5 ms·

I'm pretty sure Microsoft getting acquired is a considerably lower probability event than the other risks you're mitigating. If not, you might want to assess yo

by yodon 3y ago

I'm pretty sure Microsoft getting acquired is a considerably lower probability event than the other risks you're mitigating. If not, you might want to assess your risk tolerance.

JohnFen 3y ago
Acquisition was just an example, and true, it's not likely with Microsoft. More likely glitches with Microsoft are that it sells Github, or there's a change in management priorities or personnel. I was really addressing the larger case of depending too much on any company for this sort of thing, not Github specifically.
- yodon 3y ago
  It's a tradeoff between concentrating your risks in a very low-risk-probability monoculture or distributing your risks across a large statistical sample of (generally) much higher risk individual providers (smaller companies shut down or get acquired at much higher rates, and are frequently still high value targets for attackers even though they have much smaller budgets to spend on security and defense). Distributing your risk among a large number of vendors is not necessarily better, and even if it's "just backups" can still multiply your risk of ideally non-public information getting disclosed. Denial of service risks exist but are rare and, for example with the myriad complaints about "stripe is evil" tend to trace back to "account in question was doing something a rational unaffiliated observer would predict as a likely account cancellation driver for stripe." We don't know the circumstances here. If the circumstances were benign, it will likely be corrected, if not benign, we may never know the details. EDIT ADDED (since HN is rate limiting this): self-hosting doesn't eliminate risks, it just changes them. You still face denial of service risks from loss of power, fire, natural disaster, theft, component failures, etc. If there were a zero risk path, everyone would take it. We tend to prefer risks we feel we have "control over" (eg. Self-hosting), but at the incident rates of most other corporate hosting risks you're into the territory of an earthquake took out both your house and your rented storage locker.
  - JohnFen 3y ago
    A third way is to run essential services yourself rather than relying on other companies. This is my preference. EDIT to reply: " self-hosting doesn't eliminate risks, it just changes them." Absolutely true, but from my observations over the past couple of decades, the overall risks are lower with with self-hosting than with having someone else do it. The tradeoff is that self-hosting is more work. What's right for you depends on your particular needs.

by yodon 3y ago

I'm pretty sure Microsoft getting acquired is a considerably lower probability event than the other risks you're mitigating. If not, you might want to assess your risk tolerance.

JohnFen 3y ago

Acquisition was just an example, and true, it's not likely with Microsoft. More likely glitches with Microsoft are that it sells Github, or there's a change in management priorities or personnel. I was really addressing the larger case of depending too much on any company for this sort of thing, not Github specifically.

yodon 3y ago
It's a tradeoff between concentrating your risks in a very low-risk-probability monoculture or distributing your risks across a large statistical sample of (generally) much higher risk individual providers (smaller companies shut down or get acquired at much higher rates, and are frequently still high value targets for attackers even though they have much smaller budgets to spend on security and defense). Distributing your risk among a large number of vendors is not necessarily better, and even if it's "just backups" can still multiply your risk of ideally non-public information getting disclosed. Denial of service risks exist but are rare and, for example with the myriad complaints about "stripe is evil" tend to trace back to "account in question was doing something a rational unaffiliated observer would predict as a likely account cancellation driver for stripe." We don't know the circumstances here. If the circumstances were benign, it will likely be corrected, if not benign, we may never know the details. EDIT ADDED (since HN is rate limiting this): self-hosting doesn't eliminate risks, it just changes them. You still face denial of service risks from loss of power, fire, natural disaster, theft, component failures, etc. If there were a zero risk path, everyone would take it. We tend to prefer risks we feel we have "control over" (eg. Self-hosting), but at the incident rates of most other corporate hosting risks you're into the territory of an earthquake took out both your house and your rented storage locker.
- JohnFen 3y ago
  A third way is to run essential services yourself rather than relying on other companies. This is my preference. EDIT to reply: " self-hosting doesn't eliminate risks, it just changes them." Absolutely true, but from my observations over the past couple of decades, the overall risks are lower with with self-hosting than with having someone else do it. The tradeoff is that self-hosting is more work. What's right for you depends on your particular needs.