7 ms·

Just had this thought: are there any decentralized code hosting services? To me, I don't really see a difference between GitHub and sr.ht. Companies can start

Just had this thought: are there any decentralized code hosting services? To me, I don't really see a difference between GitHub and sr.ht. Companies can start out with these "friendly" attitudes towards FOSS, but when they reel in many paying customers, they can pretty easily, and without consequence, change their policies to be more aggressive (geared towards profit) and greedy. It just seems inevitable to me. However, decentralized hosting and governance might make it so that there can't be a hostile takeover and incorrect (relative to license) usage of FOSS code. I'm thinking something akin to IPFS but more specialized towards e.g git repository hosting. Not sure how such hosting would be feasible in terms of breaking even between hosting costs, but a decentralized service hosting distributed VCS databases seems more along the lines of the philosophy of DVCS's in general. DVCS's in general do not have timeliness requirements (i.e your "git push" most of the time doesn't have to propagate worldwide immediately) and the other goodies that come with being on GitHub (e.g CI/CD) seem orthogonal to the actual code hosting itself, and I don't see why that can't be built separately without being part of the service.

ranaexmachina 4y ago
> To me, I don't really see a difference between GitHub and sr.ht. Companies can start out with these "friendly" attitudes towards FOSS, but when they reel in many paying customers, they can pretty easily, and without consequence, change their policies to be more aggressive (geared towards profit) and greedy. It just seems inevitable to me. But with sourcehut you can just host it yourself or find someone else who hosts that as everything is FOSS. If you don't want to use the built-in CI, wiki and issue tracker, then Git is already decentralized. You can push and pull easily from and to multiple sources. Git is already built for that exact use case.
- capableweb 4y ago
  > If you don't want to use the built-in CI, wiki and issue tracker, then Git is already decentralized. You can push and pull easily from and to multiple sources. Git is already built for that exact use case. Git is a great protocol. You can pull/push to HTTPS servers, SSH servers, even directories (so via NFS if you so wish). Really, Git is really awesome in that way. But Git itself is not a "code hosting service" that parent asked for. That requires more. Something like Fossil SCM would probably fit better, or git-ssb as I mentioned in another comment here.
goodpoint 4y ago
> I don't really see a difference between GitHub and sr.ht. Companies can start out with these "friendly" attitudes towards FOSS You are really comparing DeVault with, of all companies, microsoft?
capableweb 4y ago
git-ssb is really nice for decentralized hosting between friends. Uses Secure Scuttlebutt (https://scuttlebutt.nz/ https://scuttlebutt.nz/) and I've used it for over a year to collaborate on projects with people over ssb. I'm a bit scared of putting this link here, as the gateway is not super reliable, so I'll ask people who are curious, to get ssb running locally and pull down the data if they want to look into it deeper. But regardless, here is the link for the curious minds who can't wait, it's the repository for git-ssb itself: https://git.scuttlebot.io/%254Dsh92G6zkkLnR3%2Fys%2Fv42MD0jKOUG7jbmIOqpZ72zg%3D.sha256 https://git.scuttlebot.io/%254Dsh92G6zkkLnR3%2Fys%2Fv42MD0jK... If you get server errors, jump on ssb yourself, or wait some seconds/minutes and refresh. Be kind to the poor server.
sergiotapia 4y ago
Drew Devault is /g/ incarnate. He won't ever do any bullshit to people using the services. If anything he would just as well burn it all to the ground.
- Aeolun 4y ago
  The thing is, I’ve said this about many many people that eventually sold out. I wouldn’t trust anyone that claimed it, not even myself.
  - sergiotapia 4y ago
    He never claimed it, and never said it - it's just his actions are the actions of a typical /g/ poster. So he is the real deal.
- skybrian 4y ago
  Well, there was the Mastodon instance that just disappeared on me one day. I wasn't paying for it though, or using the account much.
morpheuskafka 4y ago
I don't know the backstory with the sr.ht founder or anything, but I think there is a difference. GitHub always started out as a for-profit company, albeit targeting the market of FOSS developers/communities, and had a closed-source product sold for on-prem use. Sourcehut is itself FOSS software from the beginning and has its own developer community, so it is a little different.
miohtama 4y ago
Radicle is a decentralised Github alternative to the point it does not have any centralised servers. However, because of ”web3” many people here on HackerNews might not take it seriously, even thought it might deserve a closer look. https://radicle.xyz/ https://radicle.xyz/
- capableweb 4y ago
  As long as it's P2P without involving any cryptocurrencies, I don't see why you'd label it "Web3"? Edit: seems Ethereum is a opt-in optional part of Radicle, so I see how people could believe it to be a part of the whole "Web3" effort. Well, as long as I can run it without Ethereum, I'm happy.
  - miohtama 4y ago
    It literally says Web3 on the second heading of the landing page.
    - capableweb 4y ago
      As my edit mentions, seems at least that part is opt-in rather than a core of the protocol. So you can use it without "Web3" if you want.
      - k__ 4y ago
        Web3 is the decentralized web. Cryptocurrencies are just an extra. No wonder, people here hating on Web3 all the time, if they don't understand that.
        Klonoar 4y ago
        ...no, the decentralized web is just the web. Web3 is utterly synonymous with cryptocurrency. Plenty of people here understand what it is and what is discussed when the term is brought up.
rychco 4y ago
I don’t know Drew DeVault personally, but I feel from his blog that he’s fairly transparent and not interested in attempting to squeeze out every possible cent of profit from sourcehut. I may be proven wrong in the future, but for now I’m happy with the service and hopeful that it will remain affordable, friendly, and fast.
- quickthrower2 4y ago
  I think there is a 10 year "we can have nice things" expiry date on stuff like this. Think Google / Github / Facebook etc. After 10 years, the thing dies, or grows so big it becomes a corporation, run by suits, hungry for new revenue. There are probably exceptions (HN is one, as it is more of a well kept and groomed "pet" than a business in itself. Meant in a nice way as I love pets). Death is an interesting one. Reading that Prince's estate is trying to color troll [1], means that regardless of what Prince wanted (not sure what he wanted either way), some other heads with different ethics can take over and do something different from the ethos you thought you were buying into. [1] https://news.ycombinator.com/item?id=31925423 https://news.ycombinator.com/item?id=31925423
  - aozgaa 4y ago
    HN is maintained at least in part to promote YC startups and the reputation of YC itself. The monetization is indirect. (Maybe some posts are sponsored? I would be mildly surprised.) This suggests the incentives for YC are more aligned to users’ goals than, say, Reddit.
ddevault 4y ago
Founder of sr.ht here. I understand these fears, and I have gone to great lengths to give users tangible assurances in this regard. Trust is something that has to be earned, and it is incredibly important to me that we are worthy of yours. For a start, the company is bootstrapped and we have no private investors. The revenue to maintain the platform comes directly from users, and all users are expected to pay if they have the means for this reason. We are accountable only to them and we do not have to find "creative" ways to monetize them (or their work) because they are already footing the bill themselves. Every cent paid by users stays in open source, either supporting the platform or the dozens of projects our engineers maintain or contribute to in the FOSS ecosystem. We also seek to be as transparent as possible. Our financial reports, monitoring system & alarms, security reporting, operational documentation, backups, and so on, is all publicly available. We have hard data that you can use to understand our platform's sustainability, security, performance, uptime, and more. And, unlike GitHub (and GitLab), SourceHut is 100% bona-fide free software, mostly AGPL. You can run it on your own servers, and we make it easy to import and export your data, in standard, interoperable formats that you can use to move between instances or even between software stacks, such as GNU Mailman or other solutions. SourceHut is also not an ivory tower -- we elevate our users to peers, and many parts of our system are officially maintained by independent volunteers. I work really hard for our user's trust and I'm proud to know that I have it. If anyone has questions or concerns, I'm always prepared to listen to them and do what it takes to make sure our users are confident in the platform. FOSS is my life's passion and I am committed to doing it right.
- sneak 4y ago
  I always got the impression that sr.ht was not intended to be social software, but simply a git frontend. To me, this makes it unsuitable as a frontend for community-focused projects that cater to involving and attracting strangers, and much more something for single-committer repos. Ultimately, building large software ends up being a team sport, and I never got the impression that your product had the express goal of facilitating (and causing) collaboration; in fact quite the opposite: that those are explicitly out of scope for the project.
  - 4y ago
johnny22 4y ago
I wouldn't want to use any decentralized system for code if there's no discovery, code search, cross instance logins, AND BACKUPS. It'd suck to end up in a situation like you see with torrents, where there are tons of references, but no access to the data. I can imagine tons of useful code being lost over time that way.
- fiddlerwoaroof 4y ago
  Git is great because every clone is a backup: if you want public backups, push to multiple upstreams (or setup mirroring): e.g. sr.ht, self-hosted gitea on AWS and self-hosted gitolite on Hetzner
deleted 4y ago
[deleted]
mbreese 4y ago
Git itself is decentralized. It is entirely agnostic from a centralized/decentralized point of view. We tend to centralize things to make life easier. Who wants to pull updates from each contributor as opposed to a hub? So the real question is — what are the features of GitHub would you like to see decentralized? CI? Issues? Wikis? Because, you can self host many of these with gitea, GitLab, or sr.ht. That’s the best kind of decentralization, but it does add to your own personal overhead (maintenance, backups), and really limits discovery. I think what you might be asking for is if there is a federated code repository that supports git. That’s an interesting question, and I don’t know if such a thing yet exists.
- quickthrower2 4y ago
  Is it possible to decentralize "I know about package X -> Find Package X online -> Git Clone"? While keeping the property of very high availability? And making it convenient. I think the first two steps could be covered by a source search engine that spans different repository providers, and includes self-hosted git instances. That source search engine will probably be centralized, although if we are just searching names and descriptions (and not code) the engine could be a fairly small .zip file that anyone can install. So comes down to "passing around lists".
  - mbreese 4y ago
    That’s the idea with pkg.go, npm, pypi, CRAN, (CPAN?!?), etc… discovery of packages. I think each of these has a wider record for the package showing where individual code repositories are hosted. But I wouldn’t necessarily call them “convenient.” But that isn’t helpful for cross-language searching, or a code search engine (which I think is a great idea).
- nine_k 4y ago
  - Code review aka pull requests. - Issues. - CI. - "Home page" with the readme.md rendered. Easy discoverability is a large concern. Easy discussion with fast round-trips and a trail is important (email or NNTP can help here though). CI is a thing that may need a serious effort to get running smoothly. These things are centralized because it's easy to implement them once in one place instead of reinventing. But if there'd be an obvious and bullet-proof way to have them replicated (like in Fossil), the need for strict centralization would wane. Discoverability would still be an issue though. It's like torrents: completely decentralied, but without a directory like TPB it's really hard to find them.
hyperpape 4y ago
sr.ht is the vision of one extremely stubborn man who loves free software. I wouldn’t host my material there, but if your worry is that he’ll go corporate, you’re probably pretty safe.
- rglullis 4y ago
  > I wouldn’t host my material there Why?
  - Gigachad 4y ago
    Not OP but IMO the UX is really bad. It's removed almost everything that github/gitlab popularized for a plain, unstyled, email driven workflow. HN often states that git is too complex for most users and source hut pushes that to the extremes by using all the internal concepts and terminology in the UI rather than the more modern and understandable names.
southerntofu 4y ago
Shameless plug: https://staticadventures.netlib.re/blog/decentralized-forge/ https://staticadventures.netlib.re/blog/decentralized-forge/ I wrote this article about decentralized forging and the different approaches to it, P2P and federated. It's not exactly an in-depth analysis but i believe it's a good high-level overview of the ecosystem which has changed little since then.

ranaexmachina 4y ago

> To me, I don't really see a difference between GitHub and sr.ht. Companies can start out with these "friendly" attitudes towards FOSS, but when they reel in many paying customers, they can pretty easily, and without consequence, change their policies to be more aggressive (geared towards profit) and greedy. It just seems inevitable to me. But with sourcehut you can just host it yourself or find someone else who hosts that as everything is FOSS. If you don't want to use the built-in CI, wiki and issue tracker, then Git is already decentralized. You can push and pull easily from and to multiple sources. Git is already built for that exact use case.

capableweb 4y ago
> If you don't want to use the built-in CI, wiki and issue tracker, then Git is already decentralized. You can push and pull easily from and to multiple sources. Git is already built for that exact use case. Git is a great protocol. You can pull/push to HTTPS servers, SSH servers, even directories (so via NFS if you so wish). Really, Git is really awesome in that way. But Git itself is not a "code hosting service" that parent asked for. That requires more. Something like Fossil SCM would probably fit better, or git-ssb as I mentioned in another comment here.

goodpoint 4y ago

> I don't really see a difference between GitHub and sr.ht. Companies can start out with these "friendly" attitudes towards FOSS You are really comparing DeVault with, of all companies, microsoft?

capableweb 4y ago

git-ssb is really nice for decentralized hosting between friends. Uses Secure Scuttlebutt (https://scuttlebutt.nz/ https://scuttlebutt.nz/) and I've used it for over a year to collaborate on projects with people over ssb. I'm a bit scared of putting this link here, as the gateway is not super reliable, so I'll ask people who are curious, to get ssb running locally and pull down the data if they want to look into it deeper. But regardless, here is the link for the curious minds who can't wait, it's the repository for git-ssb itself: https://git.scuttlebot.io/%254Dsh92G6zkkLnR3%2Fys%2Fv42MD0jKOUG7jbmIOqpZ72zg%3D.sha256 https://git.scuttlebot.io/%254Dsh92G6zkkLnR3%2Fys%2Fv42MD0jK... If you get server errors, jump on ssb yourself, or wait some seconds/minutes and refresh. Be kind to the poor server.

sergiotapia 4y ago

Drew Devault is /g/ incarnate. He won't ever do any bullshit to people using the services. If anything he would just as well burn it all to the ground.

Aeolun 4y ago
The thing is, I’ve said this about many many people that eventually sold out. I wouldn’t trust anyone that claimed it, not even myself.
- sergiotapia 4y ago
  He never claimed it, and never said it - it's just his actions are the actions of a typical /g/ poster. So he is the real deal.
skybrian 4y ago
Well, there was the Mastodon instance that just disappeared on me one day. I wasn't paying for it though, or using the account much.

morpheuskafka 4y ago

I don't know the backstory with the sr.ht founder or anything, but I think there is a difference. GitHub always started out as a for-profit company, albeit targeting the market of FOSS developers/communities, and had a closed-source product sold for on-prem use. Sourcehut is itself FOSS software from the beginning and has its own developer community, so it is a little different.

miohtama 4y ago

Radicle is a decentralised Github alternative to the point it does not have any centralised servers. However, because of ”web3” many people here on HackerNews might not take it seriously, even thought it might deserve a closer look. https://radicle.xyz/ https://radicle.xyz/

capableweb 4y ago
As long as it's P2P without involving any cryptocurrencies, I don't see why you'd label it "Web3"? Edit: seems Ethereum is a opt-in optional part of Radicle, so I see how people could believe it to be a part of the whole "Web3" effort. Well, as long as I can run it without Ethereum, I'm happy.
- miohtama 4y ago
  It literally says Web3 on the second heading of the landing page.
  - capableweb 4y ago
    As my edit mentions, seems at least that part is opt-in rather than a core of the protocol. So you can use it without "Web3" if you want.
    - k__ 4y ago
      Web3 is the decentralized web. Cryptocurrencies are just an extra. No wonder, people here hating on Web3 all the time, if they don't understand that.
      - Klonoar 4y ago
        ...no, the decentralized web is just the web. Web3 is utterly synonymous with cryptocurrency. Plenty of people here understand what it is and what is discussed when the term is brought up.

rychco 4y ago

I don’t know Drew DeVault personally, but I feel from his blog that he’s fairly transparent and not interested in attempting to squeeze out every possible cent of profit from sourcehut. I may be proven wrong in the future, but for now I’m happy with the service and hopeful that it will remain affordable, friendly, and fast.

quickthrower2 4y ago
I think there is a 10 year "we can have nice things" expiry date on stuff like this. Think Google / Github / Facebook etc. After 10 years, the thing dies, or grows so big it becomes a corporation, run by suits, hungry for new revenue. There are probably exceptions (HN is one, as it is more of a well kept and groomed "pet" than a business in itself. Meant in a nice way as I love pets). Death is an interesting one. Reading that Prince's estate is trying to color troll [1], means that regardless of what Prince wanted (not sure what he wanted either way), some other heads with different ethics can take over and do something different from the ethos you thought you were buying into. [1] https://news.ycombinator.com/item?id=31925423 https://news.ycombinator.com/item?id=31925423
- aozgaa 4y ago
  HN is maintained at least in part to promote YC startups and the reputation of YC itself. The monetization is indirect. (Maybe some posts are sponsored? I would be mildly surprised.) This suggests the incentives for YC are more aligned to users’ goals than, say, Reddit.

ddevault 4y ago

Founder of sr.ht here. I understand these fears, and I have gone to great lengths to give users tangible assurances in this regard. Trust is something that has to be earned, and it is incredibly important to me that we are worthy of yours. For a start, the company is bootstrapped and we have no private investors. The revenue to maintain the platform comes directly from users, and all users are expected to pay if they have the means for this reason. We are accountable only to them and we do not have to find "creative" ways to monetize them (or their work) because they are already footing the bill themselves. Every cent paid by users stays in open source, either supporting the platform or the dozens of projects our engineers maintain or contribute to in the FOSS ecosystem. We also seek to be as transparent as possible. Our financial reports, monitoring system & alarms, security reporting, operational documentation, backups, and so on, is all publicly available. We have hard data that you can use to understand our platform's sustainability, security, performance, uptime, and more. And, unlike GitHub (and GitLab), SourceHut is 100% bona-fide free software, mostly AGPL. You can run it on your own servers, and we make it easy to import and export your data, in standard, interoperable formats that you can use to move between instances or even between software stacks, such as GNU Mailman or other solutions. SourceHut is also not an ivory tower -- we elevate our users to peers, and many parts of our system are officially maintained by independent volunteers. I work really hard for our user's trust and I'm proud to know that I have it. If anyone has questions or concerns, I'm always prepared to listen to them and do what it takes to make sure our users are confident in the platform. FOSS is my life's passion and I am committed to doing it right.

sneak 4y ago
I always got the impression that sr.ht was not intended to be social software, but simply a git frontend. To me, this makes it unsuitable as a frontend for community-focused projects that cater to involving and attracting strangers, and much more something for single-committer repos. Ultimately, building large software ends up being a team sport, and I never got the impression that your product had the express goal of facilitating (and causing) collaboration; in fact quite the opposite: that those are explicitly out of scope for the project.
- 4y ago

johnny22 4y ago

I wouldn't want to use any decentralized system for code if there's no discovery, code search, cross instance logins, AND BACKUPS. It'd suck to end up in a situation like you see with torrents, where there are tons of references, but no access to the data. I can imagine tons of useful code being lost over time that way.

fiddlerwoaroof 4y ago
Git is great because every clone is a backup: if you want public backups, push to multiple upstreams (or setup mirroring): e.g. sr.ht, self-hosted gitea on AWS and self-hosted gitolite on Hetzner

deleted 4y ago

[deleted]

mbreese 4y ago

Git itself is decentralized. It is entirely agnostic from a centralized/decentralized point of view. We tend to centralize things to make life easier. Who wants to pull updates from each contributor as opposed to a hub? So the real question is — what are the features of GitHub would you like to see decentralized? CI? Issues? Wikis? Because, you can self host many of these with gitea, GitLab, or sr.ht. That’s the best kind of decentralization, but it does add to your own personal overhead (maintenance, backups), and really limits discovery. I think what you might be asking for is if there is a federated code repository that supports git. That’s an interesting question, and I don’t know if such a thing yet exists.

quickthrower2 4y ago
Is it possible to decentralize "I know about package X -> Find Package X online -> Git Clone"? While keeping the property of very high availability? And making it convenient. I think the first two steps could be covered by a source search engine that spans different repository providers, and includes self-hosted git instances. That source search engine will probably be centralized, although if we are just searching names and descriptions (and not code) the engine could be a fairly small .zip file that anyone can install. So comes down to "passing around lists".
- mbreese 4y ago
  That’s the idea with pkg.go, npm, pypi, CRAN, (CPAN?!?), etc… discovery of packages. I think each of these has a wider record for the package showing where individual code repositories are hosted. But I wouldn’t necessarily call them “convenient.” But that isn’t helpful for cross-language searching, or a code search engine (which I think is a great idea).
nine_k 4y ago
- Code review aka pull requests. - Issues. - CI. - "Home page" with the readme.md rendered. Easy discoverability is a large concern. Easy discussion with fast round-trips and a trail is important (email or NNTP can help here though). CI is a thing that may need a serious effort to get running smoothly. These things are centralized because it's easy to implement them once in one place instead of reinventing. But if there'd be an obvious and bullet-proof way to have them replicated (like in Fossil), the need for strict centralization would wane. Discoverability would still be an issue though. It's like torrents: completely decentralied, but without a directory like TPB it's really hard to find them.

hyperpape 4y ago

sr.ht is the vision of one extremely stubborn man who loves free software. I wouldn’t host my material there, but if your worry is that he’ll go corporate, you’re probably pretty safe.

rglullis 4y ago
> I wouldn’t host my material there Why?
- Gigachad 4y ago
  Not OP but IMO the UX is really bad. It's removed almost everything that github/gitlab popularized for a plain, unstyled, email driven workflow. HN often states that git is too complex for most users and source hut pushes that to the extremes by using all the internal concepts and terminology in the UI rather than the more modern and understandable names.

southerntofu 4y ago

Shameless plug: https://staticadventures.netlib.re/blog/decentralized-forge/ https://staticadventures.netlib.re/blog/decentralized-forge/ I wrote this article about decentralized forging and the different approaches to it, P2P and federated. It's not exactly an in-depth analysis but i believe it's a good high-level overview of the ecosystem which has changed little since then.