4 ms·

You should check out http://bitbucket.org http://bitbucket.org

by zalew 15y ago

dangrossman 15y ago
I prefer to pay someone to host the private repos. No free tier means every user is treated like a paying customer, and every user's data is considered valuable. It also means that as long as the pricing is sane, the company isn't going to shut its doors for lack of revenue. Before RH I was paying Springloops. It's $6/month to take care of my most important assets. That doesn't even buy a meal at McDonalds anymore; it's worth it.
- zalew 15y ago
  > as long as the pricing is sane, the company isn't going to shut its doors for lack of revenue. BitBucket is owned by Atlassian for 2 years now and they don't look like they're about to go out of business ($60mil revenue in 2011, 400employees, worldwide offices). When they bought it, it was them who set private repos to unlimited (when @jespern was running it alone, it was set to 5), so I believe they know what they're doing and that it fits their business model. Over 5 collaborators need a paid plan and that's just how they set up the pricing scheme. As far as I can see as an active user and lurking through their blog and bugtracker, BB is actively developped, so I assume you don't have to worry about them running out of business, looks like it's a valuable asset in Atlassian's software portfolio (at least valuable enough to work on it).
- batista 15y ago
  I prefer to pay someone to host the private repos. Yeah, and people payed GitHub to host their private repos --how did that go?
  - jcoder 15y ago
    It's going _just fine_.
    - batista 15y ago
      Except when they don't handle security well, and you end up with anybody that feels like it capable of reading your private source code... Like, say, NOW.
rogerbinns 15y ago
What makes you think they are saints? About a year ago I discovered that they didn't protect attachments to tickets in private repositories (since fixed). Anyone who could guess the URL could access the content. (It looked like the cause was keeping the attachments in S3 without front-ending them.) On contacting them I was told it would be fixed in a day or two, and that it was no big deal since you had to guess the URL. The values you had to guess in the URL were a ticket number (they start from 1), a repository name, a date (YMD) and a filename. Sure there is some variety in there but it is not in the billions of possibilities, just hundreds and that won't make any computer break into a sweat and in my words at the time "easy". To make matters worse you can't delete the attachments to tickets. This may not affect you. It certainly affected me. For example we had some keyfiles in one ticket. Coredumps in others. Two weeks later the issue still hadn't been fixed and I don't know when it was. I've never seen disclosure of the issue. There wasn't even any way of knowing if attachments had been accessed in an unauthorized way since there was no checking in the first place.
- zalew 15y ago
  > What makes you think they are saints? What makes you think I think that?
  - rogerbinns 15y ago
    You suggested bitbucket as an alternative to the github the thread starter had lost trust in.

You should check out http://bitbucket.org http://bitbucket.org

by zalew 15y ago

You should check out http://bitbucket.org http://bitbucket.org

I prefer to pay someone to host the private repos. No free tier means every user is treated like a paying customer, and every user's data is considered valuable. It also means that as long as the pricing is sane, the company isn't going to shut its doors for lack of revenue. Before RH I was paying Springloops. It's $6/month to take care of my most important assets. That doesn't even buy a meal at McDonalds anymore; it's worth it.

zalew 15y ago
> as long as the pricing is sane, the company isn't going to shut its doors for lack of revenue. BitBucket is owned by Atlassian for 2 years now and they don't look like they're about to go out of business ($60mil revenue in 2011, 400employees, worldwide offices). When they bought it, it was them who set private repos to unlimited (when @jespern was running it alone, it was set to 5), so I believe they know what they're doing and that it fits their business model. Over 5 collaborators need a paid plan and that's just how they set up the pricing scheme. As far as I can see as an active user and lurking through their blog and bugtracker, BB is actively developped, so I assume you don't have to worry about them running out of business, looks like it's a valuable asset in Atlassian's software portfolio (at least valuable enough to work on it).
batista 15y ago
I prefer to pay someone to host the private repos. Yeah, and people payed GitHub to host their private repos --how did that go?
- jcoder 15y ago
  It's going _just fine_.
  - batista 15y ago
    Except when they don't handle security well, and you end up with anybody that feels like it capable of reading your private source code... Like, say, NOW.

rogerbinns 15y ago

What makes you think they are saints? About a year ago I discovered that they didn't protect attachments to tickets in private repositories (since fixed). Anyone who could guess the URL could access the content. (It looked like the cause was keeping the attachments in S3 without front-ending them.) On contacting them I was told it would be fixed in a day or two, and that it was no big deal since you had to guess the URL. The values you had to guess in the URL were a ticket number (they start from 1), a repository name, a date (YMD) and a filename. Sure there is some variety in there but it is not in the billions of possibilities, just hundreds and that won't make any computer break into a sweat and in my words at the time "easy". To make matters worse you can't delete the attachments to tickets. This may not affect you. It certainly affected me. For example we had some keyfiles in one ticket. Coredumps in others. Two weeks later the issue still hadn't been fixed and I don't know when it was. I've never seen disclosure of the issue. There wasn't even any way of knowing if attachments had been accessed in an unauthorized way since there was no checking in the first place.

zalew 15y ago
> What makes you think they are saints? What makes you think I think that?
- rogerbinns 15y ago
  You suggested bitbucket as an alternative to the github the thread starter had lost trust in.