News for hackers. Stuff that matters.
Re:GitHub Package Registry by _bxg1 on Friday May 10, 2019 @06:39PM (#19882942)
There's something slightly concerning about ceding responsibility for distributing the world's open-source projects from a family of strong independent repositories to a centralized platform owned by a tech giant.
Re:GitHub Package Registry by sho_hn on Friday May 10, 2019 @07:15PM (#19883161)
Yes, but that's not a new concern - to some, GitHub has always represented an anathema to what git was supposed to be and bring. Centralization at a proprietary vendor, instead of open systems interacting. Then locking people in further by network effect and adding centralized products around git. That it's become so popular many people equate GitHub with git adds insult to injury.

I completely understand why this all happened (centralization is just so easy and convenient; federation is hard), and it was probably inevitable in its timeframe, but I also wish it wasn't so. It's not quite what we imagined when we made the leap to dscms in the early aughts.

All the good stuff is still in there, though, and it's still as possible as ever to do different things, so it's not a bleak situation.

Re:GitHub Package Registry by arugulum on Friday May 10, 2019 @09:16PM (#19883829)
I have the opposite view: the success of GitHub and the growth of code being open by default with everything running through git has probably brought more people into the git ecosystem than would have otherwise. I primarily use GitHub, but whenever I need something that I need to run myself I know I can fairly seamlessly switch over to something like GitLab.

For example, if GitHub ever started using a very proprietary application, I would just switch over to using regular git, and I'm guessing many others would too.

Re:GitHub Package Registry by keytarsolo on Saturday May 11, 2019 @06:33AM (#19885517)
I am with you on this one. I use GitHub to share code, and participate in projects. I use my own GitBucket instance for anything purely personal that I don't want to lose, but don't want to make nice or document and then at work we use GitLab.

I'm all in on git in a way that I might not have been without GitHub making it so huge. Without GitHub, we'd probably all be using git at home but SVN at the office.

Re:GitHub Package Registry by jeena on Saturday May 11, 2019 @02:25AM (#19884893)
I don't believe you would. It's more probable that you'd install that proprietary application to get the features which standard git lacks at that time.
Re:GitHub Package Registry by tedivm on Friday May 10, 2019 @07:56PM (#19883406)
When Linus introduced git he didn't seem to care at all about decentralizing from a political standpoint, just from a "I can work on this from my laptop without an internet connection" point of view.
Re:GitHub Package Registry by toyg on Friday May 10, 2019 @09:22PM (#19883854)
That's the thing - git was fundamentally a tool borne with an asynchronous workflow in mind: I work on X, Alice works on Y, Bob works on Z, and the eventual merging (which might happen days or weeks later) should be as simple as possible - without worrying about who checked out what. Git was dropped in the "distributed VCS" bucket, but decentralization was a secondary effect of the workflow Linus wanted to achieve.

GitHub then took the server-side bits of git, and effectively built a web-based interface with social features on top. Git itself is still very much a decentralized tool (just add a new remote and off you go), only the social GUI is centralized.

It would be cool if somebody could build "Github over P2P" (I guess with a bit of blockchain, because hype). At that point the entire stack would be fully decentralized.

Re:GitHub Package Registry by soulofmischief on Friday May 10, 2019 @11:20PM (#19884334)
A git service built on IPFS or something similar would be wicked. It does take quite a bit of engineering (money) to compete with the big boys, however.
Re:GitHub Package Registry by chupasaurus on Friday May 10, 2019 @11:32PM (#19884374)
The first project provided by DDG to me was Radicle[https://radicle.xyz/]
Re:GitHub Package Registry by soulofmischief on Saturday May 11, 2019 @05:35AM (#19885378)
rad project allows you to create, checkout, manage, and publish a project, comprised of issues, patch proposals, and a git repo.

Well hot dog.

And it uses LISP for scripting? Nice.

Interesting approach to saving state, too.:

One only needs the address of the latest input, the "head", to be able to recover the whole log. The owner of a machine uses an IPNS link to point to the head of the list, and the name of this link is then the name of the machine also.

Thanks for sharing that. Definitely going to give it a whirl this weekend.

Re:GitHub Package Registry by toyg on Saturday May 11, 2019 @11:19AM (#19886590)
It looks the business but it lacks the single most important feature for popularity: a GUI. GitHub made Git dominant by building a friendly GUI on top of it. Before, it was just another player in a relatively crowded field of CLI DVCSs. Obviously it is not essential to get stuff done, but anything with any ambition of generating network effects definitely needs a GUI.

The other thing that seems to be lacking, from a quick reading of the docs, is a way to generate pull requests (or "patches" in Rad terms) from a branch, and then merge them on another branch. Obviously you can do it manually in git, but GH is definitely a superior experience.

Re:GitHub Package Registry by soulofmischief on Saturday May 11, 2019 @06:13PM (#19888706)
> It looks the business but it lacks the single most important feature for popularity: a GUI.

It's a matter of perspective. My first thought when reading the docs was, "All someone needs to do is slap a GUI on this baby. Good thing the designers made a simple CLI that it could interface with."

They've already done most of the heavy lifting. At this point a GUI is trivial to add. "Terminal–first" doesn't imply "terminal-only". In fact, quite the opposite. I wouldn't be so quick to assume that they don't envision a GUI at some point-- Why not contribute to the project and get the ball rolling?

The patch command [0] has a propose subcommand that describes what you're talking about. It generates a patch from a commit (on any branch, I presume). This can be applied however you see fit. And the checkout subcommand even lets you generate branches from patches similar to GH. What seems to be missing?

[0] https://radicle.xyz/docs/#rad-cli-reference

Re:GitHub Package Registry by toyg on Saturday May 11, 2019 @07:38PM (#19889087)
I agree that the GUI situation is a glass-half-full sort of thing, I'm just saying it needs that as a priority if they want any network effect.

> The patch command [0] has a propose subcommand that describes what you're talking about.

Yeah but in the tutorial it says it will fail to work if you are on a different branch from master - I took it to mean that the patch command can only target the same branch it was generated on. If that's the case, obviously the maintainer can then do the manual merge-and-delete routine; I'm just saying that on github it's a one-click operation.

Re:GitHub Package Registry by soulofmischief on Sunday May 12, 2019 @07:18PM (#19895236)
Hmm okay, I guess I'll just have to play around with it and see.
Re:GitHub Package Registry by akavel on Saturday May 11, 2019 @05:34AM (#19885374)
There's a Git application on Scuttlebutt, already used by people in the community - see e.g.:

https://github.com/noffle/git-ssb-intro

Re:GitHub Package Registry by soulofmischief on Saturday May 11, 2019 @05:42AM (#19885398)
Your sister comment had another project to share based on IPFS: https://radicle.xyz/

One thing that seems clear is that there needs to be a standard interchangeable format for storing PRs and issues, so that it's not just the point of origin that's decentralized, but the data itself (in case the maintainers vanish).

I'm not really sure how to go about that sort of thing either myself or as a community effort but I'd appreciate any advice from the HN community.

Re:GitHub Package Registry by chriswarbo on Sunday May 12, 2019 @09:08AM (#19891636)
> One thing that seems clear is that there needs to be a standard interchangeable format for storing PRs and issues, so that it's not just the point of origin that's decentralized, but the data itself (in case the maintainers vanish).

I use Artemis for issue tracking, and that uses maildir (a widely supported standard). I compose issues with Emacs message-mode and render them to HTML using mhonarc.

Re:GitHub Package Registry by toyg on Saturday May 11, 2019 @10:54AM (#19886479)
> anybody can push to anybody else's git repository. [...] The nomenclature is to treat the ssb remote as the "true" remote, and work off of a branch called @your-username/master as your own master, emulating a forked repo. This seems to work well: the SSB network thrives off of being a group of kind, respectful folks who don't push to each other's master branch. :)

Uh, thanks but no thanks. I thought we had learnt that the honor system does not scale.

Re:GitHub Package Registry by herewulf on Saturday May 11, 2019 @02:58AM (#19884979)
Interesting discussion on this topic from about a year ago: https://news.ycombinator.com/item?id=17234498
Re:GitHub Package Registry by chupasaurus on Friday May 10, 2019 @11:23PM (#19884350)
> decentralization was a secondary effect of the workflow Linus wanted to achieve.

Linus didn't want to achieve a change in workflow of kernel development, he just made a tool to make which would ease the pain, Linux development was decentralized since forever.

Re:GitHub Package Registry by toyg on Saturday May 11, 2019 @06:36AM (#19885526)
What I said is that the design of git was driven by the requirements of async workflow (“easing the pain”, in your words) more than decentralization as a philosophical objective. I think we saying the same thing with different words.

I still wonder if Larry McVoy feels sore that git basically destroyed BitKeeper and became what it did. “It could have been me” and all that...

Re:GitHub Package Registry by amyjess on Saturday May 11, 2019 @12:46AM (#19884621)
You might be interested in Fossil.

Tickets and the wiki are stored as part of the repo and don't depend on a completely separate web interface.

Re:GitHub Package Registry by soulofmischief on Friday May 10, 2019 @11:18PM (#19884327)
I just wish a PR and issue tracking system with pluggable credentials had been simultaneously developed and implemented alongside git, so that I could migrate my issue and PR history, or plug them in to multiple hosts.

I prefer Gitlab for a multitude of reasons but since all the action takes place on Github, my Gitlab account just serves as a repo mirror.

Re:GitHub Package Registry by chriswarbo on Sunday May 12, 2019 @09:13AM (#19891657)
Git has always had integration with email, which makes it compatible with a vast amount of existing servers, clients, credential systems, Web UIs, scripting languages, etc.

As an example I think SourceHut is mostly based around email (which it provides a Web UI for) https://sourcehut.org

Re:GitHub Package Registry by beenBoutIT on Friday May 10, 2019 @07:19PM (#19883181)
*When the tech giant is Microsoft.
Re:GitHub Package Registry by IfOnlyYouKnew on Friday May 10, 2019 @09:25PM (#19883868)
That is, indeed, a fair point of concern. But in practical terms, I would place Github very high in any ranking of good things that happened to open source.

It's possible many people have forgotten, or are to young to remember, how the ecosystem worked pre-Github. There was sourceforge, which wasn't quite the disaster it is today, but also not very good. But mostly I remember every project using different, often hand-rolled systems. PRs had to be sent in by mail. Every project had their own conventions of where to send patches, what formats to use, what additional information to provide etc.

Just try figuring out how to get a patch into Debian, which is still where most projects were ca. 2005. I won't wait.

I never contributed to OSS pre-Github. These days, I routinely send in a patch for smaller things I encounter a few times per week. Over time, I have also started becoming a more involved contributed to two projects. I doubt this would have happened without the flat learning curve that Github provides.

I wouldn't be surprised if both the number of contributors and total contributions to OSS have soared by a factor like 5x even above just the growth in OSS usage, and Github is the obvious reason for it.

Re:GitHub Package Registry by zmix on Friday May 10, 2019 @09:59PM (#19884031)
This!

Hypothetically, and, currently, only hypothetically:

If Microsoft is still of the old spirit, then what we see now, would be the biggest "Embrace, Extend, Extinguish" coup, they have ever done.

It won't happen now, it won't happen tomorrow. For that, this would be too big of an effort. But Microsoft is trying big to win back the hearts of "The Community" and "The Market". As people, especially developers, have gotten more clever about the computers, since the advent of the web has made it possible, to live in IT without "getting shown" and "taught" by "Big Daddy" type companies, since all and everybody is much more self-organizing these days, there is much more competition to MS, that has been in the past. So they try to get it back, what they have lost.

* VSCode, is very sweet and candy, with lots of bells and whistles, major software companies writing plugins for it (the most active being Microsoft). As a programmer's text editor it sits right at the core of every development. VSCode, especially, is attractive to people outside of MS Windows (they might use VisualStudio). I am talking about web- and "App" developers. Mostly frontend or mobile. * By buying Github, they bought the "source of all sources". They won't ever own the code, but as long as they own the popular infrastructure, everybody is playing on their grounds. The next step, in two years, or so, may be the need for a MS account to log into Github. They integrate it.

Out of curiosity, what else did MS buy in the last years, that would fit into this pattern?

Re:GitHub Package Registry by yarg on Friday May 10, 2019 @07:19PM (#19883178)
Hopefully something along these lines will also be added to Gitab.

I share your concerns, but I've also long had the feeling that both NPM and Maven are a security disaster in the making.

Having the dependencies being published from the same place that stores the actual code, gives me a little hope that things will improve from the security and design perspective.

Re:GitHub Package Registry by gritzko on Friday May 10, 2019 @08:49PM (#19883679)
...by adding a single point of failure?
Re:GitHub Package Registry by yarg on Saturday May 11, 2019 @01:05AM (#19884662)
No, my thoughts are that we need better mechanisms to validate our dependencies.

So far I believe that Maven and NPM have failed to deliver on that front.

The dependencies being resolved from the code store provides a decent mechanism to resolve that issue.

But as long as it's being done on closed software, it's going to be hard to move towards a standard.

Re:GitHub Package Registry by gouh on Friday May 10, 2019 @09:04PM (#19883759)
Ideally I would like the social aspects of GitHub (trending/popular repository, staring projects, notifications, etc.) but with decentralized hosting. Something that would be to GitHub what Mastodon is to Twitter
Re:GitHub Package Registry by rasz on Friday May 10, 2019 @08:27PM (#19883575)
Microsoft is just trying hard to achieve Antitrust(movie) villain goals, Github plus "telemetry" is a pretty good coverage.
Re:GitHub Package Registry by soulofmischief on Friday May 10, 2019 @11:22PM (#19884343)
Github is primarily composed of public data that Microsoft could scrape without a $7.5B investment.

There are a lot of moving parts to this and it's impossible to distill it down to a single sentence or even paragraph.

Re:GitHub Package Registry by bartimus on Saturday May 11, 2019 @06:52AM (#19885564)
It's a good reason to seriously consider Gitlab.
Re:GitHub Package Registry by piotrkubisa on Saturday May 11, 2019 @07:19AM (#19885637)
Or https://sourcehut.org/ if you are looking for something leaner.

Or if you are looking for self-hosted git servers:

- https://onedev.io/

- https://gitea.io / https://gogs.io/