6 ms·

Everyone seems to be leaving GitHub, and forgetting the entire spirit of what git is in my eyes. Git was always meant to be decentralized, the problem here is t

Everyone seems to be leaving GitHub, and forgetting the entire spirit of what git is in my eyes. Git was always meant to be decentralized, the problem here is that all the tooling around git was centralized to GitHub because it was a cleaner experience, they scaled nicely, and were properly maintained. I would prefer to still see mirrors on GitHub that are auto-synched because I've seen projects for years either self-host or go somewhere niche, then the GitHub mirror dies or is removed, and said projects go poof to the sands of time for one reason or another, completely gone. Everyone seems to be picking some random git host alternative, and some of them are really simple to use. Git is decentralized, GitHub is just another place you can host your code in, but you can push your code to multiple remote servers.

limagnolia 6mo ago
Forgejo is doing a lot of work to make the tooling decentralized, too. They are using open protocols and standards to link self hosted forges together.
- hperrin 6mo ago
  I can’t wait for federation in Forgejo. With that, there’s honestly no reason not to host your own forge.
  - Ritewut 6mo ago
    The reason will be that not everyone wants to deal wit maintaining a self-hosted box.
    - trueno 6mo ago
      my eyes have been glazing over it feels like our infra/devops dudes have proverbially given up and they're just looking to buy cloud services to do everything now. security guy looks like he wants to jump off a bridge and i keep trying to nudge them into waking up to not needing 99.9% uptime we'll settle with 95% uptime and no one needs to be on call, and you can go to sleep at night knowing all the code lives behind your damn fort knox firewall company intranet and 75 layers of authentication. it's interesting because the more paid services these guys bring on board the more complex the security shit gets for them. the head of our IT is a fucking lunatic though and he is steering shit towards utter disaster, he's obsessed with being the guy who picks the next cloud service that "makes things so much better". my small team is actually considering just getting some mac minis and making a cluster of servers. we decided we don't need infinite uptime for hosting m-f office tools and we can just ... not interface with our infra/devops guys who have lost their damn minds and say no to everything now. they're supposed to be the compute tower under the tragedy known as TBM and they haven't approved a single VM in like 2 years.
      - lelanthran 6mo ago
        What would you use a cluster of mac minis for? I mean, if you're going that far, a couple of refurbished servers gives you far more compute and far more capacity and much better maintainability.
      - anarticle 6mo ago
        It's about offloading blame. If a server nukes, it's on infra to get a guy to unscrew it. If a service nukes, infra guy says "welp it's down", keeps on clicking. It doesn't matter what happens 6m-2y down the road, your odds of being laid off or job hopping are high in the current regime so this all makes sense. You pay some amount of your budget to make your life "easier" in the now. The trouble comes 2-5y down the line when the service is bought out by <insert MEGACORP here>, and you have to scramble to replace it or hold your nose and pay up. (tbh, migration is not that hard, but the org will act like it is) The matrix of authentications, compliances, and intranets will only go up as your company grows and often are enforced by people who do not suffer them daily.
        account42 6mo ago
        > tbh, migration is not that hard, but the org will act like it is It actually would be hard to impossible if done properly - meaning no lost information and no dead links.
        anarticle 6mo ago
        Not your problem under the hot potato model. It's not impossible and here's the other thing: it often doesn't matter if things get broken to your megacorp as long as you keep up appearances with clients. Sorry if this sounds really grim / cynical, I've simply seen enough of these kinds of migrations to know that it is fundamentally opposite of my perception of engineering philosophy. It often becomes more of a question of business rather than correctness. (Can we simply fire the smaller customers? -> yes.)
    - hirako2000 6mo ago
      it's just a few clicks, starting at 2 bucks a month. https://www.pikapods.com/apps https://www.pikapods.com/apps
  - donmcronald 6mo ago
    I would love to see it happen, but an internal service vs something exposed to the internet can be challenging. I think services like Cloudflare could play a role if they were able to provide some kind of forward auth and preferential treatment of core users during overload. My self hosted systems would have to be the source of truth and Cloudflare would have to be replaceable for me to consider using it. Think along the lines of automated pre-auth that coordinates with the origin based on some standard.
  - ranger_danger 6mo ago
    There is already federation support in radicle and vervis.
- spopejoy 6mo ago
  Plus as TFA notes, they went full copyleft: > As of v9.0 in August 2024 the project relicensed from MIT to GPLv3+, with the explicit goal of staying copyleft and resisting future commercial capture of the codebase. The value of copyleft for decentralization is too often overlooked.
gchamonlive 6mo ago
Yes, but GitHub is more than just git. The most important aspect of the platform that everybody seems to forget is the social component and how easy it made to create a persistent, off-site repository and collaborate across repos.
- MrFurious 6mo ago
  The "social component" is a big problem in actual FOSS.
  - rapnie 6mo ago
    People forget what FOSS is, and you get a world of unclear expectations. FOSS is code + a copyright license. How the code is created is an entirely different matter, and where FOSS projects often fall short. As FOSS projects come Forgejo is well-organized around a community governance model.
    - brunoborges 6mo ago
      Indeed, the fact that maintainers didn't have until only recently the control for disabling Pull Requests tab in a GitHub repo, is what drove a lot of issues in FOSS collaboration over the past decade. FOSS and open source licenses never ever granted entitlement for contributors to have their proposals reviewed/merged by maintainers. Neither it ever offered entitlement for users to ask for free support. FOSS is about giving people access to source code so they can do with it whatever they want, and maintainers/authors should have always had the ability to "publish and forget" the source code, without having to deal with those "entitlements".
  - bbor 6mo ago
    IDK, it's hard to criticize the community too much given how wildly, absurdly successful it is. If I arrived on Earth yesterday and you tried to tell me how much software is Free/free in an otherwise-capitalist economy, I wouldn't believe you! I really really am not trying to start a political argument, but just as food for thought: this is exactly why I have faith in socialism (read: 'prosocial institutions and norms'). And whether socialism is eu- or dys-topian, it certainly cannot happen in the first place without a "social component"!
_flux 6mo ago
I think you're forgetting issue tracking and CI.
- shimman 6mo ago
  Forgejo has both these things, I'd even argue Forgejo has a better runner than GitHub actions as it's less resource heavy and easier to debug when issues arise (only ran into one, and it was self inflicted).
  - _flux 6mo ago
    I have no trouble believing it is better :), but it is not as easy to mirror a Github issues, or CI configuration, to Forgejo or back as it is to handle the git side. I think Radicle is interesting. It doesn't solve the CI bit, at least not yet, but I suppose it's possible to hook up some local runner for it. There's also a bug tracker which I believe was called bug, but I can't find it ;), that tries to bridge different issue trackers and providing offline mode for working with them. People of course also love free CI capacity where they can run even untrusted code, so in that sense Microsoft resources might be difficult to compete against.
    - amusingimpala75 6mo ago
      Radicle CI does exist but it is admittedly fairly early on in development
    - xvilka 6mo ago
      There is some CI service in Radicle but it's still very barebones[1]. [1] https://radicle.network/nodes/seed.radicle.dev/rad:z3qg5TKmN83afz2fj9z3fQjU8vaYE https://radicle.network/nodes/seed.radicle.dev/rad:z3qg5TKmN...
  - treyd 6mo ago
    I really wish people would drop the GHA model because it's so bad and insecure by design. GitLab's CI is miles better and easier to use.
bayindirh 6mo ago
While I'm not forgetting the spirit of what Git is, I'm also remembering how GitHub used "all open repositories" to train their first Copilot without telling anyone. So, no thanks. I'll not be committing any personal code there anymore. And no, I don't care for the social aspects either. Discoverability, stars, and AI bot powered issue bombardment. I'm fine like this. Also, remember, "Open Source is not about You".
- dandellion 6mo ago
  Don't forget a achievement badges.
- PaulKeeble 6mo ago
  It did so in direct violation of the licenses of the code held there as well and then sold code snippets they had no rights to and still do.
  - rpdillon 6mo ago
    How did you draw those conclusions? They don't seem to be in line with court rulings (i.e. Anthropic), which hold that training is fair use. Code is being treated the same as any other copyrighted content that is used for training, from blog posts to PR announcements from companies and everything in between. Of course the blog posts are PR announcements have their copyright held by their authors, with no license provided at all, so if OSS code being used in training is a violation, then so would everything being trained on (to a first approximation...public domain works excepted). But no court has every taken that position to my knowledge. There's just so much confusion around this. In this thread alone: * Distillation is legal under copyright; the violations would come as ToS violations, which is contract law, not copyright law. * Training is legal as well, so long as the original material was obtained legally. * Moving code off of GitHub doesn't change any of this: AI companies are free to download your git repo no matter where it is hosted, just like they can any other content on a publicly accessible website. * Liability comes into the picture when the models are used to infringe copyright in their output. We'll have to see the outcome of the NYT case here, but that is proceeding at a glacial pace. I am not a lawyer; I'm an interested amateur that's been following the saga for years. I wish the discussion here on HN were more nuanced. If anyone has legal updates that render any of the above incorrect, I'd love a pointer to the decisions. One area I'm particularly weak is the legal status in countries that are not the US: I don't follow those laws nearly as carefully, nor the court cases brought.
dewey 6mo ago
I don't think anyone is forgetting that, but most people don't care that much about the decentralized part. They care about it being user friendly, free and for companies if it has all the enterprise features / SSO etc. that they need.
perkovsky 6mo ago
I agree with this. Moving the git repo is easy, moving the whole project surface is the hard part. Issues, releases, CI, docs, security advisories, search and discoverability all tend to get coupled to GitHub over time. For open-source projects, I like the idea of self-hosted as the source of truth, but still keeping a read-only GitHub mirror so people can actually find it.
- giancarlostoro 6mo ago
  ...Maybe that's the answer, we need a "hub" for the smaller missing things to start, you pop in your git repository when you join, and it can sit as a thin layer over your repo with issues, releases, etc... Sounds like a lot of work, but doing it piecemeal would do it. I think trying to re-host git itself might be more trouble than its worth. My kingdom for someone to build this so I don't have to use ADO boards anymore.
  - radlad 6mo ago
    Like some kind of UI over a database scraped by code which understands Github, Forgejo, Gitlab, sr.ht, etc? One issue is that issues tend to be monotonically increasing numbers, and references to old issues vs. new issues get confusing over time.
- cmrdporcupine 6mo ago
  The ideal situation is to eliminate thinking that the thought process for "actually finding" a project == GitHub. We let Microsoft parasitize our brains with this. The software community has long had alternate forums. GitHub isn't even a particularly good one, and it's recently just become a swamp of generated content, fake stars, and mining your content. In the last couple months at least once a week I get some LLM generated phishing spam from some bot that "found your projects on GitHub and want to collaborate" etc. And it's well documented now how you can just go out and "buy" GitHub stars. Please. Cut the umbilical.
pixlmint 6mo ago
GitHub centralizes 2 things: Authentication, as well as Repository Hosting. Does the code really need to be hosted in a central location like this? (Clearly not, which is why people are leaving GitHub in the first place) But the one part GitHub provides that's genuinely valuable is the social aspect, and when you get a PR from a user named torvalds you can trust that this is in fact Linus. This isn't the case with more distributed systems. That's why I'd really like to see some entity handle just the auth/identity providing. Forgejo/ Gitea/ Gitlab instances can then choose to use that. Then, for example if you want to take on another contributor and they have their own forgejo instances, you can invite them through this provider, when they fork your repo it ends up in their own forgejo, and they can easily create PR's into your repo.
- deleted 6mo ago
  [deleted]
- lorecore 6mo ago
  Signed commits could solve this in a more decentralized way if people post their public keys on their own domains.
  - skydhash 6mo ago
    Own domains is the real deal. My preffered model is tarball releases with checksums, or better yet, with signatures (like remind[0] or msmtp[1]). Such pages are trivial to host properly and loads quickly. [0]: https://dianne.skoll.ca/projects/remind/ https://dianne.skoll.ca/projects/remind/ [1]: https://marlam.de/msmtp/download/ https://marlam.de/msmtp/download/
    - account42 6mo ago
      I was confused for a bit what those two projects have to do with signatures but I guess you are just using them as examples of having (PGP) signatures for downloads?
- giancarlostoro 6mo ago
  > That's why I'd really like to see some entity handle just the auth/identity providing. Forgejo/ Gitea/ Gitlab instances can then choose to use that. Then, for example if you want to take on another contributor and they have their own forgejo instances, you can invite them through this provider, when they fork your repo it ends up in their own forgejo, and they can easily create PR's into your repo. Agree, I feel like a true alternative should focus on this missing piece to bridge the gap.
mamcx 6mo ago
"Git is decentralized" Because is a kind of filesystem. How a TEAM operate IS NOT. And that is the point of Github. There is no escape to the coordination problem! (And if you say mails, patches, and other asynchronous ways: same thing, more complex)
locknitpicker 6mo ago
> Everyone seems to be leaving GitHub, and forgetting the entire spirit of what git is in my eyes. And here lies your misconception: services such as GitHub are really not about git. That's a red herring. It's not about tooling either. People use services such as GitHub because of things like issue management, access control, release management, project pages, and CICD integration. You click on a button and you create a repository that's automatically added to your organization, with all access controls sorted out. You click on a button and you grant read access to someone. You click on a button and you onboard a whole team. Underneath it all, it's completely irrelevant if you are even using Git. Some people even use github's CLI interface instead. Does it matter if it's git or not? Do you even care? I have personal projects hosted and mirrored across GitHub, Gitlab, and BitBucket. That works, but only as far as backups are concerned. Even in projects that onboarded onto a third party CICD system, git is really not the reason for picking one service over another.
Daviey 6mo ago
This was the original model of launchpad.net, it was supposed to be a hub of Foss that pulled in from the decentralised VCS's, and provide them all via bzr. But bzr lost the battle, Canonical was slow to adopt Git, lack of investment in the platform, so it was another lunch that got taken from them.
- account42 6mo ago
  Canonical should just rename themselves to Not Invented Here. Their inability to work with others and instead reinventing the same thing badly is beyond comical at this point.
  - Daviey 6mo ago
    Interesting, got some examples of things they reinvented?
marxism 6mo ago
Something nobody's really calling out: Forgejo is genuinely hackable. I just added a "showcase" mode to my instance: private repos can show their README and root file listing publicly (so I can advertise that a project exists and what it does), but viewing actual code, cloning, issues, PRs are all locked behind group membership. About an hour of work, small and frankly trivial diff: https://peoplesgrocers.com/code/forks/forgejo/pulls/1 https://peoplesgrocers.com/code/forks/forgejo/pulls/1 I didn't have to fight the architecture at all, the seams were right where I needed them. Added migration adding a boolean column to the repo config table, a few tweaks in permission middleware, and voila, it just worked. Really excellent decoupling in the Forgejo codebase [1] You can't do anything like this with GitHub. That's the actual freedom! Separate from the where-do-I-host-my-git question. There is a big difference between software that "sure technically I can change it since I have access to the source" vs software that's been constructed specifically to be customized and changed. [1] Permission checks live in obvious places, the template system let me modify UI without touching unrelated code. Someone (many someones) clearly cared a lot about keeping this codebase modifiable by outsiders, and it shows. That's hard to do and should be more celebrated.
the__alchemist 6mo ago
I do not mean for this to come across as a nit, but think it's worth stating explicitly: > Everyone seems to be leaving GitHub A small minority is leaving Github; this group is more likely to write articles about the choice than those who still use Github.
- account42 6mo ago
  It always starts with a small minority. In this case, it already includes some very well known projects.
Dwedit 6mo ago
Is the tooling really centralized around Github? I use TortoiseGit, and that doesn't seem to care which service you are using. Although it does seem to have special authentication features specifically made to help you log in to Github.
cortesoft 6mo ago
A lot of the complains in the blog post would still be there, though, even if GitHub was just a mirror (the AI training stuff, the US jurisdiction concerns).
throw1234567891 6mo ago
Nobody’s forgetting anything. People want tooling around git bare repos. GitHub was cool because of forks and instant forked repos. That’s how they’ve established their moat.
mattlutze 6mo ago
[dead]
dark-star 6mo ago
That "everyone" is just a small, vocal community if you look at the total numbers of repos on GitHub (which is still climbing)[1] Yes, I understand that people are upset about the Copilot issues and maybe even the "frequent" outages (which usually only affect fringe parts of the site not everyone uses daily) It's good that there are other solutions (forge, sourcehut, whatever) but most projects are still alive and very well on GitHub and my guess is that this will stay for a while. Also, personally I have no issues with GitHub training AI on my (badly-coded and bug-ridden) code if they really want to :) [1] https://www.reddit.com/r/github/comments/1snqyj3/is_there_an_official_count_of_daily_github_repos/ https://www.reddit.com/r/github/comments/1snqyj3/is_there_an...
- account42 6mo ago
  Why do you think total numbers of repos is a relevant metric here? If anything, the slop spam on GitHub is a problem and a core part of why people are leaving.
  - dark-star 6mo ago
    that might be true, yes, but still: the burden of proof (that "github is dying") lies with the original poster. A statement like "last week, these 3 big projects left GitHub" is not that
f33d5173 6mo ago
Not everybody uses git because they're infatuated with "the spirit of git". Only a tiny minority have ever even used it with the patches-by-email model it's intended for, and I would guess the vast majority of the rest have no interest in learning. People use git basically because it's what github uses, or slightly more generously because it works well when paired with a centralized host like github. The model of developing code locally and dicussion issues and patches via a web portal is the model people are taken with. Only a small portion of that is provided by git proper.
- IanCal 6mo ago
  Although that only requires a centralised host per repo.
midtake 6mo ago
Everyone knows git is decentralized. What people are searching for is a space for the social component of development such as issue tracking. Being able to reference lines of codes in issues is a killer feature of github. Gitea and gitlab do it too but not as well. Also "just use multiple remotes" doesn't solve the problem. If you don't trust GitHub you shouldn't be pushing code there to begin with. So the ideal platform for hosting an equivalent platform as Github needs to be a trusted one as well.
tonymet 6mo ago
github's draw is the community and exposure.
HiPhish 6mo ago
> Git is decentralized, GitHub is just another place you can host your code in, but you can push your code to multiple remote servers. That's precisely what I have been doing for years, I still get to keep one foot in the GitHub ecosystem. I still get most contributions on GitHub, and that's fine by me. When a PR comes it I check it out locally, review it, and when it's done I merge locally to master, push to origin, and then origin pushes to GitHub which then automatically closes the PR and gives the author attribution. I never actually have to interact with GitHub after the initial pull.
- nijave 6mo ago
  Where do review comments go? What if changes are needed?
hk1337 6mo ago
While that is true, the real power of git being decentralized is that you have a local repo and a remote repo. Typically, you’ll have a dozen local repositories from developers cloning the project
dskoll 6mo ago
I will not put anything on GitHub for a couple of reasons. 1) MSFT is using our free labour to train its AIs. 2) Being Canadian, I do not want any dependence on a US-based company, seeing as the US can no longer be considered a trustworthy ally.

limagnolia 6mo ago

Forgejo is doing a lot of work to make the tooling decentralized, too. They are using open protocols and standards to link self hosted forges together.

hperrin 6mo ago
I can’t wait for federation in Forgejo. With that, there’s honestly no reason not to host your own forge.
- Ritewut 6mo ago
  The reason will be that not everyone wants to deal wit maintaining a self-hosted box.
  - trueno 6mo ago
    my eyes have been glazing over it feels like our infra/devops dudes have proverbially given up and they're just looking to buy cloud services to do everything now. security guy looks like he wants to jump off a bridge and i keep trying to nudge them into waking up to not needing 99.9% uptime we'll settle with 95% uptime and no one needs to be on call, and you can go to sleep at night knowing all the code lives behind your damn fort knox firewall company intranet and 75 layers of authentication. it's interesting because the more paid services these guys bring on board the more complex the security shit gets for them. the head of our IT is a fucking lunatic though and he is steering shit towards utter disaster, he's obsessed with being the guy who picks the next cloud service that "makes things so much better". my small team is actually considering just getting some mac minis and making a cluster of servers. we decided we don't need infinite uptime for hosting m-f office tools and we can just ... not interface with our infra/devops guys who have lost their damn minds and say no to everything now. they're supposed to be the compute tower under the tragedy known as TBM and they haven't approved a single VM in like 2 years.
    - lelanthran 6mo ago
      What would you use a cluster of mac minis for? I mean, if you're going that far, a couple of refurbished servers gives you far more compute and far more capacity and much better maintainability.
    - anarticle 6mo ago
      It's about offloading blame. If a server nukes, it's on infra to get a guy to unscrew it. If a service nukes, infra guy says "welp it's down", keeps on clicking. It doesn't matter what happens 6m-2y down the road, your odds of being laid off or job hopping are high in the current regime so this all makes sense. You pay some amount of your budget to make your life "easier" in the now. The trouble comes 2-5y down the line when the service is bought out by <insert MEGACORP here>, and you have to scramble to replace it or hold your nose and pay up. (tbh, migration is not that hard, but the org will act like it is) The matrix of authentications, compliances, and intranets will only go up as your company grows and often are enforced by people who do not suffer them daily.
      - account42 6mo ago
        > tbh, migration is not that hard, but the org will act like it is It actually would be hard to impossible if done properly - meaning no lost information and no dead links.
        anarticle 6mo ago
        Not your problem under the hot potato model. It's not impossible and here's the other thing: it often doesn't matter if things get broken to your megacorp as long as you keep up appearances with clients. Sorry if this sounds really grim / cynical, I've simply seen enough of these kinds of migrations to know that it is fundamentally opposite of my perception of engineering philosophy. It often becomes more of a question of business rather than correctness. (Can we simply fire the smaller customers? -> yes.)
  - hirako2000 6mo ago
    it's just a few clicks, starting at 2 bucks a month. https://www.pikapods.com/apps https://www.pikapods.com/apps
- donmcronald 6mo ago
  I would love to see it happen, but an internal service vs something exposed to the internet can be challenging. I think services like Cloudflare could play a role if they were able to provide some kind of forward auth and preferential treatment of core users during overload. My self hosted systems would have to be the source of truth and Cloudflare would have to be replaceable for me to consider using it. Think along the lines of automated pre-auth that coordinates with the origin based on some standard.
- ranger_danger 6mo ago
  There is already federation support in radicle and vervis.
spopejoy 6mo ago
Plus as TFA notes, they went full copyleft: > As of v9.0 in August 2024 the project relicensed from MIT to GPLv3+, with the explicit goal of staying copyleft and resisting future commercial capture of the codebase. The value of copyleft for decentralization is too often overlooked.

gchamonlive 6mo ago

Yes, but GitHub is more than just git. The most important aspect of the platform that everybody seems to forget is the social component and how easy it made to create a persistent, off-site repository and collaborate across repos.

MrFurious 6mo ago
The "social component" is a big problem in actual FOSS.
- rapnie 6mo ago
  People forget what FOSS is, and you get a world of unclear expectations. FOSS is code + a copyright license. How the code is created is an entirely different matter, and where FOSS projects often fall short. As FOSS projects come Forgejo is well-organized around a community governance model.
  - brunoborges 6mo ago
    Indeed, the fact that maintainers didn't have until only recently the control for disabling Pull Requests tab in a GitHub repo, is what drove a lot of issues in FOSS collaboration over the past decade. FOSS and open source licenses never ever granted entitlement for contributors to have their proposals reviewed/merged by maintainers. Neither it ever offered entitlement for users to ask for free support. FOSS is about giving people access to source code so they can do with it whatever they want, and maintainers/authors should have always had the ability to "publish and forget" the source code, without having to deal with those "entitlements".
- bbor 6mo ago
  IDK, it's hard to criticize the community too much given how wildly, absurdly successful it is. If I arrived on Earth yesterday and you tried to tell me how much software is Free/free in an otherwise-capitalist economy, I wouldn't believe you! I really really am not trying to start a political argument, but just as food for thought: this is exactly why I have faith in socialism (read: 'prosocial institutions and norms'). And whether socialism is eu- or dys-topian, it certainly cannot happen in the first place without a "social component"!

_flux 6mo ago

I think you're forgetting issue tracking and CI.

shimman 6mo ago
Forgejo has both these things, I'd even argue Forgejo has a better runner than GitHub actions as it's less resource heavy and easier to debug when issues arise (only ran into one, and it was self inflicted).
- _flux 6mo ago
  I have no trouble believing it is better :), but it is not as easy to mirror a Github issues, or CI configuration, to Forgejo or back as it is to handle the git side. I think Radicle is interesting. It doesn't solve the CI bit, at least not yet, but I suppose it's possible to hook up some local runner for it. There's also a bug tracker which I believe was called bug, but I can't find it ;), that tries to bridge different issue trackers and providing offline mode for working with them. People of course also love free CI capacity where they can run even untrusted code, so in that sense Microsoft resources might be difficult to compete against.
  - amusingimpala75 6mo ago
    Radicle CI does exist but it is admittedly fairly early on in development
  - xvilka 6mo ago
    There is some CI service in Radicle but it's still very barebones[1]. [1] https://radicle.network/nodes/seed.radicle.dev/rad:z3qg5TKmN83afz2fj9z3fQjU8vaYE https://radicle.network/nodes/seed.radicle.dev/rad:z3qg5TKmN...
- treyd 6mo ago
  I really wish people would drop the GHA model because it's so bad and insecure by design. GitLab's CI is miles better and easier to use.

bayindirh 6mo ago

While I'm not forgetting the spirit of what Git is, I'm also remembering how GitHub used "all open repositories" to train their first Copilot without telling anyone. So, no thanks. I'll not be committing any personal code there anymore. And no, I don't care for the social aspects either. Discoverability, stars, and AI bot powered issue bombardment. I'm fine like this. Also, remember, "Open Source is not about You".

dandellion 6mo ago
Don't forget a achievement badges.
PaulKeeble 6mo ago
It did so in direct violation of the licenses of the code held there as well and then sold code snippets they had no rights to and still do.
- rpdillon 6mo ago
  How did you draw those conclusions? They don't seem to be in line with court rulings (i.e. Anthropic), which hold that training is fair use. Code is being treated the same as any other copyrighted content that is used for training, from blog posts to PR announcements from companies and everything in between. Of course the blog posts are PR announcements have their copyright held by their authors, with no license provided at all, so if OSS code being used in training is a violation, then so would everything being trained on (to a first approximation...public domain works excepted). But no court has every taken that position to my knowledge. There's just so much confusion around this. In this thread alone: * Distillation is legal under copyright; the violations would come as ToS violations, which is contract law, not copyright law. * Training is legal as well, so long as the original material was obtained legally. * Moving code off of GitHub doesn't change any of this: AI companies are free to download your git repo no matter where it is hosted, just like they can any other content on a publicly accessible website. * Liability comes into the picture when the models are used to infringe copyright in their output. We'll have to see the outcome of the NYT case here, but that is proceeding at a glacial pace. I am not a lawyer; I'm an interested amateur that's been following the saga for years. I wish the discussion here on HN were more nuanced. If anyone has legal updates that render any of the above incorrect, I'd love a pointer to the decisions. One area I'm particularly weak is the legal status in countries that are not the US: I don't follow those laws nearly as carefully, nor the court cases brought.

dewey 6mo ago

I don't think anyone is forgetting that, but most people don't care that much about the decentralized part. They care about it being user friendly, free and for companies if it has all the enterprise features / SSO etc. that they need.

perkovsky 6mo ago

I agree with this. Moving the git repo is easy, moving the whole project surface is the hard part. Issues, releases, CI, docs, security advisories, search and discoverability all tend to get coupled to GitHub over time. For open-source projects, I like the idea of self-hosted as the source of truth, but still keeping a read-only GitHub mirror so people can actually find it.

giancarlostoro 6mo ago
...Maybe that's the answer, we need a "hub" for the smaller missing things to start, you pop in your git repository when you join, and it can sit as a thin layer over your repo with issues, releases, etc... Sounds like a lot of work, but doing it piecemeal would do it. I think trying to re-host git itself might be more trouble than its worth. My kingdom for someone to build this so I don't have to use ADO boards anymore.
- radlad 6mo ago
  Like some kind of UI over a database scraped by code which understands Github, Forgejo, Gitlab, sr.ht, etc? One issue is that issues tend to be monotonically increasing numbers, and references to old issues vs. new issues get confusing over time.
cmrdporcupine 6mo ago
The ideal situation is to eliminate thinking that the thought process for "actually finding" a project == GitHub. We let Microsoft parasitize our brains with this. The software community has long had alternate forums. GitHub isn't even a particularly good one, and it's recently just become a swamp of generated content, fake stars, and mining your content. In the last couple months at least once a week I get some LLM generated phishing spam from some bot that "found your projects on GitHub and want to collaborate" etc. And it's well documented now how you can just go out and "buy" GitHub stars. Please. Cut the umbilical.

pixlmint 6mo ago

GitHub centralizes 2 things: Authentication, as well as Repository Hosting. Does the code really need to be hosted in a central location like this? (Clearly not, which is why people are leaving GitHub in the first place) But the one part GitHub provides that's genuinely valuable is the social aspect, and when you get a PR from a user named torvalds you can trust that this is in fact Linus. This isn't the case with more distributed systems. That's why I'd really like to see some entity handle just the auth/identity providing. Forgejo/ Gitea/ Gitlab instances can then choose to use that. Then, for example if you want to take on another contributor and they have their own forgejo instances, you can invite them through this provider, when they fork your repo it ends up in their own forgejo, and they can easily create PR's into your repo.

deleted 6mo ago
[deleted]
lorecore 6mo ago
Signed commits could solve this in a more decentralized way if people post their public keys on their own domains.
- skydhash 6mo ago
  Own domains is the real deal. My preffered model is tarball releases with checksums, or better yet, with signatures (like remind[0] or msmtp[1]). Such pages are trivial to host properly and loads quickly. [0]: https://dianne.skoll.ca/projects/remind/ https://dianne.skoll.ca/projects/remind/ [1]: https://marlam.de/msmtp/download/ https://marlam.de/msmtp/download/
  - account42 6mo ago
    I was confused for a bit what those two projects have to do with signatures but I guess you are just using them as examples of having (PGP) signatures for downloads?
giancarlostoro 6mo ago
> That's why I'd really like to see some entity handle just the auth/identity providing. Forgejo/ Gitea/ Gitlab instances can then choose to use that. Then, for example if you want to take on another contributor and they have their own forgejo instances, you can invite them through this provider, when they fork your repo it ends up in their own forgejo, and they can easily create PR's into your repo. Agree, I feel like a true alternative should focus on this missing piece to bridge the gap.

mamcx 6mo ago

"Git is decentralized" Because is a kind of filesystem. How a TEAM operate IS NOT. And that is the point of Github. There is no escape to the coordination problem! (And if you say mails, patches, and other asynchronous ways: same thing, more complex)

locknitpicker 6mo ago

> Everyone seems to be leaving GitHub, and forgetting the entire spirit of what git is in my eyes. And here lies your misconception: services such as GitHub are really not about git. That's a red herring. It's not about tooling either. People use services such as GitHub because of things like issue management, access control, release management, project pages, and CICD integration. You click on a button and you create a repository that's automatically added to your organization, with all access controls sorted out. You click on a button and you grant read access to someone. You click on a button and you onboard a whole team. Underneath it all, it's completely irrelevant if you are even using Git. Some people even use github's CLI interface instead. Does it matter if it's git or not? Do you even care? I have personal projects hosted and mirrored across GitHub, Gitlab, and BitBucket. That works, but only as far as backups are concerned. Even in projects that onboarded onto a third party CICD system, git is really not the reason for picking one service over another.

Daviey 6mo ago

This was the original model of launchpad.net, it was supposed to be a hub of Foss that pulled in from the decentralised VCS's, and provide them all via bzr. But bzr lost the battle, Canonical was slow to adopt Git, lack of investment in the platform, so it was another lunch that got taken from them.

account42 6mo ago
Canonical should just rename themselves to Not Invented Here. Their inability to work with others and instead reinventing the same thing badly is beyond comical at this point.
- Daviey 6mo ago
  Interesting, got some examples of things they reinvented?

marxism 6mo ago

Something nobody's really calling out: Forgejo is genuinely hackable. I just added a "showcase" mode to my instance: private repos can show their README and root file listing publicly (so I can advertise that a project exists and what it does), but viewing actual code, cloning, issues, PRs are all locked behind group membership. About an hour of work, small and frankly trivial diff: https://peoplesgrocers.com/code/forks/forgejo/pulls/1 https://peoplesgrocers.com/code/forks/forgejo/pulls/1 I didn't have to fight the architecture at all, the seams were right where I needed them. Added migration adding a boolean column to the repo config table, a few tweaks in permission middleware, and voila, it just worked. Really excellent decoupling in the Forgejo codebase [1] You can't do anything like this with GitHub. That's the actual freedom! Separate from the where-do-I-host-my-git question. There is a big difference between software that "sure technically I can change it since I have access to the source" vs software that's been constructed specifically to be customized and changed. [1] Permission checks live in obvious places, the template system let me modify UI without touching unrelated code. Someone (many someones) clearly cared a lot about keeping this codebase modifiable by outsiders, and it shows. That's hard to do and should be more celebrated.

the__alchemist 6mo ago

I do not mean for this to come across as a nit, but think it's worth stating explicitly: > Everyone seems to be leaving GitHub A small minority is leaving Github; this group is more likely to write articles about the choice than those who still use Github.

account42 6mo ago
It always starts with a small minority. In this case, it already includes some very well known projects.

Dwedit 6mo ago

Is the tooling really centralized around Github? I use TortoiseGit, and that doesn't seem to care which service you are using. Although it does seem to have special authentication features specifically made to help you log in to Github.

cortesoft 6mo ago

A lot of the complains in the blog post would still be there, though, even if GitHub was just a mirror (the AI training stuff, the US jurisdiction concerns).

throw1234567891 6mo ago

Nobody’s forgetting anything. People want tooling around git bare repos. GitHub was cool because of forks and instant forked repos. That’s how they’ve established their moat.

mattlutze 6mo ago

[dead]

dark-star 6mo ago

That "everyone" is just a small, vocal community if you look at the total numbers of repos on GitHub (which is still climbing)[1] Yes, I understand that people are upset about the Copilot issues and maybe even the "frequent" outages (which usually only affect fringe parts of the site not everyone uses daily) It's good that there are other solutions (forge, sourcehut, whatever) but most projects are still alive and very well on GitHub and my guess is that this will stay for a while. Also, personally I have no issues with GitHub training AI on my (badly-coded and bug-ridden) code if they really want to :) [1] https://www.reddit.com/r/github/comments/1snqyj3/is_there_an_official_count_of_daily_github_repos/ https://www.reddit.com/r/github/comments/1snqyj3/is_there_an...

account42 6mo ago
Why do you think total numbers of repos is a relevant metric here? If anything, the slop spam on GitHub is a problem and a core part of why people are leaving.
- dark-star 6mo ago
  that might be true, yes, but still: the burden of proof (that "github is dying") lies with the original poster. A statement like "last week, these 3 big projects left GitHub" is not that

f33d5173 6mo ago

Not everybody uses git because they're infatuated with "the spirit of git". Only a tiny minority have ever even used it with the patches-by-email model it's intended for, and I would guess the vast majority of the rest have no interest in learning. People use git basically because it's what github uses, or slightly more generously because it works well when paired with a centralized host like github. The model of developing code locally and dicussion issues and patches via a web portal is the model people are taken with. Only a small portion of that is provided by git proper.

IanCal 6mo ago
Although that only requires a centralised host per repo.

midtake 6mo ago

Everyone knows git is decentralized. What people are searching for is a space for the social component of development such as issue tracking. Being able to reference lines of codes in issues is a killer feature of github. Gitea and gitlab do it too but not as well. Also "just use multiple remotes" doesn't solve the problem. If you don't trust GitHub you shouldn't be pushing code there to begin with. So the ideal platform for hosting an equivalent platform as Github needs to be a trusted one as well.

tonymet 6mo ago

github's draw is the community and exposure.

HiPhish 6mo ago

> Git is decentralized, GitHub is just another place you can host your code in, but you can push your code to multiple remote servers. That's precisely what I have been doing for years, I still get to keep one foot in the GitHub ecosystem. I still get most contributions on GitHub, and that's fine by me. When a PR comes it I check it out locally, review it, and when it's done I merge locally to master, push to origin, and then origin pushes to GitHub which then automatically closes the PR and gives the author attribution. I never actually have to interact with GitHub after the initial pull.

nijave 6mo ago
Where do review comments go? What if changes are needed?

hk1337 6mo ago

While that is true, the real power of git being decentralized is that you have a local repo and a remote repo. Typically, you’ll have a dozen local repositories from developers cloning the project

dskoll 6mo ago

I will not put anything on GitHub for a couple of reasons. 1) MSFT is using our free labour to train its AIs. 2) Being Canadian, I do not want any dependence on a US-based company, seeing as the US can no longer be considered a trustworthy ally.