logo

blog

My website can't be that messy, right? git clone https://hacktivis.me/git/blog.git

My issue with Github (and Microsoft buying it).xhtml (5499B)

    

  1. <article lang="en" class="h-entry">
  2. <a href="/articles/My%20issue%20with%20Github%20(and%20Microsoft%20buying%20it)"><h1>My issue with Github (and Microsoft buying it)</h1></a>
  3. <h2>Embrace; Extend; Extenguish</h2>
  4. <p>Microsoft and similar Corporations are well-known for doing this kind of thing, we cannot have permanent links or main forges based on something like that.
  5. Also microsoft may like Open-Source (and probably not GPL), but the same goes to Google, do we all trust Google with our and others data? Also Google Code created a pile of dead links.<br />
  6. And this post will probably evolve as Microsoft apparently haven’t finished aquiring Github.</p>
  7. <h2>Lack of Transparency / OpenData</h2>
  8. <p>Currently all the tickets aren’t available in a open manner (I know gitlab can import them, but AFAIK you need a Github account for that and control over the repository).<br />
  9. One true alternative to this that is used in real life is debbugs (used at debian) by using emails, and bugzilla with their RSS feeds.</p>
  10. <p>I also see some projects and their owner from time to time being removed from GitHub with no messages at all on their side. And looking at their <a href="https://help.github.com/articles/github-terms-of-service/#m-cancellation-and-termination">Terms of Service</a> there is a bunch of ways you can be banned. (search for "suspen" and "terminat")</p>
  11. <h2>Centralisation of Power</h2>
  12. <q>Never put all your eggs in the same basket</q>
  13. <pre><code>
  14. /usr/portage $ <kbd>cat metadata/timestamp.commit</kbd>
  15. <samp>932f2215d9f814c7ef2dd8de6593af58e2c16048 1537662482 2018-09-23T00:28:02+00:00
  16. </samp>/usr/portage $ <kbd>grep -l 'github' -r */*/metadata.xml | wc -l</kbd>
  17. <samp>5194
  18. </samp>/usr/portage $ <kbd>find */*/metadata.xml | wc -l</kbd>
  19. <samp>19549
  20. </samp>/usr/portage $ <kbd>bc -l</kbd>
  21. <kbd>(5194/19549)*100</kbd>
  22. <samp>26.56913397104711238400</samp>
  23. </code></pre>
  24. <p>So if I didn’t mess up the math there is at least over 26% of software in gentoo ports/packages that are more-or-less hosted on github. I think a better version could be obtained by incrementing one package if there is github in the metadata or the latest ebuild. It would be awesome if repology.org could have some stats on VCS providers usage btw.</p>
  25. <h2>Github is a bad interface</h2>
  26. <p>(This parts also applies to most git-based Forges)</p>
  27. <p>Pull Requests shouldn’t be the only way to send modifications, they are meant to maintainers/frequent contributors, not someone that send patches from time to time. (I love sending months of commits to github…).<br />
  28. Pull Requests also puts more burden on the contributor than on the maintainer, it means that whatever modification often have to be done by the contributor otherwise it’s not mergeable, which may know nothing about your coding policies. I’m pretty sure this is how you have long-standing PRs that became broken because other stuff came in.</p>
  29. <p>Also GitHub is very inpopular with designers and others non-coders, and for a good reason, git is meant for versioning code/text files and it does that well. But for other stuff? No, it’s basically a hack and every contributor shouldn’t have to learn git. (note: coders don’t all know git and not having PRs would just mean knowing how to use <code>diff(1)</code>).<br />
  30. And one of my favorite thing from coders is <q>but GitHub allows you to edit with a web browser</q>. Yeah, but where is rebase, ammending commits, …? There is just only one commit and a broken push. Could be acceptable for a patch, not really acceptable in most cases for something that is made to be directly merged in a branch.</p>
  31. <p>GitHub is a registered trademark of Github Inc. ; Microsoft is a registered trademark of Microsoft Corporation.</p>
  32. <h2>False Security</h2>
  33. <p>I posted about this on the fediverse before, probably on social.hacktivis.me (RIP). So here github with their dark pattern (Update is highlighted, so not enough privacy given?) is randomly asking me to confirm my account recovery settings. And it is actually bad for security because here it means that Facebook could gain access to Github Accounts. What could go wrong? (Note: I do have a bit of write access to few projects on github).</p>
  34. <p>Also I use the <abbr title="Time-based One-time Password Algorithm">TOTP</abbr> token regularly and I have recovery codes in case I would lose it (actually all stored and encrypted with <a href="https://www.passwordstore.org/">pass</a>, maybe I should change that).</p>
  35. <figure>
  36. 	<img loading="lazy" src="/images/github_confirm_recovery.png" alt="Github asking me to confirm my account recovery settings, I could risk getting locked out of my account"/>
  37. 	<img loading="lazy" src="/images/github_confirm_recovery_expanded.png" alt="Same but tooltips extended to see that “Recovery Tokens” is actually a sign-in with facebook in disguise"/>
  38. </figure>
  39. <p>One thing I wonder is: <a href="https://queer.hacktivis.me/objects/aeb38dc5-61c9-47c9-b2c6-2827dc80dcb9">Is github putting a similar thing to people not using token?</a>. 2FA is quite useless in my case so I could remove tokens, and I could quite imagine other people doing that but on which 2FA actually increases security. Woops, less people being secure because of a bad design. (Also security ≠ usability is bullshit, but that will be for a later time)</p>
  40. <p><a href="https://queer.hacktivis.me/objects/4e657d4d-8eb2-40a2-af0d-1b2ec9531fe4">Post for comments and sharing on the fediverse.</a></p>
  41. </article>