Earlier quoted context omitted.
Yeah, it starts and 29 and goes up from there 1500 is their maximum price...
No, there are still limitations, e.g.: 50 Team Members
True didn't put that down my bad.
Upptime – GitHub-powered open-source uptime monitor and status page
81–86 of 86 posts
Re: Upptime – GitHub-powered open-source uptime monitor and status page
#82@anandchowdhary Can you explain the security implications of using Upptime?
Does it need a token to access all of the user's GitHub repos?
That's a little worrying because the code does not reside in the git repo it's fetched from third-party repos by the GitHub Action. Does this mean the user has no way of auditing and locking down the code to prevent future compromises to third-party repos?
If yes, then an attacker that compromises Upptime or one of the third-party GitHub Actions could hijack all of the users repos (including non-Upptime repos owned by the users).
Re: Upptime – GitHub-powered open-source uptime monitor and status page
#83Anything that is "GitHub-powered" as a requirement is not open-source.
So is youtube-dl and thousand other api wrappers, if thats the case you wont have majority of the open-source community.
youtube-dl is a bad example because it isn't designed around using a site. It's designed around not using a site.
Re: Upptime – GitHub-powered open-source uptime monitor and status page
#84Earlier quoted context omitted.
Yes and no. Depends on tenancy requirements. I know with docker and other common Linux container strategies you would want to keep each tenant on their own VM. A container isn’t safe enough. So if this is your org’s only action. Then you’re probably spinning up a VM. If you have other options. You’re probably not adding any overhead. (Edit: grammar)
Ya, but I doubt that is the case with actions, because I don't think you really have full access to everything. You provide a yaml file and their software runs that yaml which could easily exclude any dangerous commands. Plus, github offers a hosted runner service where you pay for a dedicated VM to run your actions in. So that makes it seem like actions are probably run together on larger VMs by default.
It is definitely the case with Actions.
> I don't think you really have full access to everything
You do.
> their software runs that yaml which could easily exclude any dangerous commands
Categorizing dangerous commands is impossible to do accurately by just looking at a yaml file.
> Plus, github offers a hosted runner service where you pay for a dedicated VM to run your actions in. So that makes it seem like actions are probably run together on larger VMs by default.
I'm not sure what this means. The paid hosted runners are not any different from the free hosted runners, but free runners can only be used on public repos.
Re: Upptime – GitHub-powered open-source uptime monitor and status page
#85Earlier quoted context omitted.
I'm pretty sure GitHub actions do use a whole (though probably lightweight) VM. And I think AWS lamdas do as well, or at least used to.
Well, if lambdas are using VMs and have sub-second launch times, I don't think using a lot of github actions would cause much overhead.
This is a common misconception about Lambda and Functions. They don't always give you a fresh container/VM, but Actions does.
https://aws.amazon.com/blogs/compute/container-reuse-in-lamb...
https://docs.microsoft.com/en-us/azure/azure-functions/funct...
Re: Upptime – GitHub-powered open-source uptime monitor and status page
#86Earlier quoted context omitted.
Yeah, MS has been pretty vague so far on gha usage. Basically “have fun; don’t go crazy”. I imagine they are waiting and collecting more data before opting to impose any specific usage constraints.
They've only recently started playing nice with open source and developers. I doubt they'll do anything to jeopardise that.
Good point.