The way GitHub reacted (blocking @homakov) is just wrong and destroyed all my confidence in them. Even more so when it was pointed out that @zedshaw crashed GitHub and didn't get blocked. http://sheddingbikes.com/posts/1306816425.html

Edit: Given that they have now stated that suspending @homakov was only temporary I no longer bear any ill will towards them.

I'm still disturbed by their security practices though. I expected better by the github guys and I don't like what this implies about the rest of their App. (And yes I am using attr_accessible and not attr_protected since its inception)

Edit 2: See here http://news.ycombinator.com/item?id=3664839 My worst fear that GitHub is using unsafe mass assignment everywhere was NOT confirmed.

https://github.com/nickmartini/dongml

Which has:

https://a248.e.akamai.net/assets.github.com/img/b0de87a4cf0c...

If I was a woman there'd be an international shit storm over that image, but I'm a dude, and one that TPW hates, so of course they won't do shit.

Then again I can usually handle myself so that's what I did.

And github forgetting the block user functionality makes me think they don't want to listen to user needs. Sure, it may not be a very popular request, but I bet for a minority it's the most important.

There was a time when CGI and Perl were synonymous. You won't believe how many people have a similar opinion about JQuery and Javascript these days.

A few days back I wanted to use a object oriented language for a big project. Generally I straight away go and use Perl for all my experiments. But since this time I wanted Java programmers to be working with my project later I thought let me use Python as its more syntactically closer to Java. When I started coding, my manager peeked over my shoulder and asked if it was Python in which I was coding I replied yes. He immediately asked me to stop writing in it, as he thinks writing in 2.x is waste of time as it is going to go away, 3.x is not yet having all the libraries. And writing 2.x will force a huge rewrite effort later. I tried and reasoned enough to convince other wise. But alas, it didn't fly.

That is how it works with pointy haired managers. They read something some where and then hold strong opinions about a particular technology.

As programmers we can try and educate people in forums like these.

But managers don't read these forums. They are likely to read magazines from IBM and Oracle, where XML's are glorified and eclipse is presented as the biggest productivity booster ever. Unless we get a forum on such magazines, we won't be able to make much difference.

For sure I think that a language shouldn't be avoided for something different than technical reasons, and nothing else.

Haha what. Do you maintain any sites? Tell us what ones. I want to warn all of your users that the admin is someone who will disable an account of someone who committed to master on a project that is not theirs and feel he has accomplished something.

http://twitter.com/#!/homakov/status/176476394455437312

"Thank you all,sweethearts! For support, and shit too. One more thing to clarify. That tattoo is kind of fake made with henna. eat vegetables"

If he was, he wouldn't have really made his point, would he? There are a lot of other Ruby sites which have this sort of bug.

I actually do understand suspending his account, and I even kind of get the intentionally misleading communications (you have to keep the corporate customers happy, right?), but the new "white hat" policy thing is kind of silly, because that's clearly not what this was about.

EDIT: On second thoughts, I think I am being overly critical on all parties. Instead, I think I hands up "we messed up, but we are learning" approach would be better, and we see how both sides act if/when this happens again, lessons learnt and all that!

I've been a happy customer for a while now, and have seen them recommended on HN many times. You get unlimited repositories with unlimited users for less than the cost of GitHub's cheapest 5 repo plan.

My open source code is on GH, but it's all also pushed to RH, along with all my private code.

I know it can be a faf to setup proper reliable secure backups and so forth (though with git it shouldn't be too hard give the whole thing is designed with wide but efficient distribution in mind), but if you stuff is sensitive enough (in a business sense, some other financial sense, or for more personal reasons) to care about keeping private then I would think twice before trusting a third party with the data. No matter how trustworthy, reliable, and secure they try to be, every one makes mistakes.

Maybe I'm just paranoid. Or just plain old fashioned. But "everything in the cloud" just scares me. Keep public stuff on public services by all means, but keep your private stuff under greater control.

On contacting them I was told it would be fixed in a day or two, and that it was no big deal since you had to guess the URL. The values you had to guess in the URL were a ticket number (they start from 1), a repository name, a date (YMD) and a filename. Sure there is some variety in there but it is not in the billions of possibilities, just hundreds and that won't make any computer break into a sweat and in my words at the time "easy". To make matters worse you can't delete the attachments to tickets.

This may not affect you. It certainly affected me. For example we had some keyfiles in one ticket. Coredumps in others.

Two weeks later the issue still hadn't been fixed and I don't know when it was. I've never seen disclosure of the issue. There wasn't even any way of knowing if attachments had been accessed in an unauthorized way since there was no checking in the first place.

What makes you think I think that?

It's $6/month to take care of my most important assets. That doesn't even buy a meal at McDonalds anymore; it's worth it.

BitBucket is owned by Atlassian for 2 years now and they don't look like they're about to go out of business ($60mil revenue in 2011, 400employees, worldwide offices). When they bought it, it was them who set private repos to unlimited (when @jespern was running it alone, it was set to 5), so I believe they know what they're doing and that it fits their business model. Over 5 collaborators need a paid plan and that's just how they set up the pricing scheme.

As far as I can see as an active user and lurking through their blog and bugtracker, BB is actively developped, so I assume you don't have to worry about them running out of business, looks like it's a valuable asset in Atlassian's software portfolio (at least valuable enough to work on it).

Yeah, and people payed GitHub to host their private repos --how did that go?

Unlimited private Git, SVN and Mercurial repos for free.

We've been using them for years for all our projects with no issues.

Nowadays you can hand a CD, plus a printed manual. Printing the code is now optional. But you still have to register every version :)

http://www.cuti.org.uy/registro-de-software.html

But then, going so far to say losing all trust in github.. there was a bug, it's fixed and they suspended the "attacker". I wonder what will happen in the following days with script kiddies trying to "hack" all rails website. In fact, isn't the overloading of parameters something as old as the earth that security experts would check first as a vulnerability?