Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub and Rails: You have let us all down.

chrisacky.posterous.com

Post reply on HN
Print view View original

71–80 of 205 posts

Re: GitHub and Rails: You have let us all down.

#71

Post by tar »

epistasis wrote: post #32

I have lost all trust in GitHub, and not because of the vulnerability, but because of their response. With their suspension of hamakov's account and deceptive blog post about the extent of the hole, GitHub has guaranteed that they won't be the first to know about the next vulnerability (and there's always another). I've downgraded my paid account to a free account, and won't keep any non-public data on GitHub in the…

This is probably the perfect time to switch to http://bitbucket.org/ . They offer free unlimited public and private repositories for both Git and Mercurial. However, the free private repositories are limited to five collaborators.

Re: GitHub and Rails: You have let us all down.

#73

Post by stickfigure »

rdl wrote: post #66
stickfigure wrote: post #16

Earlier quoted context omitted.

I don't think anyone is dreadfully concerned about service availability - although that is certainly a concern. The problem is that source code is incredibly valuable and often represents many man-years of effort. A competitor could use this to bypass a lot of the early architectural fumbling around that we all do. Also, source code often contains passwords and shared secrets like Facebook secret keys. Disclosure wou…

Do people actually host confidential code on Github, vs. open source projects? I'm worried about the integrity of open source projects, but not really their confidentiality.

According to https://github.com/about, they have 59 employees and have never taken VC. Since the opensource projects don't pay, the math suggests that yes, quite a lot of organizations are paying to host confidential code.

FWIW, we do.

Re: GitHub and Rails: You have let us all down.

#74

Post by dangrossman »

zalew wrote: post #65
dangrossman wrote: post #52

Earlier quoted context omitted.

I'm just going to latch on to this comment to make mention of a GitHub alternative for private repositories: http://repositoryhosting.com/ I've been a happy customer for a while now, and have seen them recommended on HN many times. You get unlimited repositories with unlimited users for less than the cost of GitHub's cheapest 5 repo plan. My open source code is on GH, but it's all also pushed to RH, along with all my…

You should check out http://bitbucket.org

I prefer to pay someone to host the private repos. No free tier means every user is treated like a paying customer, and every user's data is considered valuable. It also means that as long as the pricing is sane, the company isn't going to shut its doors for lack of revenue. Before RH I was paying Springloops.

It's $6/month to take care of my most important assets. That doesn't even buy a meal at McDonalds anymore; it's worth it.

Re: GitHub and Rails: You have let us all down.

#75

Post by alinajaf »

Though I will say that mass assignment is about as rookie a rails mistake as you can make, I won't be leaving github.

They've delivered so much value over the past four years for me that I can forgive them this and I'd still have (a little) goodwill towards them left over.

Re: GitHub and Rails: You have let us all down.

#76

Post by zavulon »

dangrossman wrote: post #52
epistasis wrote: post #32

I have lost all trust in GitHub, and not because of the vulnerability, but because of their response. With their suspension of hamakov's account and deceptive blog post about the extent of the hole, GitHub has guaranteed that they won't be the first to know about the next vulnerability (and there's always another). I've downgraded my paid account to a free account, and won't keep any non-public data on GitHub in the…

I'm just going to latch on to this comment to make mention of a GitHub alternative for private repositories: http://repositoryhosting.com/ I've been a happy customer for a while now, and have seen them recommended on HN many times. You get unlimited repositories with unlimited users for less than the cost of GitHub's cheapest 5 repo plan. My open source code is on GH, but it's all also pushed to RH, along with all my…

I've always plugged the here on HN before, and will do it again: http://www.assembla.com

Unlimited private Git, SVN and Mercurial repos for free.

We've been using them for years for all our projects with no issues.

Re: GitHub and Rails: You have let us all down.

#78

Post by zalew »

dangrossman wrote: post #74
zalew wrote: post #65

Earlier quoted context omitted.

You should check out http://bitbucket.org

I prefer to pay someone to host the private repos. No free tier means every user is treated like a paying customer, and every user's data is considered valuable. It also means that as long as the pricing is sane, the company isn't going to shut its doors for lack of revenue. Before RH I was paying Springloops. It's $6/month to take care of my most important assets. That doesn't even buy a meal at McDonalds anymore; i…

> as long as the pricing is sane, the company isn't going to shut its doors for lack of revenue.

BitBucket is owned by Atlassian for 2 years now and they don't look like they're about to go out of business ($60mil revenue in 2011, 400employees, worldwide offices). When they bought it, it was them who set private repos to unlimited (when @jespern was running it alone, it was set to 5), so I believe they know what they're doing and that it fits their business model. Over 5 collaborators need a paid plan and that's just how they set up the pricing scheme.

As far as I can see as an active user and lurking through their blog and bugtracker, BB is actively developped, so I assume you don't have to worry about them running out of business, looks like it's a valuable asset in Atlassian's software portfolio (at least valuable enough to work on it).

Re: GitHub and Rails: You have let us all down.

#79

Post by hythloday »

stock_toaster wrote: post #68
hythloday wrote: post #61

Earlier quoted context omitted.

He notified Github "last Friday", according to them: https://github.com/blog/1068-public-key-security-vulnerabili...

> His previous report was fixed last friday Makes it sound like a separate issue. edit: looks like github clarified https://github.com/blog/1069-responsible-disclosure-policy

Same exploit, different endpoint. Github agree they "should have...immediately looked for related issues":

https://twitter.com/#!/technoweenie/status/17645071550868684...

...though as they've now unbanned his account (good on them), it's somewhat moot.

Post reply on HN