4 ms·

People keep wanting to replace GitHub, but with what? If GH is getting RCE's this late in the game who wants to take the chance something else won't?

gtech1 6mo ago
GitLab ?
- latchkey 6mo ago
  The people who suggest gitlab, haven't used it. But I guess I could be tempted to try again... https://status.gitlab.com/pages/history/5b36dc6502d06804c08349f7 https://status.gitlab.com/pages/history/5b36dc6502d06804c083...
  - capitalhilbilly 6mo ago
    If you could only choose from github, gitlab and atlassan then I suppose.. But really anything newer that stays in existance has to be focused on quality from early enough to not be defined by path dependence problems and bad choices like those 3.
    - latchkey 6mo ago
      Given that github is imploding under a lot of load, everyone leaving github for something else, actually makes github better.
  - gtech1 6mo ago
    Ah, you assumed I meant SaaS GitLab. I meant the self-hosted version. I would never host our source code on a remote service.
    - latchkey 6mo ago
      Why not?
      - gtech1 6mo ago
        Because I don't trust someone else to not train or steal our source code, or, even legally, introduce some silly cause after we are invested/locked into their infra, that allows them to do whatever with our property. And on equal footing, I trust our security more than theirs. Case in point.
- himata4113 6mo ago
  Me and my friends call it CveLab because there was a time where there was a critical security update every week or multiple times a week.
chucky_z 6mo ago
.... git? replace it with git. if you want a whole ui you can use something like forgejo which has far fewer features likely leading to less issues.
- latchkey 6mo ago
  i want what github offers.
  - heliumtera 6mo ago
    Enjoy your experience, there will certainly be no end to it.
    - latchkey 6mo ago
      I've had my account since 2008. ¯\_(ツ)_/¯ updated: changed the date to 2008. my account shows 2001, but that's probably from projects I moved over... proof: https://github.com/lookfirst https://github.com/lookfirst
      - sitzkrieg 6mo ago
        i just deleted my account of 2008. github sucks
      - necubi 6mo ago
        GitHub launched in 2008, so that seems unlikely?
      - seanclayton 6mo ago
        Just be careful your patronage doesn't lead to a sunk cost fallacy---a middle manager might just be betting on it
        latchkey 6mo ago
        I have no ingrained loyalty, I just haven't found something better.
Caligatio 6mo ago
I am personally now drawing a clear delineation between projects for my internal consumption (e.g. ansible scripts) and projects that have potential use for the general populace. For the prior, I now host a private Forgejo instance. For the latter, I'll put it on GitHub but mirror it to my Forgejo instance. I was pleasantly shocked that Forgejo is literally a single binary with a relatively easy config. All my internal services reference my Forgejo instance so, if I need to bail on GitHub, it's low friction for me.
skrrtww 6mo ago
A "reasonable" answer is probably a primary self-hosted Forgejo instance as the canonical forge, while using GitHub as a mirror solely to take advantage of its free CI, while that lasts, while hosting secrets with a dedicated secret-hosting provider (I don't know what the provider du jour for this is these days).
- latchkey 6mo ago
  Replace a whole 24/7 team of devops people with myself? As much as I'd like to believe that I'm worthy, I'm not.
  - skrrtww 6mo ago
    If the primary forge's only job is to host the actual Git infrastructure (the code, the MRs, the issues, maybe a wiki), it's a lot more simple than GitHub, and probably more within the scope of what people can reasonably administer themselves.
    - latchkey 6mo ago
      I hosted the first "java.apache.org". I was an early employee at CollabNet, and in the first discussions around starting subversion. I worked on Cloud Foundry. This stuff isn't easy and I'm more than happy letting someone else do it at the expense of some downtime.
  - slopinthebag 6mo ago
    24/7 devops team for a forgejo instance? Come on mate...
    - latchkey 6mo ago
      24/7 devops team for github? Come on mate...
      - slopinthebag 6mo ago
TZubiri 6mo ago
just git
crimsonnoodle58 6mo ago
Self hosted gitlab behind a VPN. The all-in-docker image and a couple of gitlab runners is all small to medium sized teams need. (Don't overcomplicate it with the kubernetes version unless you really need it)
asa977 6mo ago
We moved from github to a self-hosted forgejo instance about 6 months ago, works like a charm. Still can't belive how snappy forgejo is / laggy github has become
- latchkey 6mo ago
  Is it public or locked down? https://news.ycombinator.com/item?id=47941590 https://news.ycombinator.com/item?id=47941590
trashb 6mo ago
No worries Thomas Dohmke has you covered with his new project. https://news.ycombinator.com/item?id=46961345 https://news.ycombinator.com/item?id=46961345 https://news.ycombinator.com/item?id=47712656 https://news.ycombinator.com/item?id=47712656

gtech1 6mo ago

GitLab ?

latchkey 6mo ago
The people who suggest gitlab, haven't used it. But I guess I could be tempted to try again... https://status.gitlab.com/pages/history/5b36dc6502d06804c08349f7 https://status.gitlab.com/pages/history/5b36dc6502d06804c083...
- capitalhilbilly 6mo ago
  If you could only choose from github, gitlab and atlassan then I suppose.. But really anything newer that stays in existance has to be focused on quality from early enough to not be defined by path dependence problems and bad choices like those 3.
  - latchkey 6mo ago
    Given that github is imploding under a lot of load, everyone leaving github for something else, actually makes github better.
- gtech1 6mo ago
  Ah, you assumed I meant SaaS GitLab. I meant the self-hosted version. I would never host our source code on a remote service.
  - latchkey 6mo ago
    Why not?
    - gtech1 6mo ago
      Because I don't trust someone else to not train or steal our source code, or, even legally, introduce some silly cause after we are invested/locked into their infra, that allows them to do whatever with our property. And on equal footing, I trust our security more than theirs. Case in point.
himata4113 6mo ago
Me and my friends call it CveLab because there was a time where there was a critical security update every week or multiple times a week.

chucky_z 6mo ago

.... git? replace it with git. if you want a whole ui you can use something like forgejo which has far fewer features likely leading to less issues.

latchkey 6mo ago
i want what github offers.
- heliumtera 6mo ago
  Enjoy your experience, there will certainly be no end to it.
  - latchkey 6mo ago
    I've had my account since 2008. ¯\_(ツ)_/¯ updated: changed the date to 2008. my account shows 2001, but that's probably from projects I moved over... proof: https://github.com/lookfirst https://github.com/lookfirst
    - sitzkrieg 6mo ago
      i just deleted my account of 2008. github sucks
    - necubi 6mo ago
      GitHub launched in 2008, so that seems unlikely?
    - seanclayton 6mo ago
      Just be careful your patronage doesn't lead to a sunk cost fallacy---a middle manager might just be betting on it
      - latchkey 6mo ago
        I have no ingrained loyalty, I just haven't found something better.

Caligatio 6mo ago

I am personally now drawing a clear delineation between projects for my internal consumption (e.g. ansible scripts) and projects that have potential use for the general populace. For the prior, I now host a private Forgejo instance. For the latter, I'll put it on GitHub but mirror it to my Forgejo instance. I was pleasantly shocked that Forgejo is literally a single binary with a relatively easy config. All my internal services reference my Forgejo instance so, if I need to bail on GitHub, it's low friction for me.

skrrtww 6mo ago

A "reasonable" answer is probably a primary self-hosted Forgejo instance as the canonical forge, while using GitHub as a mirror solely to take advantage of its free CI, while that lasts, while hosting secrets with a dedicated secret-hosting provider (I don't know what the provider du jour for this is these days).

latchkey 6mo ago
Replace a whole 24/7 team of devops people with myself? As much as I'd like to believe that I'm worthy, I'm not.
- skrrtww 6mo ago
  If the primary forge's only job is to host the actual Git infrastructure (the code, the MRs, the issues, maybe a wiki), it's a lot more simple than GitHub, and probably more within the scope of what people can reasonably administer themselves.
  - latchkey 6mo ago
    I hosted the first "java.apache.org". I was an early employee at CollabNet, and in the first discussions around starting subversion. I worked on Cloud Foundry. This stuff isn't easy and I'm more than happy letting someone else do it at the expense of some downtime.
- slopinthebag 6mo ago
  24/7 devops team for a forgejo instance? Come on mate...
  - latchkey 6mo ago
    24/7 devops team for github? Come on mate...
    - slopinthebag 6mo ago

TZubiri 6mo ago

just git

crimsonnoodle58 6mo ago

Self hosted gitlab behind a VPN. The all-in-docker image and a couple of gitlab runners is all small to medium sized teams need. (Don't overcomplicate it with the kubernetes version unless you really need it)

asa977 6mo ago

We moved from github to a self-hosted forgejo instance about 6 months ago, works like a charm. Still can't belive how snappy forgejo is / laggy github has become

latchkey 6mo ago
Is it public or locked down? https://news.ycombinator.com/item?id=47941590 https://news.ycombinator.com/item?id=47941590

trashb 6mo ago

No worries Thomas Dohmke has you covered with his new project. https://news.ycombinator.com/item?id=46961345 https://news.ycombinator.com/item?id=46961345 https://news.ycombinator.com/item?id=47712656 https://news.ycombinator.com/item?id=47712656