3 ms·

It's not entirely clear to me whether you're talking about using GitHub for your own production tooling, or as a source for some arbitraty third party component

It's not entirely clear to me whether you're talking about using GitHub for your own production tooling, or as a source for some arbitraty third party component. If it's the latter, then I completely agree with you. Use a read-through proxying package repository. I don't care if you run it yourself or if you pay a provider, but don't pull stuff from the origin every time you build. In the general case, adoping an external system will bring with it greater reliability than trying to run stuff oneself. The differences are that you don't get to choose your maintenance windows, and you can't do anything to fix it yourself. Take care about who you pick, and own the depencency, because you've put a part of your own reputation in the hands of your provider. Now, if you pick GitHub as a part of your controlled ecosystem -- which is totally reasonable, if it fits your use-case -- then you still shouldn't be pulling arbitrary stuff from places outwith your control. GitHub has package repository tooling that you can use :). Although it's not entirely clear to me that it's as suitable for third-party dependencies as tools like Artifactory or Nexus.

swatcoder 3y ago
Yeah, I was talking about access to third-party dependencies, which I had assumed was the crisis the OP had in mind. I've since read many sibling replies fret over build automation or source code storage, but some downtime in build automation will rarely damage customers and (my goodness) I hope people aren't trusting the only copy of all their IP to a business partner and that they always have a very recent backup somewhere they own themselves.
- andrewaylett 3y ago
  Some things are disappointingly hard to back up properly. Source code isn't really in that category. There's still a question of how strong an ownership we need -- for example, my mail server is owned by OVH, and its backups are sent to rsync.net. I consider that to be sufficent ownership of backups. I'm much more likely to lose my files than they are. I'm sure that GitHub also have backups, but they're not for the benefit of their customers.

swatcoder 3y ago

Yeah, I was talking about access to third-party dependencies, which I had assumed was the crisis the OP had in mind. I've since read many sibling replies fret over build automation or source code storage, but some downtime in build automation will rarely damage customers and (my goodness) I hope people aren't trusting the only copy of all their IP to a business partner and that they always have a very recent backup somewhere they own themselves.

andrewaylett 3y ago
Some things are disappointingly hard to back up properly. Source code isn't really in that category. There's still a question of how strong an ownership we need -- for example, my mail server is owned by OVH, and its backups are sent to rsync.net. I consider that to be sufficent ownership of backups. I'm much more likely to lose my files than they are. I'm sure that GitHub also have backups, but they're not for the benefit of their customers.