5 ms·

There's something slightly concerning about ceding responsibility for distributing the world's open-source projects from a family of strong independent reposito

by _bxg1 8y ago

There's something slightly concerning about ceding responsibility for distributing the world's open-source projects from a family of strong independent repositories to a centralized platform owned by a tech giant.

sho_hn 8y ago
Yes, but that's not a new concern - to some, GitHub has always represented an anathema to what git was supposed to be and bring. Centralization at a proprietary vendor, instead of open systems interacting. Then locking people in further by network effect and adding centralized products around git. That it's become so popular many people equate GitHub with git adds insult to injury. I completely understand why this all happened (centralization is just so easy and convenient; federation is hard), and it was probably inevitable in its timeframe, but I also wish it wasn't so. It's not quite what we imagined when we made the leap to dscms in the early aughts. All the good stuff is still in there, though, and it's still as possible as ever to do different things, so it's not a bleak situation.
- beenBoutIT 8y ago
  *When the tech giant is Microsoft.
- tedivm 8y ago
  When Linus introduced git he didn't seem to care at all about decentralizing from a political standpoint, just from a "I can work on this from my laptop without an internet connection" point of view.
  - toyg 8y ago
    That's the thing - git was fundamentally a tool borne with an asynchronous workflow in mind: I work on X, Alice works on Y, Bob works on Z, and the eventual merging (which might happen days or weeks later) should be as simple as possible - without worrying about who checked out what. Git was dropped in the "distributed VCS" bucket, but decentralization was a secondary effect of the workflow Linus wanted to achieve. GitHub then took the server-side bits of git, and effectively built a web-based interface with social features on top. Git itself is still very much a decentralized tool (just add a new remote and off you go), only the social GUI is centralized. It would be cool if somebody could build "Github over P2P" (I guess with a bit of blockchain, because hype). At that point the entire stack would be fully decentralized.
    - soulofmischief 8y ago
      A git service built on IPFS or something similar would be wicked. It does take quite a bit of engineering (money) to compete with the big boys, however.
      - chupasaurus 8y ago
        The first project provided by DDG to me was Radicle[https://radicle.xyz/ https://radicle.xyz/]
        soulofmischief 8y ago
        rad project allows you to create, checkout, manage, and publish a project, comprised of issues, patch proposals, and a git repo. Well hot dog. And it uses LISP for scripting? Nice. Interesting approach to saving state, too.: One only needs the address of the latest input, the "head", to be able to recover the whole log. The owner of a machine uses an IPNS link to point to the head of the list, and the name of this link is then the name of the machine also. Thanks for sharing that. Definitely going to give it a whirl this weekend.
        toyg 8y ago
        It looks the business but it lacks the single most important feature for popularity: a GUI. GitHub made Git dominant by building a friendly GUI on top of it. Before, it was just another player in a relatively crowded field of CLI DVCSs. Obviously it is not essential to get stuff done, but anything with any ambition of generating network effects definitely needs a GUI. The other thing that seems to be lacking, from a quick reading of the docs, is a way to generate pull requests (or "patches" in Rad terms) from a branch, and then merge them on another branch. Obviously you can do it manually in git, but GH is definitely a superior experience.
        soulofmischief 8y ago
        > It looks the business but it lacks the single most important feature for popularity: a GUI. It's a matter of perspective. My first thought when reading the docs was, "All someone needs to do is slap a GUI on this baby. Good thing the designers made a simple CLI that it could interface with." They've already done most of the heavy lifting. At this point a GUI is trivial to add. "Terminal–first" doesn't imply "terminal-only". In fact, quite the opposite. I wouldn't be so quick to assume that they don't envision a GUI at some point-- Why not contribute to the project and get the ball rolling? The patch command [0] has a propose subcommand that describes what you're talking about. It generates a patch from a commit (on any branch, I presume). This can be applied however you see fit. And the checkout subcommand even lets you generate branches from patches similar to GH. What seems to be missing? [0] https://radicle.xyz/docs/#rad-cli-reference https://radicle.xyz/docs/#rad-cli-reference
- arugulum 8y ago
  I have the opposite view: the success of GitHub and the growth of code being open by default with everything running through git has probably brought more people into the git ecosystem than would have otherwise. I primarily use GitHub, but whenever I need something that I need to run myself I know I can fairly seamlessly switch over to something like GitLab. For example, if GitHub ever started using a very proprietary application, I would just switch over to using regular git, and I'm guessing many others would too.
  - jeena 8y ago
    I don't believe you would. It's more probable that you'd install that proprietary application to get the features which standard git lacks at that time.
  - keytarsolo 8y ago
    I am with you on this one. I use GitHub to share code, and participate in projects. I use my own GitBucket instance for anything purely personal that I don't want to lose, but don't want to make nice or document and then at work we use GitLab. I'm all in on git in a way that I might not have been without GitHub making it so huge. Without GitHub, we'd probably all be using git at home but SVN at the office.
- soulofmischief 8y ago
  I just wish a PR and issue tracking system with pluggable credentials had been simultaneously developed and implemented alongside git, so that I could migrate my issue and PR history, or plug them in to multiple hosts. I prefer Gitlab for a multitude of reasons but since all the action takes place on Github, my Gitlab account just serves as a repo mirror.
  - chriswarbo 8y ago
    Git has always had integration with email, which makes it compatible with a vast amount of existing servers, clients, credential systems, Web UIs, scripting languages, etc. As an example I think SourceHut is mostly based around email (which it provides a Web UI for) https://sourcehut.org https://sourcehut.org
yarg 8y ago
Hopefully something along these lines will also be added to Gitab. I share your concerns, but I've also long had the feeling that both NPM and Maven are a security disaster in the making. Having the dependencies being published from the same place that stores the actual code, gives me a little hope that things will improve from the security and design perspective.
- gritzko 8y ago
  ...by adding a single point of failure?
  - yarg 8y ago
    No, my thoughts are that we need better mechanisms to validate our dependencies. So far I believe that Maven and NPM have failed to deliver on that front. The dependencies being resolved from the code store provides a decent mechanism to resolve that issue. But as long as it's being done on closed software, it's going to be hard to move towards a standard.
rasz 8y ago
Microsoft is just trying hard to achieve Antitrust(movie) villain goals, Github plus "telemetry" is a pretty good coverage.
- soulofmischief 8y ago
  Github is primarily composed of public data that Microsoft could scrape without a $7.5B investment. There are a lot of moving parts to this and it's impossible to distill it down to a single sentence or even paragraph.
gouh 8y ago
Ideally I would like the social aspects of GitHub (trending/popular repository, staring projects, notifications, etc.) but with decentralized hosting. Something that would be to GitHub what Mastodon is to Twitter
IfOnlyYouKnew 8y ago
That is, indeed, a fair point of concern. But in practical terms, I would place Github very high in any ranking of good things that happened to open source. It's possible many people have forgotten, or are to young to remember, how the ecosystem worked pre-Github. There was sourceforge, which wasn't quite the disaster it is today, but also not very good. But mostly I remember every project using different, often hand-rolled systems. PRs had to be sent in by mail. Every project had their own conventions of where to send patches, what formats to use, what additional information to provide etc. Just try figuring out how to get a patch into Debian, which is still where most projects were ca. 2005. I won't wait. I never contributed to OSS pre-Github. These days, I routinely send in a patch for smaller things I encounter a few times per week. Over time, I have also started becoming a more involved contributed to two projects. I doubt this would have happened without the flat learning curve that Github provides. I wouldn't be surprised if both the number of contributors and total contributions to OSS have soared by a factor like 5x even above just the growth in OSS usage, and Github is the obvious reason for it.
zmix 8y ago
This! Hypothetically, and, currently, only hypothetically: If Microsoft is still of the old spirit, then what we see now, would be the biggest "Embrace, Extend, Extinguish" coup, they have ever done. It won't happen now, it won't happen tomorrow. For that, this would be too big of an effort. But Microsoft is trying big to win back the hearts of "The Community" and "The Market". As people, especially developers, have gotten more clever about the computers, since the advent of the web has made it possible, to live in IT without "getting shown" and "taught" by "Big Daddy" type companies, since all and everybody is much more self-organizing these days, there is much more competition to MS, that has been in the past. So they try to get it back, what they have lost. * VSCode, is very sweet and candy, with lots of bells and whistles, major software companies writing plugins for it (the most active being Microsoft). As a programmer's text editor it sits right at the core of every development. VSCode, especially, is attractive to people outside of MS Windows (they might use VisualStudio). I am talking about web- and "App" developers. Mostly frontend or mobile. * By buying Github, they bought the "source of all sources". They won't ever own the code, but as long as they own the popular infrastructure, everybody is playing on their grounds. The next step, in two years, or so, may be the need for a MS account to log into Github. They integrate it. Out of curiosity, what else did MS buy in the last years, that would fit into this pattern?
bartimus 8y ago
It's a good reason to seriously consider Gitlab.
- piotrkubisa 8y ago
  Or https://sourcehut.org/ https://sourcehut.org/ if you are looking for something leaner. Or if you are looking for self-hosted git servers: - https://onedev.io/ https://onedev.io/ - https://gitea.io https://gitea.io / https://gogs.io/ https://gogs.io/

by _bxg1 8y ago

sho_hn 8y ago

Yes, but that's not a new concern - to some, GitHub has always represented an anathema to what git was supposed to be and bring. Centralization at a proprietary vendor, instead of open systems interacting. Then locking people in further by network effect and adding centralized products around git. That it's become so popular many people equate GitHub with git adds insult to injury. I completely understand why this all happened (centralization is just so easy and convenient; federation is hard), and it was probably inevitable in its timeframe, but I also wish it wasn't so. It's not quite what we imagined when we made the leap to dscms in the early aughts. All the good stuff is still in there, though, and it's still as possible as ever to do different things, so it's not a bleak situation.

beenBoutIT 8y ago
*When the tech giant is Microsoft.
tedivm 8y ago
When Linus introduced git he didn't seem to care at all about decentralizing from a political standpoint, just from a "I can work on this from my laptop without an internet connection" point of view.
- toyg 8y ago
  That's the thing - git was fundamentally a tool borne with an asynchronous workflow in mind: I work on X, Alice works on Y, Bob works on Z, and the eventual merging (which might happen days or weeks later) should be as simple as possible - without worrying about who checked out what. Git was dropped in the "distributed VCS" bucket, but decentralization was a secondary effect of the workflow Linus wanted to achieve. GitHub then took the server-side bits of git, and effectively built a web-based interface with social features on top. Git itself is still very much a decentralized tool (just add a new remote and off you go), only the social GUI is centralized. It would be cool if somebody could build "Github over P2P" (I guess with a bit of blockchain, because hype). At that point the entire stack would be fully decentralized.
  - soulofmischief 8y ago
    A git service built on IPFS or something similar would be wicked. It does take quite a bit of engineering (money) to compete with the big boys, however.
    - chupasaurus 8y ago
      The first project provided by DDG to me was Radicle[https://radicle.xyz/ https://radicle.xyz/]
      - soulofmischief 8y ago
        rad project allows you to create, checkout, manage, and publish a project, comprised of issues, patch proposals, and a git repo. Well hot dog. And it uses LISP for scripting? Nice. Interesting approach to saving state, too.: One only needs the address of the latest input, the "head", to be able to recover the whole log. The owner of a machine uses an IPNS link to point to the head of the list, and the name of this link is then the name of the machine also. Thanks for sharing that. Definitely going to give it a whirl this weekend.
        toyg 8y ago
        It looks the business but it lacks the single most important feature for popularity: a GUI. GitHub made Git dominant by building a friendly GUI on top of it. Before, it was just another player in a relatively crowded field of CLI DVCSs. Obviously it is not essential to get stuff done, but anything with any ambition of generating network effects definitely needs a GUI. The other thing that seems to be lacking, from a quick reading of the docs, is a way to generate pull requests (or "patches" in Rad terms) from a branch, and then merge them on another branch. Obviously you can do it manually in git, but GH is definitely a superior experience.
        soulofmischief 8y ago
        > It looks the business but it lacks the single most important feature for popularity: a GUI. It's a matter of perspective. My first thought when reading the docs was, "All someone needs to do is slap a GUI on this baby. Good thing the designers made a simple CLI that it could interface with." They've already done most of the heavy lifting. At this point a GUI is trivial to add. "Terminal–first" doesn't imply "terminal-only". In fact, quite the opposite. I wouldn't be so quick to assume that they don't envision a GUI at some point-- Why not contribute to the project and get the ball rolling? The patch command [0] has a propose subcommand that describes what you're talking about. It generates a patch from a commit (on any branch, I presume). This can be applied however you see fit. And the checkout subcommand even lets you generate branches from patches similar to GH. What seems to be missing? [0] https://radicle.xyz/docs/#rad-cli-reference https://radicle.xyz/docs/#rad-cli-reference
arugulum 8y ago
I have the opposite view: the success of GitHub and the growth of code being open by default with everything running through git has probably brought more people into the git ecosystem than would have otherwise. I primarily use GitHub, but whenever I need something that I need to run myself I know I can fairly seamlessly switch over to something like GitLab. For example, if GitHub ever started using a very proprietary application, I would just switch over to using regular git, and I'm guessing many others would too.
- jeena 8y ago
  I don't believe you would. It's more probable that you'd install that proprietary application to get the features which standard git lacks at that time.
- keytarsolo 8y ago
  I am with you on this one. I use GitHub to share code, and participate in projects. I use my own GitBucket instance for anything purely personal that I don't want to lose, but don't want to make nice or document and then at work we use GitLab. I'm all in on git in a way that I might not have been without GitHub making it so huge. Without GitHub, we'd probably all be using git at home but SVN at the office.
soulofmischief 8y ago
I just wish a PR and issue tracking system with pluggable credentials had been simultaneously developed and implemented alongside git, so that I could migrate my issue and PR history, or plug them in to multiple hosts. I prefer Gitlab for a multitude of reasons but since all the action takes place on Github, my Gitlab account just serves as a repo mirror.
- chriswarbo 8y ago
  Git has always had integration with email, which makes it compatible with a vast amount of existing servers, clients, credential systems, Web UIs, scripting languages, etc. As an example I think SourceHut is mostly based around email (which it provides a Web UI for) https://sourcehut.org https://sourcehut.org

yarg 8y ago

Hopefully something along these lines will also be added to Gitab. I share your concerns, but I've also long had the feeling that both NPM and Maven are a security disaster in the making. Having the dependencies being published from the same place that stores the actual code, gives me a little hope that things will improve from the security and design perspective.

gritzko 8y ago
...by adding a single point of failure?
- yarg 8y ago
  No, my thoughts are that we need better mechanisms to validate our dependencies. So far I believe that Maven and NPM have failed to deliver on that front. The dependencies being resolved from the code store provides a decent mechanism to resolve that issue. But as long as it's being done on closed software, it's going to be hard to move towards a standard.

rasz 8y ago

Microsoft is just trying hard to achieve Antitrust(movie) villain goals, Github plus "telemetry" is a pretty good coverage.

soulofmischief 8y ago
Github is primarily composed of public data that Microsoft could scrape without a $7.5B investment. There are a lot of moving parts to this and it's impossible to distill it down to a single sentence or even paragraph.

gouh 8y ago

Ideally I would like the social aspects of GitHub (trending/popular repository, staring projects, notifications, etc.) but with decentralized hosting. Something that would be to GitHub what Mastodon is to Twitter

IfOnlyYouKnew 8y ago

That is, indeed, a fair point of concern. But in practical terms, I would place Github very high in any ranking of good things that happened to open source. It's possible many people have forgotten, or are to young to remember, how the ecosystem worked pre-Github. There was sourceforge, which wasn't quite the disaster it is today, but also not very good. But mostly I remember every project using different, often hand-rolled systems. PRs had to be sent in by mail. Every project had their own conventions of where to send patches, what formats to use, what additional information to provide etc. Just try figuring out how to get a patch into Debian, which is still where most projects were ca. 2005. I won't wait. I never contributed to OSS pre-Github. These days, I routinely send in a patch for smaller things I encounter a few times per week. Over time, I have also started becoming a more involved contributed to two projects. I doubt this would have happened without the flat learning curve that Github provides. I wouldn't be surprised if both the number of contributors and total contributions to OSS have soared by a factor like 5x even above just the growth in OSS usage, and Github is the obvious reason for it.

zmix 8y ago

This! Hypothetically, and, currently, only hypothetically: If Microsoft is still of the old spirit, then what we see now, would be the biggest "Embrace, Extend, Extinguish" coup, they have ever done. It won't happen now, it won't happen tomorrow. For that, this would be too big of an effort. But Microsoft is trying big to win back the hearts of "The Community" and "The Market". As people, especially developers, have gotten more clever about the computers, since the advent of the web has made it possible, to live in IT without "getting shown" and "taught" by "Big Daddy" type companies, since all and everybody is much more self-organizing these days, there is much more competition to MS, that has been in the past. So they try to get it back, what they have lost. * VSCode, is very sweet and candy, with lots of bells and whistles, major software companies writing plugins for it (the most active being Microsoft). As a programmer's text editor it sits right at the core of every development. VSCode, especially, is attractive to people outside of MS Windows (they might use VisualStudio). I am talking about web- and "App" developers. Mostly frontend or mobile. * By buying Github, they bought the "source of all sources". They won't ever own the code, but as long as they own the popular infrastructure, everybody is playing on their grounds. The next step, in two years, or so, may be the need for a MS account to log into Github. They integrate it. Out of curiosity, what else did MS buy in the last years, that would fit into this pattern?

bartimus 8y ago

It's a good reason to seriously consider Gitlab.

piotrkubisa 8y ago
Or https://sourcehut.org/ https://sourcehut.org/ if you are looking for something leaner. Or if you are looking for self-hosted git servers: - https://onedev.io/ https://onedev.io/ - https://gitea.io https://gitea.io / https://gogs.io/ https://gogs.io/