Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Introducing unlimited private repositories

github.com

Post reply on HN
Print view View original

531–540 of 662 posts

Re: Introducing unlimited private repositories

#531

Post by geofft »

neoeldex wrote: post #390
geofft wrote: post #378

Earlier quoted context omitted.

Git is just a format for storing data with a record of how that data changed. Saying you shouldn't store it in git seems rather like saying you shouldn't store it in btrfs. It's true that if your btrfs disk image becomes public, the data is recoverable, and it's hard to reliably scrub deleted files from btrfs, but that doesn't mean it's the wrong tool for a filesystem (or a repo) that stays entirely internal. Saying…

A git repo is usually shared over multiple machines/developers. So the chance of someone publicating it is larger. As well as the entire history is usually copied everywhere

All of these machines and developers have legitimate access to the secret in question, though. Hence my framing of git as just a file storage format—any other mechanism provides the technical means for any of these machines or developers to publicize it. (And a few other simple mechanisms, like "scp the secret from another machine" or "copy/paste it with your terminal", have an increased risk of doing so by accident. Accidentally making a git repo public is generally unlikely.)

Re: Introducing unlimited private repositories

#532

Post by thomasahle »

Xylakant wrote: post #281
jnmandal wrote: post #270

Earlier quoted context omitted.

If you are non profit and open source do you really need private repos?

In a non-profit that I collaborate with [1] we use private repos to keep the server setup and some tickets that contain sensitive information (user data). All other code is open source. Obviously we don't want to keep api keys etc. in the public repos. [1] https://github.com/sozialhelden/wheelmap

And you share the passwords with enough volunteers that per users pricing becomes a problem?

Re: Introducing unlimited private repositories

#533

Post by fps »

taytus wrote: post #492
emidln wrote: post #439

Earlier quoted context omitted.

I've used Bitbucket in the past. They charge per-user[1], and their pricing is significantly better free for 5 users and then once you eclipse 5 users it's $1/user up to 100 users and then $200 for unlimited users. [1] - https://bitbucket.org/product/pricing

This. I use bitbucket too and I can't understand why people are still paying github when bitbucket does exactly the same and is free.

Network effects make github more valuable, to an open source organization, than self hosting or hosting on another provider. Almost everyone has a github account and asking users to sign up for another account is a significant barrier to contribute.

Re: Introducing unlimited private repositories

#534

Post by lox »

Xylakant wrote: post #410
woah wrote: post #399

Earlier quoted context omitted.

What the hell? Are you defending a decision to keep keys unencrypted in a git repo?

yes, indeed I am. I'm all in favor of keeping the tools used to a level where the effort makes sense to protect the value of the goods. I totally could lock up my newrelic api key in a bank safe, double encrypted with two persons 4096 bit GPG keys, but that would be a little overkill, wouldn't it? Do you do that? I'd be moderately annoyed if somebody started pushing false metrics to my NR account, but that's about al…

Agreed, we do this as well at some scale. The vast majority of application configuration falls into this category. The advantage of storing them in a git repo (we use a different git repo to the main codebase) is that you can re-use the same access control mechanisms (note that is not the same as giving the same people access to the different repos) and you get strong change history.

Re: Introducing unlimited private repositories

#535

Post by parsnips »

NetStrikeForce wrote: post #473
antihero wrote: post #381

Earlier quoted context omitted.

If $8 is a big deal per user, how little are you paying the poor bastards?

I guess he's not paying his employees 900% market rate, why would he pay 900% market rate for GitHub instead of BitBucket? Just trying to point that your logic doesn't check out. I personally like the new pricing, but as a non-paying user of GitHub and BitBucket... I'll stick to BitBucket for my private repos :) I guess they don't give a damn as I'm still not paying either :)

You believe bitbucket represents the market?

Re: Introducing unlimited private repositories

#536

Post by fps »

__jal wrote: post #503
VLM wrote: post #343

Earlier quoted context omitted.

"that we're not developing in the open" Honest question... why? I totally understand the mindset of "gotta go all secret squirrel to protect our profits" but if your org isn't in it for the profits there's not much to protect? I have seen examples of people performing very naughty acts like private repos to hold plain text passwords, plain text cloud service keys, plain text corporate credit card numbers for expense…

There are a ton of reasons not to develop in the open, no matter what your structure. - You're experimenting - You don't want comments from the peanut gallery while things are in progress - It is not for external use, specific to an institution or project, or otherwise nobody else will care - It deals with something sensitive - You've made an agreement with someone else that requires it - etc. etc. etc. People seem t…

mostly these reasons. We also want to make sure that code we open source is properly documented, has appropriate functional tests, and is useful outside of our organization. Our typical workflow is to build a POC, then an MVP, then build out documentation and unit tests.

Re: Introducing unlimited private repositories

#537

Post by tokenizerrr »

maerF0x0 wrote: post #515
taytus wrote: post #492

Earlier quoted context omitted.

This. I use bitbucket too and I can't understand why people are still paying github when bitbucket does exactly the same and is free.

People use github over bitbucket if they like the features that github provides, the diffs, issues etc. Not sure which features are unique to github alone, but each provider (including gitlab) has their own flavor. Many are just used to github flavor.

I use bitbucket at work, and it has many of the same features as github. The UI is a bit clunkier, and it does lack some of the flashy features such as automatically squashing commits when merging a pull request. However it does work fine, and it is well integrated with atlassian's other offerings which we also use. Mainly JIRA and hipchat, though bitbucket also has a per-repository issue tracker.

Re: Introducing unlimited private repositories

#538

Post by Xylakant »

thomasahle wrote: post #532
Xylakant wrote: post #281

Earlier quoted context omitted.

In a non-profit that I collaborate with [1] we use private repos to keep the server setup and some tickets that contain sensitive information (user data). All other code is open source. Obviously we don't want to keep api keys etc. in the public repos. [1] https://github.com/sozialhelden/wheelmap

And you share the passwords with enough volunteers that per users pricing becomes a problem?

I don't handle the account in that case, so I can't even say if it's free or not. I was just replying to the implied question "why would a nonprofit org with an OS project need private repos?"

Re: Introducing unlimited private repositories

#539

Post by [deleted] »

thomasahle wrote: post #532
Xylakant wrote: post #281

Earlier quoted context omitted.

In a non-profit that I collaborate with [1] we use private repos to keep the server setup and some tickets that contain sensitive information (user data). All other code is open source. Obviously we don't want to keep api keys etc. in the public repos. [1] https://github.com/sozialhelden/wheelmap

And you share the passwords with enough volunteers that per users pricing becomes a problem?

[deleted]
Post reply on HN