3 ms·

Backing up your GitHub/Gitlab/Bitbucket repositories is a good idea because it ensures that you have a copy of your code stored in a separate location in case s

Backing up your GitHub/Gitlab/Bitbucket repositories is a good idea because it ensures that you have a copy of your code stored in a separate location in case something happens to the original. This could include issues such as accidental deletion, data loss due to a server failure (unlikely, but not impossible), or unauthorized access to your account. In 2017, Gitlab lost over 300GB of data: https://about.gitlab.com/blog/2017/02/01/gitlab-dot-com-database-incident/ https://about.gitlab.com/blog/2017/02/01/gitlab-dot-com-data...

verdverm 4y ago
When most people think of unauthorized access to their git, their concern is more about code being stolen. Wouldn't a service such as this expand that attack surface? Modifications can be undone, it's git after all. Most repositories are essentially backed up by the devs in their working environments, are they not?
- alexandrub 4y ago
  Many developers do store copies of their code in their working environments, but these copies may not be as easily accessible or organized as a separate backup. In case of an emergency, it's easier to find the developer with the latest copy or just restore from a backup? Modifications to a git repository can be undone if the repository itself is not deleted. If it's deleted, you will have to find the developer which has the latest copy on its working environment. Regarding the metadata, the chances of recovering it are very small. Unauthorized access to your GitHub account can lead to code being stolen or tampered with, and using a backup service could potentially expand the attack surface (even if we do our best to minimize the chances). However, the benefits of having a backup in a separate location, such as being able to restore or migrate your code with one click, outweigh the risks in many cases. At least this is the opinion of the companies using such services. How many developers are in your team?
  - verdverm 4y ago
    I've worked at a number of different organizations and making backups of GitHub (et al) has never even come up as a discussion topic, let alone something we considered. We talk more about reducing 3rd party vendors given the increasing attacks on the software supply chain. We use the permission system to limit the damage a developer could inflict. It is not easy to delete a repository.

verdverm 4y ago

When most people think of unauthorized access to their git, their concern is more about code being stolen. Wouldn't a service such as this expand that attack surface? Modifications can be undone, it's git after all. Most repositories are essentially backed up by the devs in their working environments, are they not?

alexandrub 4y ago
Many developers do store copies of their code in their working environments, but these copies may not be as easily accessible or organized as a separate backup. In case of an emergency, it's easier to find the developer with the latest copy or just restore from a backup? Modifications to a git repository can be undone if the repository itself is not deleted. If it's deleted, you will have to find the developer which has the latest copy on its working environment. Regarding the metadata, the chances of recovering it are very small. Unauthorized access to your GitHub account can lead to code being stolen or tampered with, and using a backup service could potentially expand the attack surface (even if we do our best to minimize the chances). However, the benefits of having a backup in a separate location, such as being able to restore or migrate your code with one click, outweigh the risks in many cases. At least this is the opinion of the companies using such services. How many developers are in your team?
- verdverm 4y ago
  I've worked at a number of different organizations and making backups of GitHub (et al) has never even come up as a discussion topic, let alone something we considered. We talk more about reducing 3rd party vendors given the increasing attacks on the software supply chain. We use the permission system to limit the damage a developer could inflict. It is not easy to delete a repository.