Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub is now free for teams

github.blog

Post reply on HN
Print view View original

331–340 of 664 posts

Re: GitHub is now free for teams

#331

Post by koheripbal »

m0xte wrote: post #319
spenczar5 wrote: post #303

Earlier quoted context omitted.

> No company would invest a massive amount of money in a duplicate product. I don't mean to be rude, but have you worked at a very large company like Microsoft or Amazon or Google? Redundant products are par for the course because of the byzantine internal politics and funding structures of big companies.

Big companies like Microsoft and Google like to burn products with little notice too.

...and small companies go under or radically morph their products.

There's this irrational demand vocal on social media that large corporations keep their products forever.

Re: GitHub is now free for teams

#332

Post by MrStonedOne »

natfriedman wrote: post #96
pubby wrote: post #67

Earlier quoted context omitted.

Hey Nat glad to see you here. A few days ago one of the biggest team collaborative games (Space Station 13) got banned on GitHub without a public explanation from GitHub staff, but some suspect it was because the code contained bad words and slurs. Do you know if this is why the project was banned, and will these new private team repos be subject to the same terms/rules?

Private repos are not subject to our Community Guidelines on public content, so no, we don't enforce the same rules there: https://help.github.com/en/github/site-policy/github-communi... I wasn't aware of SS13, and will look into what happened there. Content moderation at GitHub scale is hard and sometimes mistakes are made.

I run /tg/station's servers.

A few questions:

Do you think the scale could be handled better if you informed repo owners 1: that their repo was disabled, and 2: why their repo was disabled?

Currently the owner has to contact support to know why it was disabled, our repo was disabled thursday at 5am pdt, we sent a ticket by 6am. We still don't know why it was disabled. Its tuesday. (edit: we did get a reply, vague comment about slurs, nobody's sure if its the nword word filter (so thats getting removed, ironically enough), or the comment from 2014 with a soft-a, (but it can go), or the fact that the meatball food item has a, umm, british name)).

Also, do you think the scale of content moderation would be easier if you tiered repo disables between can be resolved and can not be resolved, and in the former case provide the same 24 hours deadline that you provide line item dmcas, as well as provide access to the owner during any suspension if the 24 hours deadline is not met (That you also provide to line item dmcas)?

All of these unneeded trips to support has to be eating into the efficiency of things.

Re: GitHub is now free for teams

#333

Post by user5994461 »

Saaster wrote: post #193
derefr wrote: post #133

Earlier quoted context omitted.

Sounds like SAML needs the same "everyone gets together to make a FOSS implementation that knows about the weird quirks of all the implementations it interacts with" approach that e.g. the Samba project was founded upon.

I agree. There's a million SAML for Java/Python/Node.js/Foo libraries out there, all with a long list of issues and known cases that don't work correctly, security issues etc. but it's the wrong model in my opinion. Instead of directly bolting SAML into your app, I think a FOSS implementation of an independently running service is the way to go. You run the battle tested open source service (locally / in your cloud),…

If you want JWT tokens, you should be using OpenID Connect instead of SAML. There is very little reasons to use SAML in 2020, it's over complicated and has little support. OpenID Connect does 95% of the same, much better.

If you want self hosted IAM solutions. The most common one is Microsoft active directory. It provides both SAML and OpenID Connect integrations out of the box as of ADFS 2016.

Still, SAML requires to onboard applications individually, create keys, and stuff. It's not plug and play, it really needs humans on both sides to add a new service.

Re: GitHub is now free for teams

#334

Post by popinman322 »

pknopf wrote: post #297
natfriedman wrote: post #266

Earlier quoted context omitted.

Both products have a bright future and millions of users, and so we're continuing to invest in both for the foreseeable future. We're also finding ways to improve integration between them, so people can use them together if they want to. GitHub Actions reuses a bunch of code from Pipelines under the hood, for example.

I get that you guys want to say that publicly, but let's be real. No company would invest a massive amount of money in a duplicate product. One product will eventually starve. I guess it is up to us to guess. Anyone? I see GitHub being the unmovable giant here. Microsoft is publicly developing on it, as opposed to Azure Dev Ops. It has a very large mind-share. More developers are willing to use it without having the…

ADO is widely used inside Microsoft, with a variety of internal extensions to integrate with our internal build & deployment solutions.

AFAIK, there aren't any plans in Azure to give up ADO in favor of GitHub. If anything, with the push to standardize builds internally, it wouldn't make sense to move to GitHub for at least another 2-5 years.

Obviously, I don't speak for my employer and leadership may have other directions in mind.

Re: GitHub is now free for teams

#335

Post by user5994461 »

tptacek wrote: post #231
Saaster wrote: post #174

Earlier quoted context omitted.

Passwords, rate limits, resets, etc. are the same for everyone, and so are the problems and the solutions to those. SAML on the other hand is different for each organization. Providers pay Auth0 and the like to have developers on staff who know the pitfalls and quirks of ADFS 3.0 on Windows Server 2012 R2, so they don't have to. Dealing with a single Okta as IdP integration is like the absolute best-case scenario the…

It's a little odd to say something is not a "net security benefit" and, in the next sentence, make a powerful case for it as a net security benefit. SSO is probably the most important organization security tool there is, and a survey of tech company CSOs will average it in the top 3, if not the top 2 technology acquisitions most would make at a new firm (this is a question I've actually surveyed).

What's are the other contenders for top 3?

Re: GitHub is now free for teams

#336

Post by Haegin »

Saaster wrote: post #88
thramp wrote: post #35

Earlier quoted context omitted.

This is a great change! One request: I wish that SAML was not an enterprise feature. SAML ought be a basic security feature like 2FA—it's especially valuable for open source teams who might use a mixture of services, and an easily accessible and cheap SSO solution would go a long way in raising the security bar for all teams, not just open source teams.

SAML (and 2FA to a lesser extent) comes with some serious support burdens on the companies offering it. There's a long tail of more or less broken SAML implementations on both the service and identity provider sides, provisioning issues, configuration issues, "Sally can't login on Tuesdays" issues, duplicated slightly-inconsistent data in IdP and Service side records issues... If you as a SaaS provider outsource your…

It's a paid service, but AWS Cognito supports SAML in a similar way to Okta/Auth0 but with a much lower initial cost (you just pay a reasonable rate for what you use, not multiple thousands of dollars to get it up and running). I used it to build a SAML integration at the end of last year and have been pretty happy with it so far.

Re: GitHub is now free for teams

#337

Post by znpy »

natfriedman wrote: post #26

Hi HN, I'm the CEO of GitHub. Everyone at GitHub is really excited about this announcement, and I'm happy to answer any questions. We've wanted to make this change for the last 18 months, but needed our Enterprise business to be big enough to enable the free use of GitHub by the rest of the world. I'm happy to say that it's grown dramatically in the last year, and so we're able to make GitHub free for teams that don'…

Will there ever be an OSS version of GitHub, a la Gitlab?

Re: GitHub is now free for teams

#338

Post by sdesol »

oaiey wrote: post #301
jedberg wrote: post #114

Earlier quoted context omitted.

So far Microsoft isn’t taking customers away from AWS. They’re just expanding the total market. But I do wonder if AWS will try to buy gitlab.

While Amazon tried to go into the private hosting and ci/cd market, they are not a dev tool company. Microsoft was born as one. When Amazon or Google would buy GitLab they would meaningless integrate it, reduce staff by half and then ruin it over time. Maybe when Microsoft would have opened up some years earlier, Codeplex would not share the fate of Google Cloud.

> While Amazon tried to go into the private hosting and ci/cd market, they are not a dev tool company

When did Amazon give up?

Re: GitHub is now free for teams

#339

Post by user5994461 »

tptacek wrote: post #310
Saaster wrote: post #302

Earlier quoted context omitted.

100% agreed, GitHub SAML is unequivocally good. I'm in the "cat sharing startup", so my view and comments are colored by that perspective. Our options are to pay $$$ for a competent auth provider, or take on a much larger and complex security responsibility than it would seem at first, that might end up compromising our entire service. I have a theory that one reason we don't see many your-SAML-implementation-is-comp…

The riskiest components in SSO deployments are SP-side libraries, and those are all open source. If you want to use Okta to drive those libraries, the trial account you need is free. The worst bugs here are indeed mostly private, but that's because they're feature bugs inside of people's random products; they're like every other bug in that regard. But people do find and report bugs in the SP libraries. I agree that…

I'm surprised you'd say SP-side libraries are open source. In my experience, it's always been mostly custom and close source in every company I've seen and done.

You take some open source pieces you can (saml, xml, oidc, ssl, jwt) but permissions, groups, user attributes, keys are always per company then the whole thing together has to be supported into end-user applications running on language and frameworks of the day with their own restrictions, so custom.

Re: GitHub is now free for teams

#340

Post by FpUser »

toyg wrote: post #262
vbezhenar wrote: post #246

Earlier quoted context omitted.

We're living with transparent juridical system and it works fine. Imagine that you could be thrown to jail without explaining a reason. That would be outrageous.

> transparent juridical system and it works fine Yeah, criminals are always arrested and convicted. /s It's a balance. With something as essential as human rights and personal freedom, people (tend to) err on the safe side. Online moderation can err on the other side, since consequences are relatively modest. If you get banned on GH, move to Gitlab or host your own, that's hardly a tragedy.

That is exactly what I do. I use self hosted solutions for my source code repositories. I just can't digest my code being handled by some other entity. Too important.
Post reply on HN