - Confluence - wiki w/ plugins - Asana - Slack/FlowDock - waay better than digging through HipChat/Campfire, IRC - Hubot - integrations/CLI for everything - jenkins - for private CI - Github enterprise - or maybe Gitlab if one can get away with it - Google Apps for Work / Zoho - because of AD integrations PS: When deploying a portal page whether internally or for a client, a bespoke 404 page with either a game or random funny images is the way to go. Maybe a humans.txt too.
  - monksy 11y ago
    What about Bitbucket?
brugidou 11y ago
We are using https://github.com/rapid7/github-connector https://github.com/rapid7/github-connector to sync github org users with an internal AD.
tacos 11y ago
AWS has a horse in this race. Odd not to see it mentioned yet... https://aws.amazon.com/codecommit/pricing/ https://aws.amazon.com/codecommit/pricing/
- mwfj 11y ago
  And they even named their product in a way so that people could understand what it is about! That is so unlike them!

157 points by us0r 11y ago

The "inviting a person to the org" issue sounds like a failing on the GH side. Why can't you just invite someone by email and let them choose the account to use the invite with (or create one)??

jedberg 11y ago
You send me an invite. I choose to use it with my account that I set up while working at your competitor. Now your competitor potentially has access. At least the way they do it now gives some control to the org as to who has access to their account. It's inconvenient but it biases towards making on boarding hard to make control and off boarding easier. Also, GitHub wants to avoid the same person having multiple accounts. Their focus is the developer, not the org. So they want all your work to be associated with you. I still have stuff on my account that is associated with Netflix and reddit. Because the account is tied to my personal account, those orgs can never "remove" my contribution.
- adrianN 11y ago
  A malicious employee can simply send the code to the competitor. There is no need to set up an account that is controlled by the competitor to evade access protections.
  - johncolanduoni 11y ago
    I think the point is that in this way it can happen without the employee intending it to happen.
    - stephenr 11y ago
      How though? Can someone explain a situation where a GH organisation automatically gets access to another organisations' repos through a shared individual member?
- crandycodes 11y ago
  This is pretty much the answer. GitHub identity <> Corporate identity. Jeff's portal helps join those two, so that permissions & legal can be handled automatically. If you ever contributed to a Microsoft Org owned repo, you'll get a bot asking you to sign the CLA and tagging your PRs DNM until you do. When I leave Microsoft, if I make any PRs later on (I'll probably end up using a few of these projects later on), they'll have removed me from Org and listed me as a non-MSFT, so I'd have to sign the CLA. This portal is really nice compared to the previous system, which was send an email to someone and wait for them to get to it. :)
- stephenr 11y ago
  How does the competitor get access to your repo/org via a users account?
eli 11y ago
At least they fixed the invite interface so that you can search for someone by name or email address. Previously you could only add a user to your org by knowing their GH username. I was always paranoid I was going to typo and release my code to some random user.
jeffwilcox 11y ago
In the past GitHub had a more open workflow (you just added people directly), but I think that was problematic... For a while we hacked around this problem by letting third party associates "invite themselves" using a one-time use token in our portal, but we moved away from that since we no longer join externals to the org. We're thinking of bringing it back, though, for "Outside Collaborators".

nikolay 11y ago

Coming from a custom Gitolite [0] setup where I was able to protect branches and reject commits and do other basic or complex stuff with ease, GitHub looks like a joke. Their "improved" permissioning made me laugh. It doesn't even show signed commits, tags, and branches! Simply put, I like the "Hub", I hate the "Git" in GitHub. [0] https://github.com/sitaramc/gitolite https://github.com/sitaramc/gitolite

menacingly 11y ago
This is voted down, but my organization found the Github pricing system awkward as hell, and we were competent enough to use Git without a condom, so Gitolite was a great fit for us.
- x1024 11y ago
  Yes, charging per repository is nothing short of predatory. It means that every scratch project and every prototype needs to be deleted - or paid for in perpetuity. It's even worse for agencies and contractors, since for them changing projects often is a natural part of business.
  - ryanjshaw 11y ago
    Even as a developer working on my first open source project I find the model a huge turn-off. I want to keep my repo private for now and it appears I have to pay. Instead I'm using Bitbucket which charges by the user -- far more reasonable model IMO.
    - jeffwilcox 11y ago
      Yeah, we're sort of in this odd space: GitHub has a lot of us "big tech" happy to be in a space with a lot of people collaborating, but we're having to spend pretty big in order to be productive.
  - wyldfire 11y ago
    Hmm. I had thought GH-Enterprise was monthly per-developer. Per repository sounds odd. So each fork is paid for independently?

abluecloud 11y ago

Slight digression but I find it a bit odd they've used Safari in their screenshots.

allendoerfer 11y ago
It's the new Microsoft, they do OpenSource, too, and make awesome Laptops.
skyyler 11y ago
They're selling how great Azure is, not how great Windows/Edge is. I don't find it all that strange.
jmspring 11y ago
When working with open source, sometimes it is best to use the tools appropriate to the projects you are working on or people you are working with. I work in DX/Evangelism at MSFT and a lot of work around containers, etc, at the moment is easier on *nix than it is on Windows (for me). I've got both machines as well as a Windows VM on the Mac if I need something there...
- Alupis 11y ago
  > When working with open source, sometimes it is best to use the tools appropriate to the projects you are working on or people you are working with Which would be Chrome then (since it dominates browser share), instead of Safari. Perhaps the person making the screenshots wanted to use a *nix system, but didn't want to be caught showing off the competition's product.
  - jeffwilcox 11y ago
    I wasn't trying to make a browser politics statement in the post, but am glad to be able to work in the new Microsoft that is proud of whatever platform and tool works - including employees. Personally I use Safari when I'm on battery all day (coffee shops, etc.), Chrome when I need multiple profile support, and I tend to split Chrome/Edge when in my Windows VM.

deleted 11y ago

[deleted]

epaulson 11y ago

I've used this as an outsider to do some work with Microsoft and it's really slick. I wish the Visual Studio Online team would look a little harder at Github and steal more of its Issues experience, and have something more lightweight than the backlog monster they've got now. I think it's not uncommon for VSO users to keep a Github sync of their code so they can use GH for issues and day to day code and VSO for builds and deploys.

partiallypro 11y ago
I use VSO for the free private repos, but really it needs to be overhauled in a number of ways...a name change itself would go a long way. "Visual Studio Online" sounds like I'm actually going to be using an online version of VS like Office 365's online apps...but nope. It's a bit of a marketing nightmare. Even the guys from Microsoft were complaining about the naming making it hard to make people understand when I was at Build this year.
- johngossman 11y ago
  We just renamed it to "Visual Studio Team Services" last week. Yeah, everybody assumed it was an online version of Visual Studio. https://www.visualstudio.com/en-us/products/visual-studio-team-services-vs.aspx https://www.visualstudio.com/en-us/products/visual-studio-te...
  - partiallypro 11y ago
    Christ that name is still bad. They need to drop the Visual Studio part. You don't even need Visual Studio to use it.
  - junto 11y ago
    Isn't it just a version of TFS online using a SAAS billing concept? Wouldn't "TFS Online" be a better description if you want to stock with the Microsoft unimaginative naming policy? At least it says exactly what it is. My personal opinion is that Microsoft should just go with the internal names. They are more interesting and memorable for customers. They are often one word, rather than five. Visual Studio Team System Online 2020 Developer Edition.... Sorry, started snoring after 3 words. https://en.m.wikipedia.org/wiki/List_of_Microsoft_codenames https://en.m.wikipedia.org/wiki/List_of_Microsoft_codenames

ossreality 11y ago

The tool is really well done and impressive. Yes, it exists to work around gaps in GitHub's functionality, but it's not like we're going to self host git repos and use gitolite...

jeffwilcox 11y ago
My hope is that I can delete this in the future. It's a scary place to be in when we're 1) dependent on a third party, 2) we have to follow GitHub and the API down the rabbit whole, and 3) we are just trying to enable our team to get going fast and hope in time GitHub can just give us all the right tools that check at least some boxes we need, i.e. very granular management to delegate decision making even more.
- EvanPlaice 11y ago
  What's so scary about it? Any data that is stored on GitHub (ex issues, PRs) can be pulled down via the REST API. So, it should be relatively easy to build a migration tool or alternate UI if necessary.
cat-dev-null 11y ago
Oh man... reminds me of svn2git migration I did, an integration of gitolite, deploying on-prem AD, jenkins, JIRA, Confluence and all working together a couple years back. Getting the LDAP query just right is 90% of it. These days: - JIRA - for internal, complex project management because the plugins are really good - Confluence - wiki w/ plugins - Asana - Slack/FlowDock - waay better than digging through HipChat/Campfire, IRC - Hubot - integrations/CLI for everything - jenkins - for private CI - Github enterprise - or maybe Gitlab if one can get away with it - Google Apps for Work / Zoho - because of AD integrations PS: When deploying a portal page whether internally or for a client, a bespoke 404 page with either a game or random funny images is the way to go. Maybe a humans.txt too.
- monksy 11y ago
  What about Bitbucket?

brugidou 11y ago

We are using https://github.com/rapid7/github-connector https://github.com/rapid7/github-connector to sync github org users with an internal AD.

tacos 11y ago

AWS has a horse in this race. Odd not to see it mentioned yet... https://aws.amazon.com/codecommit/pricing/ https://aws.amazon.com/codecommit/pricing/

mwfj 11y ago
And they even named their product in a way so that people could understand what it is about! That is so unlike them!