Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: GitHub will delete your private repo if you lose access to the original

news.ycombinator.com

Post reply on HN
Print view View original

221–230 of 294 posts

Re: Tell HN: GitHub will delete your private repo if you lose access to the original

#221

Post by geraldwhen »

pavon wrote: post #101
Mystery-Machine wrote: post #57

Earlier quoted context omitted.

GitHub is not supposed to make such decisions for the user here. It is user's responsibility to make sure they delete their private forks if they shouldn't have access to the repo/fork anymore. What's next? Should we all install spyware on our computers and let GitHub automatically delete local copies of forks as well? GitHub and the company/person, who deleted the original private repo, should inform the owner of th…

I think this incident reinforces that private repos on github.com are a weird hybrid of the public github and on-premise github which creates various practical problems and misunderstandings when those two security models collide. First off is the fact that forking a repo is often a necessary step in contributing to project if you don't have push permission, so these forks will be created during the normal developmen…

Enterprise Managed Users solves the issue.

Re: Tell HN: GitHub will delete your private repo if you lose access to the original

#222

Post by hoherd »

naikrovek wrote: post #127
evouga wrote: post #107

Earlier quoted context omitted.

This doesn’t make any sense to me. My private forks are * mine* and I most certainly do not want GitHub guessing at whether and when to permanently delete them without my consent. Companies of course have the right to manage access to their proprietary source code, for example by only giving access to corporate accounts under their control and reclaiming those accounts when an employee leaves.

> My private forks are mine Not if you create them using the "Fork" button in the UI. Since this behavior has yet again surprised many people, here is the documentation: https://docs.github.com/en/pull-requests/collaborating-with-...

This seems really bizarre to me. They seem to want people to have the network of connected GH repositories, but this behavior promotes "forking" a project in a way that breaks that network, which is to `git clone` and then create a new repo from that clone.

To put it another way, if the user had "forked" the GH repo onto GitLab, there would be no data loss, but that behavior would promote using GH in a way that breaks the upstream/downstream relationship that you see on GH.

It's even worse that the deleted fork was private. What impact does GH expect deleting the hosted private repository has on folks who really want to keep a private copy of the repo, such as offline or on another git hosting site? I'm really struggling to see any real-world positive sides to this mechanism. Seems like an ineffectual legal or compliance CYA.

Re: Tell HN: GitHub will delete your private repo if you lose access to the original

#223

Post by pabs3 »

kitkat_new wrote: post #145
sangnoir wrote: post #136

If you have a Raspberry Pi wasting away in a drawer[0], I strongly recommend installing Gitea or Forgejo and mirroring all the repos you like (i.e. the ones you contribute(d) to and/or starred, not just on Github too!). You set it up once and it will sync in upstream changes as often as you like (default is daily) 0. Or a homelab, or a cheap 256MB VM, or a NAS that can run docker containers, or an old Chromebook: any…

I'll look for a tool that mirrors all my repositories (i.e. only forks). If I can't find one, I'll write it myself.

https://github-backup.branchable.com/

Re: Tell HN: GitHub will delete your private repo if you lose access to the original

#225

Post by hakfoo »

jefftk wrote: post #187
donmcronald wrote: post #176

Earlier quoted context omitted.

> There are many aspects of the AAD design that make zero sense until you pause for a second and realise that it is not designed for you. It's designed for Microsoft 365! Business Basic accounts being limited to 7 days of login logs is a huge middle finger to the entire small business sector. Of course they think everyone should just buy Enterprise subscriptions. It's nothing more than a corporate version of "don't b…

Segmenting an enterprise version of a product is generally about finding features that are disproportionately valuable to enterprise (centralized control, policy enforcement, auditing, etc) separating them into a different offering. This lets you charge less to small businesses without having your small business product cannibalize your enterprise business. This seems basically fine to me? If there are a lot of small…

The particular segmentation is a questionable choice.

Small enterprises are likely to have small IT/Security staff, and the most likely, therefore, to not notice something awry for a few days, at which point, vital log info has already rolled off the 7-day window.

Re: Tell HN: GitHub will delete your private repo if you lose access to the original

#226

Post by therealdrag0 »

Marsymars wrote: post #168
evouga wrote: post #107

Earlier quoted context omitted.

This doesn’t make any sense to me. My private forks are * mine* and I most certainly do not want GitHub guessing at whether and when to permanently delete them without my consent. Companies of course have the right to manage access to their proprietary source code, for example by only giving access to corporate accounts under their control and reclaiming those accounts when an employee leaves.

> Companies of course have the right to manage access to their proprietary source code, for example by only giving access to corporate accounts under their control and reclaiming those accounts when an employee leaves. This is how it should be done, but is too much overhead for many "IT as a cost centre" companies.

It why would GitHub care to build functionality to behave how companies who aren’t paying them want it to behave?

Re: Tell HN: GitHub will delete your private repo if you lose access to the original

#227

Post by jefftk »

hakfoo wrote: post #225
jefftk wrote: post #187

Earlier quoted context omitted.

Segmenting an enterprise version of a product is generally about finding features that are disproportionately valuable to enterprise (centralized control, policy enforcement, auditing, etc) separating them into a different offering. This lets you charge less to small businesses without having your small business product cannibalize your enterprise business. This seems basically fine to me? If there are a lot of small…

The particular segmentation is a questionable choice. Small enterprises are likely to have small IT/Security staff, and the most likely, therefore, to not notice something awry for a few days, at which point, vital log info has already rolled off the 7-day window.

Maybe the small businesses you've encountered are different from the ones I have? My expectation is that most have no security staff and wouldn't use this feature even if it had indefinite retention.

Re: Tell HN: GitHub will delete your private repo if you lose access to the original

#228

Post by shagie »

eyelidlessness wrote: post #217
shagie wrote: post #174

Earlier quoted context omitted.

The original code may be licensed MIT. The MIT license allows for the project to be relicensed, closed source and it is also possible for a proprietary contributions that aren't MIT license to be added to it that are protected as any other closed source code. The MIT license is not "viral" and doesn't require that everything following from it is. The person may be able to find the original code that was MIT licensed…

IANAL but… > The original code may be licensed MIT. The MIT license allows for the project to be relicensed, closed source … this is less compelling to me than this: > and it is also possible for a proprietary contributions that aren't MIT license to be added to it that are protected as any other closed source code. The MIT license is not "viral" and doesn't require that everything following from it is. AFAIK, changi…

The first part sets up the second part that unlike the GPL, the MIT license doesn't require that future contributions to the project be any particular license.

Presumably the OP can find the open source project MIT licensed without the company's contributions to it.

The only thing that the MIT license requires is:

> The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

It doesn't even require attribution in the compiled application or any other notices.

And so, it is possible (and I would dare say likely) that the contributions that the OP made while working on the repo at the company unless specific permission was given otherwise would be considered as work for hire or as part of the work product as condition for employment and completely owned by the company (and not MIT licensed).

If the OP thinks that they should have access to the code because of the MIT license, that is something to take up with a lawyer. My IANAL senses suggest that that would be rather fruitless.

I don't find GitHub's model particularly surprising but rather the most reasonable one that opens GitHub up to the least liability for accidental disclosures of content. Error on the side of least privilege and if there's something to work out beyond that, that's something for the contributors to work out themselves - GitHub isn't the arbitrator for that.

Re: Tell HN: GitHub will delete your private repo if you lose access to the original

#229

Post by phendrenad2 »

Seems like it's working as intended. The code is MIT-licensed, but github doesn't know that. It only knows that you were allowed access to a private repo, and that access was revoked. This is supposed to save you the trouble of going through all of your forks and ensuring that you aren't retaining any code from an organization you left. Personally I make new github accounts for every new org I join, but that's just me.
Post reply on HN