I guess the calculation here is that the enterprise contracts are where all the money is, and keeping smaller customers on GitHub is worth the price cut?
Teams who need advanced features (like code owners), enterprise features (like SAML), or personalized support can upgrade to one of our paid plans.
I wonder whether this is a result of market conditions, or whether GitHub sees this is a first-to-market play of some sort, or whether it's something else. I hate to be a cynic given how much good Microsoft + GitHub have been doing lately, but what prevents this change from being rolled back?
Congrats again! I love using GitHub and look forward to many happy years shipping code on the platform.
But it’s probably just completion in the space
Could be a response to GitLab, which had a similar offering for years, including unlimited free private repos.
They understand their target audience more than most of the companies out there. When they are making moves such as this, they explain what was behind it. I find it authentic.
[Speculation:]
Perhaps they've run the numbers and can figure out that they make enough money from enterprise clients and will make enough more money from the 'marketplace' being a channel for selling github integrations and addons to cover this cost of not trying to monetize through supporting teams.
It also moves a large base from 'customer' with needed support to free users which don't need the same level of support.
You can even spin up postgres and redis instances for tests by just specifying that you want them. It's amazing.
We've wanted to make this change for the last 18 months, but needed our Enterprise business to be big enough to enable the free use of GitHub by the rest of the world. I'm happy to say that it's grown dramatically in the last year, and so we're able to make GitHub free for teams that don't need Enterprise features.
We also retained our Team pricing plan for people who need email support (and a couple of other features like code owners).
In general we think that every developer on earth should be able to use GitHub for their work, and so it is great to remove price as a barrier.
TBQH, I don't see Gitlab lasting too much longer without an acquisition event of some sort, when facing up against this sort of Microsoft-backed feature funding. And I say this as a bigger user of Gitlab than Github (primarily because of the free private repositories and organisations).
because if you're referring to requiring review approvals before a PR can be merged, that's available in the free plan (under branch protection rules).
Also: are there plans to open source more of GitHub? Post Microsoft acquisition, I have been increasingly concerned about vendor lock-in, EEE, and so forth.
Just like Facebook used Onavo.
https://www.wsj.com/articles/facebooks-onavo-gives-social-me...
I think open sourcing GitHub is an interesting idea.
Thanks to everyone at Github making stuff like this possible and creating such a great epicenter for open source in general. Keep on being awesome!
Also I was wondering, Github is offering so many features for free, but does the company sustain itself through entreprise payments or some other stream? I was just curious. :)
As for how we sustain ourselves -- lots of big enterprise customers!
Or is HN just as susceptible to the narrow news horizon?
Due to the on-going Pandemic, I've been trying to cut business costs left and right. Github Team was one of those I wanted to cut but it's also so important that I couldn't decide easily. So thanks again for the change. Much appreciated!
From the side-lines it looks like they're slowly becoming an unstoppable dominant force, what's surprising to me is AWS's / GCP's inaction, they're either asleep at the wheel or they don't see Microsoft's dev mindshare grab as a threat.
On behalf of our tiny team at WorkOS, thanks! :)
Unless i’m missing something, it should not be the same as “administrators” - otherwise branch protection rules would be fine.
Does GitHub anticipate that this pricing change will affect the proportion of code that's provided under free / open source licensing on your platform, and if so can you share any information regarding the direction GitHub would like to lead the community in?
> We’re also reducing the price of our paid Team plan from $9 per user/month to $4 per user/month, effective immediately. Existing customers will have their bills automatically reduced going forward.
I don't mind this - we'll likely stay on the paid plan anyways at that price point. But there you are.
You are downgrading to GitHub Free
After April 15, 2020, ... features and limits will change:
Protected branches in private repos
Draft PRs in private repos
GitHub Pages in private repos (using 1)
Wikis in private repos
Code owners in private repos
Multiple issue assignees in private repos
Multiple PR assignees in private repos
Code review automatic assignment in private repos
Scheduled reminders in private repos
Standard support
2,000 minutes for GitHub Actions (currently 3,000)
500MB of storage for packages (currently 2GB)Gitlab CI has been the opposite of other experiences I've had with well over 10k jobs completed across different projects with diverse needs. Even for small hobby projects it's been great for me, it's nice to easily be able to push updates without having to worry about it. Makes it much easier to iterate and test things out!
[Individuals] become [small teams] who turn into [big enterprises] / So [GitHub] be good to your [individuals], too
E.g. I have git repos where I use multiple remotes (1 Github, 2 Gitlab..). So git is the same as everwhere.. I never felt locked in. It's not too hard to transfer your repos to another provider.
Unrelated: have you seen https://sourcehut.org/? Thoughts?
Do they? Unless you're on GitHub Enterprise, migrating is just moving your repos over the weekend, setting up new webhooks, emailing everyone a command to switch their upstream URL, and hoping the new workflow works for you. For teams of <100, this it one of the easier transitions to make.
Git is open source and widely supported, which doesn't benefit Microsoft. By causing GitHub-specific features to be an essential part of a "modern" or "industry standard" git workflow, they can capture more marketshare/attention, and cause alternatives to be sidelined. This requires removing all friction to entering the proprietary ecosystem, including purchasing. This, along with the acquisition of NPM, is the "embrace" part.
The next will be an expansion of GitHub and NPM's featuresets in ways that are only accessible via branded, first party tools (i.e. not git/ssh/yarn). GitHub has already made some inroads there prior to the Microsoft acquisition with of course the ubiquitous PRs as well as GitHub Issues and Actions. I imagine the ability to check out GitHub wikis as git repos will probably eventually go away to further this.
The last part ("extinguish") is turning off support for non-firstparty tools like git-via-ssh, .patch URL support, issue collaboration via email, yarn, et c. By the time they do this, few people will notice, having acclimated to the entirely-proprietary ecosystem they've been incrementally subjected to.
The goal, as always: a Microsoft editor (VS Code or Atom), editing code in a Microsoft language (TypeScript/.NET/whatever), signed off via Microsoft review software (GitHub mobile), publishing to a Microsoft website (GitHub/npm), running CI on a Microsoft VM (GitHub Actions), pushing code to a Microsoft datacenter (Azure).
It's simply a moat to prevent open, unfettered competition in any intersection of the vertical. Any weak spots (such as GitHub signup friction) are to be subsidized as they will yield benefits when later used as a cohesive whole in an anticompetitive fashion.
What enterprise is paying is the convenience, not security itself.
If you as a SaaS provider outsource your SAML integration to a third party provider like Okta or Auth0, the auth provider pricing is immediately on a "call us" tier, with a per-federation pricing in the low four figures for each company connecting via SAML. Let me just state that again, to have company X connect to my SaaS via SAML, I as the SaaS provider have to pay my auth provider $X,000 per year for the privilege, not counting the base enterprise tier pricing for the auth.
I'm not complaining; MS should point GH at where the money is and there is competition you can switch to. I'm just not excited to save a few bucks a month given what will likely change.
I wasn't aware of SS13, and will look into what happened there. Content moderation at GitHub scale is hard and sometimes mistakes are made.
Like... everything MSFT and GOOG have ever done?
Great.
Who else is good at this? I’m somewhat fond of Digital Ocean’s docs.
It's also to note they attacking on two fronts, the open source and startup folks (VS code, github, typescrip, azure) , and the enterprise with communication, productivity tools and cloud infra (Teams, Office 365, Azure)
Owned.
The new flat price of $4/user seems perfect for us. I've already moved one private repo to our org account.
Thanks again ^_^
I’m much happier with a sliding scale model than ad or spyware based models. The problem there is that my experiences have been that a lot of expensive scaling work that you might otherwise have deferred gets done for your biggest customers, and we don’t often get the revenue right to absorb that hit. More than once our biggest customers have ended up having the lowest margins, if you de-fuzz the math.
OAuth only does AuthZ. I've always found OAuth more complicated because you have to combine it with other technologies to get AuthN
And it was should have been rather obvious when GitHub released the beta of Actions a few years ago. Actions remains the most important thing GitHub has done, ever, in my opinion. It might take a few more years for people to fully realize what this could be. Hope GitHub doesn't screw it up!
But I do wonder if AWS will try to buy gitlab.
Oh dear. That doesn't really sound like a good idea in the long term.
So once you place all your projects/repositories on a third party git service like Github and it goes down, what can you do to push that critical change? Might be no big deal for personal projects but unacceptable for big business and open source orgs.
You might as well call the CEO of GitHub for support. A better way is to self-host...
- Required reviewers
- 3,000 Actions minutes/month (Free for public repositories)
- 2GB of GitHub Packages storage (Free for public repositories)
- Code owners
This is completely fair, but lack of transparency makes it significantly more frustrating.
A full FAQ on pricing is available here: https://help.github.com/en/github/getting-started-with-githu...
Hope that's helpful!
PS - No affiliation with anyone.
That said, the news made me wonder what exactly I’m still paying for with my personal Pro account. I went to the pricing page https://github.com/pricing and it seems Pro isn’t even listed anymore? And the Billings page https://github.com/settings/billing says “Pages, Wikis, protected branches and more for Pro developers” without any further explanation or link to docs explaining the differences. I can only assume that Pro has the same set of features as the $4/user/mo Team plan, but the messaging is certainly pretty confusing, don’t you think?
(I sure hope this isn’t a sign of neglect for individual developers, who are still the backbone of open source activities.)
I worry about the community dying and losing my favorite game, but have taken solace in the fact that the source will always be publicly available. If it was banned from GitHub, that's a major problem.
Even ignoring the higher cost to set up, are you sure your self-hosted solution will have better uptime? Are you sure you'll be able to get things up and running faster when it does go down than GitHub will when GitHub goes down?
IMO Microsoft views GitHub's user base as potential Azure leads and Cloud computing as the current & future lucrative computing utilization business model who has been pulling out all stops to grow Azure as fast as possible.
They're fortunately rich & big enough that they don't need every one of their business to maximize their profits and are more than happy to leverage the synergies in their different assets to funnel more business into Azure.
The same could clearly be done for SAML (and I've even implemented SAML and SCIM auth and user management for Okta before in an app, it's not difficult).
The problem is that the only organizations that would make this single issue of SSO support a deal-breaker are bigger companies who can afford to be upsold, so everyone treats this as an up-sell feature. This comes at the expense of the smaller companies, who can't afford to care as much about security. The industry should be making things secure by default as much as possible, and there's a big gap here in what basically every SAAS company is doing.
.alt-mono-font {
font-family: SFMono-Regular,Consolas,Liberation Mono,Menlo,Courier,monospace;
}
AuthN: Authentication (who you are) AuthZ: Authorization (what you are allowed to do)
I guess for that matter... also when has MSFT? I buy they have, but not aware of any examples of the top of my head.
So how does Microsoft make them happy? Give 'em free stuff: Free repositories, student pack, ebooks, courses, cloud credits, etc and they come running back to GitHub. There's Sign in with GitHub which makes it easy to claim all the freebies, unlike the rest of the alternatives.
This is why the majority of developers will stay and some would realise that it will all go down and will leave Github and self-host their own git server instead.
If they mean that they're now removing required reviewers for public repos in the free plan, that's definitely a big step backward I think.
> Required reviewers in private repos
> Protected branches in private repos
> Repository insights in private repos
> Wikis in private repos
> Pages in private repos
> Code owners in private repos
> 3,000 minutes for GitHub Actions
> 2GB of storage for packages
Source: we use an on-prem installation at Vimeo
That only really leaves the fact that its OSS that differentiates Gitlab in your list. Not comparing the two, just making sure you're aware.
[1]: https://docs.gitlab.com/ee/user/project/import/github.html
[2]: https://confluence.atlassian.com/get-started-with-bitbucket/...
Seems like every generation re-invents this idea, and every time it fails for the same fatal flaw: Illusions are just that, and you'll wind up hacking around the illusion if you want to do something not envisioned (or run into a bug in the secret sauce).
And before someone replies "it is nothing like Web Forms!!!" here's a direct quote from Blazor's homepage:
> Blazor can run your client logic on the server. Client UI events are sent back to the server using SignalR - a real-time messaging framework. Once execution completes, the required UI changes are sent to the client and merged into the DOM.
That's literally how Web Forms worked.
We do have a paid plan, right now. Is there any way to continue having that paid plan on the team (paying per user for the extra features) while also adding users who don't share the extra features? We'd like to open up our org to all of our clients who use our private repos, but we don't want them to e.g. have access to all the private k8s cluster configs.
I'm sure they have enough info about onboarding and unit economics to see how it will pay off mid to long term.
I'll happily pay for use though, it makes sense and it makes the value addition of github core vs extra more clear.
I've never had to clarify what someone is actually trying to accomplish when they want "SAML 2.0"
* protected branches
* codeowners
* draft PRs
* pages and wikis
* multiple assignees (PRs and issues)
* required reviews & status checks
sources:
* https://help.github.com/en/github/setting-up-and-managing-or...
* https://help.github.com/en/github/authenticating-to-github/a...
[edit: formatting]
SAML on the other hand is different for each organization. Providers pay Auth0 and the like to have developers on staff who know the pitfalls and quirks of ADFS 3.0 on Windows Server 2012 R2, so they don't have to. Dealing with a single Okta as IdP integration is like the absolute best-case scenario there is. There is also zero consistency in what actual data IdPs returns out of the box to the SPs, so now you're walking the customer's admin through setting up the proper attribute mappings, etc.
I also very much disagree that SAML is a net security benefit, at least directly. It's for convenience, top-down visibility and control into what people are using, de-provisioning services, onboarding and offboarding users at scale etc. e.g. problems that only big companies have. Many SAML implementations are just as likely to add truck-sized security holes to the service provider when done poorly, and a lot of them are done poorly.
No, there has not been any change to the data pack pricing for LFS data.
Glad this will help you continue building on GitHub!
We moved across when GH did their pricing changed. Free CI/CD well before "actions". Never looked back.
The only way I can think of is to have a bot be the only one with commit access, and to interact with the bot to do merging. But that seems pretty roundabout.
I'm a user of both - Github for OSS, and Azure DevOps for private work. IMO, these areas are where they are best suited - pipelines in particular are really powerful in Azure DevOps, and user/permission management, AAD integration and integration with build agents are all excellent.
I really like Azure DevOps, but all this has me worried about it's future - do you know if it's going to continue to exist and be developed in tandem with Github?
First, Microsoft was evil back then because they didn't just rely on excellent pricing and features (both of which they had) - but also because they leveraged their monopoly in one market (desktop operating systems) to prevent competition in adjacent markets (browsers).
I think it's difficult for people to believe that Microsoft has evolved, and grown more responsible (Hell, I can run linux directly with windows - with kernels available on the Microsoft store) - but you need to follow the evidence.
Also, leadership: Satya Nadella != Steve Ballmer.
We have multiple client sites (completely static) we're hosting on $5 Droplets (+GST+Backups).
We plan to deploy more such sites and keeping them on Gh-pages (auto build using GH-Actions) would reduce a lot of headaches for us.
Right now we've had all private repos scattered over everyones individual accounts and managing this has been a pain. So it would be nice if there is a single place to keep it all (thanks to free private repos for teams, we'll be migrating all of it to one place soon enough).
With 3 team members, $12/month for all the extra goodies seems reasonable.
We initially used BitBucket but switched to GitHub as we prefer it's UI/UX/Familiarity + a single place to manage both work/open source issues/prs etc is definitely easier.
Oh and gotta need that repo/contributor insight to compete with team mates :P
Since OIDC is better than SAML, which is probably the scariest security standard on the Internet, I think it's worth being clear to people that OIDC/OAuth is viable.
The SAML authz story, for what it's worth, is pretty shady.
In Firefox:
- Right click on the element, select `Inspect Element`
- Click on the Font tab on the right hand side and it will tell you which font is being used.
Well, unless they decide to switch market or shut down, in which case you're hosed no matter how much you're willing to pay.
Now that the core Pro features are free, I wonder if Rob will update sso.tax to set Github to :inf:.
Instead of directly bolting SAML into your app, I think a FOSS implementation of an independently running service is the way to go. You run the battle tested open source service (locally / in your cloud), it accepts the SAML assertions and mints something sane like JWTs which can easily be consumed by the service providers, isolating the entire thing from your core app and allowing it be used with any stack. E.g. essentially an open source locally deployed Okta. Doesn't even need to do any user management, just focus on rock solid interoperability and forward all decision making to the actual app server.
There's a lot of functional overlap between SAML and OIDC/OAuth, but SAML is a very different (and idiosyncratic) protocol; the "what" is the same, but the "how" is very different.
For developers everywhere competition is great. We recently made 18 new features free and open source https://about.gitlab.com/blog/2020/03/30/new-features-to-cor... and today Github with an improved free plan and their team plan came down to the exact same price as our most affordable plan. BTW Maybe an idea to rename their lowest tier from team, may we suggest bronze? :)
Since you mentioned contrasting here is a quick take on the features that you lose if you go from a GitHub Pro account to a Free account, I got the list from https://news.ycombinator.com/item?id=22867974 :
Protected branches in private repos => Free on GItLab
Draft PRs in private repos => Free on GItLab
GitHub Pages in private repos (using 1) => => Free on GItLab
Wikis in private repos => Free on GItLab
Code owners in private repos => Bronze on GItLab
Multiple issue assignees in private repos => Bronze on GItLab
Multiple PR assignees in private repos => Bronze on GItLab
Code review automatic assignment in private repos => ?
Scheduled reminders in private repos => TODOs are free on GitLab
Standard support => Bronze on GitLab
The most important bit is workflow automation. It can be triggered on most (all?) events github emits
https://help.github.com/en/actions/reference/events-that-tri...
It was super obvious the value prop when it was HCL based. YAML based it kind of looks more like 'another CI'. It's still insanely powerful, just not as developer friendly anymore.
Huh, I thought github made private repos available to free github accounts a while ago?
Looking for historical announcement, aha, it was not with "unlimited collaborators" before.
From Jan 2019:
> GitHub Free now includes unlimited private repositories. For the first time, developers can use GitHub for their private projects with up to three collaborators per repository for free.
https://github.blog/2019-01-07-new-year-new-github/
So what's new is dropping the 3-collaborators-per-repo restriction.
I hadn't actually realized this restriction was there, apparently I've never used a private github repo in a free account! And the messaging from a year ago stuck in my head as "private repos are free on github now", I thought they had already done what they did today, oops.
Above natfriedman writes:
> We've wanted to make this change for the last 18 months,
So apparently they had wanted to do this even in Jan 2019 when they did something less than this...
I don't see what paying Github would do for AWS or GCP. They both have their own code repos, build pipelines, container registries, and more. Even Azure has its own DevOps product.
Whereas there is a need for legal corporate personhood (so they can enter contracts, be sued and sue others, etc), the extent to which a corporation has a "personality" is very much debatable— sign contracts, sure; but fund political candidates? Have a political opinion even? That's crossing a big phat red line most countries have outlawed (with good reason)— only citizens in their own name (that of a natural person) may participate in the civic life, whether board member/CEO or the lowest paid employee: same rights and duties, in a truly democratic political theory.
Factually, when psychologists attempt to describe the behavior of corporations, they are faced with "sociopathy"— but let's not pretend it's a trait, because it results more likely from the absence of consistency between people, departments, historical periods... it's not and cannot be as stable in space and time as a real natural person.
Corporations are neither good nor bad "people", they are simply not "people", but a different category of objects. We could also demonstrate conversely that natural persons and households belong to very broken categories of businesses... because they're not businesses!
So when we anthropomorphize corporations and businesses like they're people... we really create meaning out of thin air that never was there. If it's a one-man show, sure, obviously. Above that begins a very slippery slope that leads to super PACs and other churches like Evil MS versus Heavenly Apple and what-have-you.
Whatever greatness or horrors we observe from corporations should be attributed directly to the natural people who make those decisions— it's not Boeing that's bad, it's whoever's in charge and whoever condoned it. People. Boeing is just a 6-letter words, you can't put "Boeing" in jail, nor make it "Sir" by a Queen...
So I'd rather praise Nat himself than "GitHub" here, and I'd rather judge him and Satya Nadella in name than "GitHub" or "Microsoft"; recognizing that he (they) can't possibly be alone in this so the praise extends to all employees who strive to make great on a vision... and also the blame lies with them, when they're being disingenuous. People, real people, with real names and a past and loved ones and maybe kids and political opinions. Not an abstract 6-letter name who's already changed in the timeframe I wrote this post, as two new people got hired and another one left.
Indeed, a corporation is a permanent ship of Theseus: who's left, at Microsoft, from the 1990s? How much power do they command? Here is the real link between that era and now, behaviorally. The name matters little, people manning Microsoft 40 years from now will all be new people. Transmission of culture is limited between kids and parents, and even more so between one's predecessor and one's successor at a job.
Microsoft has changed, as a group of people, because well... most of these people have left and new ones came in.
Sorry for a long piece; but this truth needs saying, especially in these times if we are to reform our societies to better solve the pursue of a "greater, common good". Mistakes were made (in the legal structure of things), ethical compasses need realignment (let's just admit people from the past couple centuries couldn't get everything right nor possibly predict our present, and let's just move on with our times, our challenges, shall we?)
I'm very interested to hear what Hackers have to say about this, although I suspect it's become a fairly non-controversial, almost benign realization nowadays (used to be ridiculous, then dangerous thinking, now it seems obvious retrospectively like any real paradigm shift).
You can see that there's a lot of overlap and that these offers cover very broad sections of the industry. This gives students the opportunity to explore and develop immediately employable skillsets without impacting their already limited budgets.
My guess is that it is unlikely to see your request for a more generalized script or Dockerfile runner realized because that (Dockerfiles) was the original implementation of Actions during the beta; they pivoted away from that to the current form.
Still waiting for it for the last few months. :)
Is it? Past behavior on the scale of decades, with leadership and org changes, market changes, culture changes in between?
I don't think that my behavior 10 or 20 years ago is a very good predictor for my behavior today.
Isn't that exactly what's happening here?
Gitlab competes with Github, but doesn't have the equivalent of Azure to subsidize it with.
Azure competes with AWS and GCP, but Amazon or Google don't really have a Github competitor. (Maybe Google has a small one (?), but I've never heard of anyone using outside their cloud product.)
Bringing Github and Azure closer together is an obvious move.
Github might not be a monopoly in the legal sense, but it's a solid #1 in the space, with strong network effects. On the other hand, Azure is far behind the near-monopoly AWS.
Blazor is the next evolution in client-side and offers an alternative to building component UI with C# running through WebAssembly instead of Javascript. Again it's much more productive and lets backend teams reuse much of the same code, similar to JS/node projects today.
Blazor's server-side runtime is a optional model where all the component logic can run on the server and be delivered over a SignalR connection to further increase productivity and efficiency where it makes sense (highly constrained devices, local intranet apps, etc. There's even experimental projects to bring Blazor for mobile apps.
We couldn't push to master, but we could merge accepted PRs. Not sure if this was done with GitHub or with Git itself.
* Sometimes legal counsel provide advice that there should be no further response to the individual or organization. Often technical people don't understand this situation, but it doesn't change the merits of the legal advice. In smaller organizations a leader might take a chance in further engagement, if they think it's helpful, but it's unlikely a large organization would expose themselves to this risk.
* Breakdown in internal response processes. You'll find that many people are really uncomfortable in these situations (e.g. compliance team shut down service, but don't "own" the response.) Unless the legal team has written a response and instructions on how to deliver it, you will often see people in organizations avoid giving the response. Things get passed down as low as they can go which doesn't help because there is less experience with handling tough situations. Very often some poor person with support ends up having to give the response and they basically ignore it because they can avoid the situation. This isn't very professional of the organization, but it's a reality.
OAuth is way more complex, I've used it countless times and still get confused by it. It has more complex patterns like having a separate resource server and authentication server, it's used for more purposes, e.g. sometimes for API access and sometimes for login and sometimes a confusing mix of both, and there are big differences between v1 and v2 and some services are still using v1.
I'm also not sure why you are conflating Silverlight with Web Forms - it was never competing with Web Forms, it was client-side only, a replacement to Flash - a better UI and API (at the time) than HTML/CSS/JS.
Blazor is OSS, and doesn't work like Web Forms.
As in your own quote, Blazor uses SignalR - which uses push-based comms, such as Web Sockets; Web Forms was standard HTTP.
Why you ask? You have total control over the stack, CI, etc and some orgs have in-house sys-admins or IT department to do all the work independent of a third party like GitHub. Maybe you should ask the Linux Kernel Project, WebKit, OpenBSD, Mozilla Firefox and even RedoxOS maintainers about why they self-host their projects which some even have mirrors on GitHub.
On another note I keep seeing this over on some repositories and now because it is 'private' I don't even think it remotely makes sense or is a good idea to even use GitHub to backup private keys even if the repository is 'private'. As long as it is on someone else's server, you're not in control.
Just pointing that out - to be clear, I don't buy into all the Microsoft bashing that there is on HN (and I say that as someone who was around when Microsoft gave plenty reason to be hated).
Make no mistake: this is about control.
Unless you stretch the term so broadly that "I think Apple is planning to produce a mobile phone" becomes a conspiracy theory, I suppose.
I'm however speaking from the point of view of the service provider (the SaaS app) and about SAML in particular. I feel that the addition of SAML into a given service is a net-negative from that service's security point of view. It's a large additional complex attack surface, many open source SAML libraries that I've reviewed have a history (and in some cases open issues right now) of "pants on head" type of security errors. A popular library in use right now, has a known race condition where it gets confused if there are concurrent SAML requests happening.
And that's just the libraries. Then you have to use them correctly. The libraries do the absolute minimum checking since they don't have the context, you have to add a laundry list of your own checks to them. Just recently there was a HN article about taking SAML assertions posted to provider A and re-using them on provider B, where clearly the most basic of checks aren't in place at all. There's all kinds of confused-deputy type of problems I believe most service providers don't think about at all. And that was an easily offline checked attribute, I believe if you'd start to check how many services correctly implement even the basic "inResponseTo" check on SP-initiated flows (which requires a distributed cache on the service provider side), you'd find they don't.
And for the classroom system, it's open-source (https://classroom.github.com/) and you can run it on a box at home. That'd work given you probably only have a couple users at any one time.
Though it does require a bit of between the line reading
Yeah, criminals are always arrested and convicted. /s
It's a balance. With something as essential as human rights and personal freedom, people (tend to) err on the safe side. Online moderation can err on the other side, since consequences are relatively modest. If you get banned on GH, move to Gitlab or host your own, that's hardly a tragedy.
Meanwhile: we're discussing Github, not a random cat-sharing startup. Github has one of the larger security teams in the industry. The parties implicated in Github SAML are Github, Okta, and Github customers, who do not actually have to implement SAML. Github SAML is not in fact a net-negative for security.
That's not true. We are a tiny company (~10 ppl), but SAML, OIDC (or GSSAPI or Radius, if really necessary) support are a deal-breaker for anything we use.
We used to have separate accounts for everything we had. It became a drag, we had to solve it. Nowadays, either it can be integrated with SSO, or we will do without.
> so everyone treats this as an up-sell feature.
And that's the mistake.
I was a Web Forms developers, I've earned at least that. Blazor absolutely does work like Web Forms, in terms of client<->server integration, just because it uses WebAssembly & SignalR instead of JavaScript & Ajax doesn't really change that but rather obfuscates it. Essentially it is just another set of abstractions attempting to paper over a real boundary.
> As in your own quote, Blazor uses SignalR - which uses push-based comms, such as Web Sockets; Web Forms was standard HTTP.
Which makes it even worse, if the client/server boundary wasn't muddied enough with with the unidirectional magic Web Forms used, now we have omnidirectional instead. As if that will make it less complicated and buggy.
Definitely put me in the "nay" category with Blazor. I've danced this exact tango with Microsoft twice before, and their obsession with making browsers desktop-like applications. WebAssembly is cool tech for one day, they're just abusing it for something that is an inherently bad idea.
I think the person who solves project discovery across all these services is going to make a killing.
For sure this is to the benefit of the involved companies. But paying for good tooling is normal not strange. When you go to your local handyman he will tell you a lot about good and expensive tools.
It's also worth pointing out that it doesn't have to come from malicious intentions.
You want Keycloak - https://www.keycloak.org/ - then.
The new plan is a downgrade from the old one. For example, it will only include 3000 Github Action minutes. The old plan included 10000. The next plan up would be > 2 * old price.
Source: https://github.com/pricing vs http://web.archive.org/web/20200406010552/https://github.com...
Not true.
The new Team plan will be a downgrade in specs from the old teams plan. For example it only includes 3000 Github Action minutes. The old plan included 10000. The next plan up would be > 2 * old price.
Source: https://github.com/pricing vs http://web.archive.org/web/20200406010552/https://github.com...
How do I downgrade without losing all my private repos.
Thank you!
I once tried to implement it, and found that the specification was spread across ~500 pages of dense PDFs. I find it to be complex.
True, but that applies as much to their $200k figure.
> This gives students the opportunity to explore and develop immediately employable skillsets without impacting their already limited budgets.
The stuff that's worth using has free or cheaper alternatives anyway.
I guess it is up to us to guess. Anyone?
I see GitHub being the unmovable giant here. Microsoft is publicly developing on it, as opposed to Azure Dev Ops. It has a very large mind-share. More developers are willing to use it without having the Microsoft stigma that some nix people feel.
"Your account can not be downgraded yet because one or more of your private repositories is over the collaborator limit for the free plan. Please make sure that each of the private repositories owned by your account below has 3 or fewer collaborators before downgrading your account. Questions? Please contact support@github.com."
Am I missing something or is this not implemented yet?
Source: Watching an alcoholic CTO get fired by the board and taking the startup's hosted Mongo database hostage
Maybe when Microsoft would have opened up some years earlier, Codeplex would not share the fate of Google Cloud.
I have a theory that one reason we don't see many your-SAML-implementation-is-completely-broken reports is precisely because it's a gated enterprise feature, so few independent security researchers have the access or ability to poke and prod at them outside of private penetration tests.
I don't mean to be rude, but have you worked at a very large company like Microsoft or Amazon or Google? Redundant products are par for the course because of the byzantine internal politics and funding structures of big companies.
And that's money that's not going to better equipment. Or your salary. Or whatever else that it could be spent on that would have a far bigger effect.
> But paying for good tooling is normal not strange.
Paying for bad tooling is normal. Good tooling tends to come as a consequence of trying to solve something else.
Bad tooling also tends to be much more expensive to produce, because it's so prone to scope creep. Visual Studio had to build their own Docker wrapper, because telling people to just use it directly would give their users a glimpse of the outside world, and we can't have that!
> When you go to your local handyman he will tell you a lot about good and expensive tools.
The vital difference is that physical tools are expensive to duplicate and maintain. You can't distribute a hammer via BitTorrent.
Update: apperantly github also has self hosted runners
https://help.github.com/en/actions/hosting-your-own-runners/...
The worst bugs here are indeed mostly private, but that's because they're feature bugs inside of people's random products; they're like every other bug in that regard. But people do find and report bugs in the SP libraries.
I agree that SAML is risky to implement; since we agree that Github SAML is an unalloyed good thing, we'd be searching for reasons to disagree at this point.
People tend to get pretty upset when someone is very clearly complying with the letter while flying in complete opposition to the spirit, and it's not always an easy fix.
I don't know how much control their external board members have, but if an offer came in, the board may be able to force acceptance instead of going public.
In the long term we'd probably see the cloud providers create their own social revision control projects, and then fuck around with private APIs so the quality of the integration between their cloud service and their source control leads you to stay locked in.
Even in that scenario it could make sense for there to be a 'neutral' party like gitlab, though.
I acknowledge this is my own imagination and I've no claim to know the future! :)
That is a class act right there.
Now, if you would open source github...
I kid. I have zero hope that that will ever happen.
It has always been bizarre (IMO) that arguably the most popular open source dev forge, er, hub, is closed and proprietary. But what can you do?
Remember when all those FOSS devs sent an open letter to github whining about that and begging for attention? https://github.com/dear-github/dear-github (Ironically, they "signed" it by filling out a Google docs spreadsheet! As opposed to, say, patching a file.)
Utterly bizarre.
And now they have done it again, apparently because GitHub serves ICE: https://github.com/drop-ice/dear-github-2.0
They "call upon GitHub to: Immediately cancel your contract with ICE ; Commit yourself to a higher ethical standard with all of your business dealings ..." [in writing]. But they stop short of threatening to leave if GitHub doesn't comply with their demands.
Leaving aside the politics of ICE, and the strangeness of talking to "GitHub" like it's a single person, it seems to me that without taking some action (like moving to e.g. Srht or self-hosting a DVCS hub) that this is just posturing.
Anyway, congratulations on sucking more air out of the room of FOSS development. In the words of the aforementioned, undersigned, concerned peasants, excuse me! users, of GitHub:
> We still believe in GitHub as a platform, as a place to help the open source community make the world a genuinely better place. Please, step up and join us.
There's this irrational demand vocal on social media that large corporations keep their products forever.
A few questions:
Do you think the scale could be handled better if you informed repo owners 1: that their repo was disabled, and 2: why their repo was disabled?
Currently the owner has to contact support to know why it was disabled, our repo was disabled thursday at 5am pdt, we sent a ticket by 6am. We still don't know why it was disabled. Its tuesday. (edit: we did get a reply, vague comment about slurs, nobody's sure if its the nword word filter (so thats getting removed, ironically enough), or the comment from 2014 with a soft-a, (but it can go), or the fact that the meatball food item has a, umm, british name)).
Also, do you think the scale of content moderation would be easier if you tiered repo disables between can be resolved and can not be resolved, and in the former case provide the same 24 hours deadline that you provide line item dmcas, as well as provide access to the owner during any suspension if the 24 hours deadline is not met (That you also provide to line item dmcas)?
All of these unneeded trips to support has to be eating into the efficiency of things.
If you want self hosted IAM solutions. The most common one is Microsoft active directory. It provides both SAML and OpenID Connect integrations out of the box as of ADFS 2016.
Still, SAML requires to onboard applications individually, create keys, and stuff. It's not plug and play, it really needs humans on both sides to add a new service.
AFAIK, there aren't any plans in Azure to give up ADO in favor of GitHub. If anything, with the push to standardize builds internally, it wouldn't make sense to move to GitHub for at least another 2-5 years.
Obviously, I don't speak for my employer and leadership may have other directions in mind.
When did Amazon give up?
You take some open source pieces you can (saml, xml, oidc, ssl, jwt) but permissions, groups, user attributes, keys are always per company then the whole thing together has to be supported into end-user applications running on language and frameworks of the day with their own restrictions, so custom.
For example, people who harass others just within the confines of the rules so that they can't be banned from a community solely using the rules.
This is why we need humans to judge the spirit of the rules.
https://www.wired.com/2015/09/what-to-do-with-your-zune-rip-...
The company who STILL supports 16-bit apps?
https://www.groovypost.com/howto/enable-16-bit-application-s...
Ya... I would hardly say MS is known for killing stuff early - more like they've spent years being ridiculed for carrying baggage forward for decades longer than anyone else.
MS might be bad at a lot of things, but I'd hardly say they're known for "burning products with little notice".
This messaging is very confusing. Teams is not being made free, you need to pay $4 per user. A better message would be: "we're reducing your price to $4pp, and giving you access to more features."
Speaking as a long-time user, over the last 10(?) years I've only ever needed to reach out to support@ twice or so, both times with fairly obscure issues that were promptly dealt with -- thank you.
It'd be a shame if the implied change to "community support only" for free accounts means that free users no longer have any direct way to contact support.
I am actually going through the list and thinking my company might be able to do with the free plan from now on.
It’s probably great news for the vast majority of teams.
The messages are under specified and overcomplicated, doing incredibly obscure stuff (XML signing and canonization for one) that nobody can understand and implement. That's mainly why it's so hard to use and there is so little support from libraries.
As security researcher, we could nitpick all days on security being hard, no matter the solution. It is factually true but it doesn't help developers, fact is, developers would be better off ignoring SAML and going with OIDC instead.
It does work for the basic use cases, so I would still consider that an better option than rolling your own for the average service provider.
Instead, use a self-hosted Gitlab instance or similar, preferably with an external firewall preventing outbound and non-team inbound connections if feasible.
2) You can be shot without any explanation whatsoever.
3) Your possessions can be taken away, and sold off without any explanation and without recourse.
Links about each of these claims:
https://abovethelaw.com/2018/07/innocent-people-who-plead-gu...
https://en.wikipedia.org/wiki/Shooting_of_Walter_Scott
https://www.forbes.com/sites/jacobsullum/2014/09/11/how-cops... (also applies to, say, cars)
Now I can at least compare the two.
Azure Devops deployment tools are (were? It’s been a couple of years) just as good for deploying to AWS as AWS’s own tools.
2. I think the product complexity issues are, like, 95% the same whether you use OIDC or SAML.
3. I think no matter how much simplification you got from using OIDC instead of SAML, none of it is going to offset the actual reason why SSO integration is a paid feature.
4. I agree that SAML is much worse than OIDC from a protocol implementor's perspective even if I'm not so sure that it's much better from a developer's perspective, so wouldn't want to find new reasons to disagree.
Even in cases where the IdP supports both SAML & OIDC, I see almost no one choosing to use OIDC (a case of the devil you know?). The only real users of OIDC in an enterprise setting I see as a service provider, is G Suite businesses.
Do you actually believe this was the reason behind developing Docker wrapper for VS? I mean you can always try stretching out the worst intention and motives, but do you actually believe this?
Suppose you do, how do you think about the gazillion 3rd party open source extensions to VS code? Did Red Hat develop OpenShift extension because they are part of the conspiracy too? Do you think that this is part of course change due to the IBM acquisition?
>The vital difference is that physical tools are expensive to duplicate and maintain. You can't distribute a hammer via BitTorrent.
The fact that you can distribute software for nearly free doesn't make the cost of producing it to be cheaper than hammer.
Google's text messaging and video chat apps didn't get that memo.
I still buy a Windows license to play video games. I don't want to use Windows or buy a Windows license.
Of course, I could always choose to not play video games, so technically you're correct that I wasn't "forced" into their ecosystem. But I'm still there and I don't want to be. This is a direct result and present day residual benefit of their anticompetitive practices over twenty years ago. These are very long games that they play; you don't make hundreds of billions of dollars by accident.
That said, like 90% of my Pipeline actions are "screw it, I'll do it all in PowersHell"
I'm pretty sure OIDC can be supported everywhere now. Okta, Oauth, PingIdentity, ForgeRock, Microsoft all support both. The last offender was Microsoft but it's included with active directory since 2016 both on premise or through Azure.
I'm working on auth for a big bank and it's definitely there, although not necessarily advertised and not everybody understand what is supported or preferred.
If a company were to only support OIDC nowadays, and maintain that OIDC is the preferred protocol when customers ask "can you do SAML?", I am willing to bet that most customers would integrate just fine either way.
Azure DevOps and Github largely cover different, though overlapping market segments.
I would be slightly more concerned about Github Enterprise and Devops co-mingling over time, as I think that may be inevitable, which makes me concerned over the public/free resources that Github offers in the long run... even then, migrating to Gitlab is an option should that time come. My only hope would be better discoverability and social coding with Gitlab to better match Github over the interim time.
Even then, it's just a possibility and somewhat unlikely that MS would burn this much karma.
[0]: https://github.com/pricing
[1]: https://sso.tax/
Why not just use Gitlab if you really need on-prem for cheap/free?
I tend to stick with bare scripts and npm scripts as much as possible though, so the environment doesn't matter as much.
I don't think there is an explicit conspiracy. I do think there is a negative spiral where IDE addicts (for the lack of a better term) produce tools that "help" others avoid leaving their comfort zone.
I'm not immune to it either. When trying to learn Kubernetes I spent weeks fighting the graphical dashboard before just hunkering down and learning the core concepts and building my own intuition.
And I still like having an integrated environment. But with Emacs I'm at least generally just a `describe-function` or `describe-key` away from peeking behind the curtains.
> The fact that you can distribute software for nearly free doesn't make the cost of producing it to be cheaper than hammer.
Bad analogy. Producing it would be closer to developing the blueprint. Which is:
1. Done once
2. Tends to happen without economic incentives because, as it turns out, you probably want a hammer too
It's replacing an open, free (in both senses), decentralized system with a closed, for-profit, centralized one that expressly benefits a single organization at the expense of everyone else in the ecosystem.
This is not to say that GitHub isn't a benefit over emailing patches around; just that it's probably also worth mentioning that Linus et al have not migrated to this shiny new (centralized) system for the largest collaborative development effort in the history of the world, and, indeed, git itself was developed specifically to avoid a hard dependency on a single, centralized point.
The judicial system that backs it is a massive beast. If someone wants that level of assurances, they should be paying thousands of dollars for a github account. You get the level of perfection you pay for.
One can find an open source library to handle part of the SAML or XML in Java, but it doesn't take the right settings or import user attributes as needed or handle URL redirections properly. So the company has to write a ton of authentication code to make it work. It may start from an open-source library but the result is either separate code on top or an outright fork.
Microsoft is still a company, that called linux a cancer. No trust at all.
One need only look at what they've done with Windows and Office and Xbox to see how Microsoft approaches client software.
Here's hoping I'm wrong about all of this.
But dismissing presence of companies culture is as extreme point of view as dismissing possibility of change. To name a few - Oracle, Google, Facebook, Apple, Toyota, Tesla - they are different and quite predictable.
> If it looks like a duck, swims like a duck, and quacks like a duck, then it probably is a duck.
I am not in "Evil MS" camp but
> Fool me once, shame on you; fool me twice, shame on me
Same as with people - sometimes they change but sometimes they don't
And corporations are inherently dangerous - they maximize profit. Unbound by law, unchecked by people, even amazing people with nicest slogans would make dystopia.
I mean, if they hadn't done a thing it would have been a great job, too. Pumping in cash to fund previously paid features for free sure goes a long way, too, but the changes they've made so far I'd hardly call managing and more not touching it aside from making paid things free.
The company will end up writing a ton of authentication and authorization code --- it'll do that no matter what, because the application will have its own security logic, like all applications do.
(OIDC doesn't use XML. But the story is the same, with different endpoints.)
I do assume a lot of this is their own money, but with the financial security that Microsoft offers you just can't do much wrong. Even without actual money actually moving, it might still be MS funding that makes the difference.
Ironically, the first point makes me realize that half the work to bring in a product in an entreprise is to deploy and set it up -properly with authentication- while the other half is to get the budget and approvals to buy it. Thus it's rather relevant to the thread in an unfortunate way.
Not saying they're a philanthropic organisation that should promote open source to the kids or anything, just agreeing about an almost certain side effect.
Alternatively, many people see value in focusing on what they develop and not have to bother studying the fine details of the underlying platforms they use. As someone who live deep down in detail and assist others using tools in the whole range from IDEs to cli, I have no disrespect for engineers who won't bother spending their time on knowing the subtitlities of the systems where their code will run.
>Bad analogy. Producing it would be closer to developing the blueprint.
Software tools are far from blueprints that are done once, they require constant maintenance to be compatible with changes in other tools and environments, bug and security fixing as well as implementing new features that users request.
Software development is extremely expensive, libre software is free only because someone is paying the cost of production and prefer to distribute it for free. Probably most of the open source software today is paid for by big companies, and their aim is usually to gain something from the investment. Docker wasn't developed as a manifestation of free speech, nor was Kubernetes born under GNU's roof. If not for the piles of money Google and Red Hat spent on it, Kubernetes couldn't be anything resembling the amazing beast that it is.
Also, FWIW I think we need to move away from GitHub.
One could argue some MSFT acquisitions have been focused on acquiring large swaths of exisiting users moreso than acquiring revenue streams or work product. Github could have been one such acquisition.
Grumbly investors beget grumbly board members, who then vote to oust executives to correct the profitability problem.
How are you going to alienate/lose customers by not getting rid of customers? If anything, I'd argue the opposite; a platform that refuses to ban legal content is one that I find easier to trust (for a counterexample, see Google). It's not even like github-like companies are social networks where you can claim that one user's experience of the platform is made worse by another user's posts.
Then you get the apps.
Then you win the consumers.
How long to the next Microsoft Phone?
Wouldn’t want to be Google.
And, note, that there is, and obviously wouldn't be, a law against a monopolist giving it's monopoly product away for free - That's kind of like anti-leveraging.
Look at this from a different perspective - free git hosting for teams is awesome. This is unquestionably a positive thing that Microsoft has done. It's good to be a bit cynical, but not to be so cynical that we put blinders on to the wonderful resources that are now being made gratis.
And, as long as they don't try and put some crappy "Microsoft only" extension onto their platform so that the vanilla git doesn't support all of it's capabilities - it hasn't taken that dark step into "extend." Once they do that, then it's worth a post to HN about Microsoft's Embrace-Extend-Extinguish dark past.
> For more than 99% of customers, these changes have lowered their GitHub bills, in many cases quite dramatically. For a very small number of customers who use a large percentage of the free Actions minutes allotment each month, these changes have the potential to cause your bill to increase by $20-50/month, depending on how much you use Actions in the future. To offset that possibility, we’re adding a free credit of $500 to your organization’s GitHub account for you to use in any way you want.
0: http://azpodcast.azurewebsites.net/post/Episode-321-GitHub
- Business Contact Manager for Outlook, Outlook Customer Manager
- Microsoft Invoicing, Listings etc.
And these are critical applications for a company.
Have a look at Sharepoint which is widely used and has an uncertain future. Or the strategy behind Lync, Skype and now teams.
But we'll see. Microsoft has shifted in a good way in the last couple of years but their track record in keeping legacy operating system APIs for decades is not necessarily a good indicator of the stability of their other product lines.
Our team doesn't really see the value when it's just fine to have links to PRs or commit hashes but hey, to each their own.
Even GitHub was never in a position to go public, that seems to be mere postering to drive valuation or attract M&A offers.
Edit: The FAQ points to Github product page [1] which list GitHub Team having 10K Actions instead.
[1] https://help.github.com/en/github/getting-started-with-githu...
Even setting that aside, SSO is a feature which is very meaningful to businesses and relatively meaningless to individuals. Because of that its often used to differentiate between the customers. This differentiation results in individuals getting a discount at the expense of the businesses; which to me makes sense.
https://help.github.com/en/github/setting-up-and-managing-bi...
The concept of actions is new, but it is brilliant compared to traditional approach of doing everything inside the CI jobs, or bring your own docker images.
One could argue that EEE is a strategy to gain monopoly status. Microsoft does NOT have a monopoly in this space currently, but perhaps they want to get one (but only in practice, not quite legally recognized as one).
I see nothing wrong with bringing up EEE before it happens. Which scenario is more likely to discourage the tactic (A) nobody cares until the second E or (B) people are worried about any hint of it.
What is Microsoft doing right now to remove EEE from their options? For example, they could release the whole GitHub codebase under AGPL, and that would be quite a reassurance but not a guarantee.
"It is easier to avoid temptation than to resist it" — Dan Ariely
Isn't this the definition of Federation, rather than SSO?
Most US companies these days have no morals, and are easily influenced by these tactics due to greed and fear of being targeted themselves. Silicon Valley and the majority of the big tech companies seem to be especially vulnerable to this, probably due to their own employee demographics.
What many of these companies don't understand, possibly because they live in a relative 'bubble' surrounded by those who think similarly, is that there are a lot of us out there who not only disagree with this type of behavior, but will actively NOT use the services of any company who supports these types of tactics.
It's always pleasantly surprisingly to go to Gitlab and see how much they continue to improve.
By contrast GitLab's tiers are... Cheap. And it's perfectly feasible to do professional, modern CI flows on their free tier.
It'll be interesting to see what happens next.
I remember from economics that in an idealized, efficient, large market, the price of a product should tend towards the marginal cost of production. In the case of SaaS, that's almost $0 (server costs being fairly low), so SaaS products ideally should all get cheaper over time. Good to see theory matching real-world here.
"We're open sourcing rich functionality across Plan, Create, Verify, Package, Release, Configure, and Defend."
https://about.gitlab.com/blog/2020/03/30/new-features-to-cor...
It's good to see that MS has joined the party.
Are there any plans to make GitHub itself available for self-hosting? I am not sure but the go-to place for open source software cannot be closed source.
Cheers,
Tarun
At LinkedIn they are tightening all of the screws and extracting cash from all comers.
What is different about GitHub?
My guess is GitLab.
This is an old strategy for Microsoft. They used to call it Embrace, Extend, Extinguish.
I started my dev career a long time ago in Web Forms. I went so long without understanding HTTP POST/GET/etc that it harmed me.
Anyone remember UpdatePanel? AjaxControlToolkit? Blazor gives me the same feelings.
The opposite certainly exists though, for example simplesamlphp which gets commingled into a php app codebase as you described.
Which can be and often is subject to abuse.
So instead of a question, this is more thank you. I'm a tiny bootstrapped startup and was only using 3 of the 5 previously minimum seats. I'm a prime beneficiary of this change, and look forward (fingers crossed) to being one of the enterprise customers that pays for everyone else :D
For others, can you elaborate on how this will work for current annual billing customers, I found some vague references but no detail.
Thank you
I can't. Does GitHub really have nothing better to do than to play nanny cop because I used a naughty word in my code? Are brainfuck interpreters now off-limits? How about drivers for teledildonics hardware? Or libraries specifically for detecting and filtering swear words? Or maybe I just want to vent a bit in a comment every once in awhile because of some annoyance with the language or target platform or problem to be solved?
Fuck that and the horse it rode in on. We're all adults here (well, or possibly teenagers, but let's face it: they've probably already heard much worse at school).
Not that this seems like the real reason why SS13 got nuked anyway; if GitHub really has some kind of anti-profanity rule, they're doing a real bang-up job of consistently enforcing it: https://github.com/search?q=shit / https://github.com/search?q=piss / https://github.com/search?q=fuck / https://github.com/search?q=cunt / https://github.com/search?q=cocksucker / https://github.com/search?q=motherfucker / https://github.com/search?q=tits
I've seen numerous posts noting the sharp decline in contribution soon after the acquisition was announced.
https://news.ycombinator.com/item?id=22601451
https://news.ycombinator.com/item?id=21142934
Without an official explanation, given the timing, it'd be reasonable to assume you pulled development resources away from it, the exact thing you actually went on Reddit to claim you wouldn't do:
https://www.reddit.com/r/AMA/comments/8pc8mf/im_nat_friedman...
P.S. I've observed that these kinds of posts tend to turn into a place where people shit on Atom in favor of _insert preferred other editor here_. Feel free to do that here too, but just note that I'm not going to be obliged to engage since it's completely orthogonal to the topic at hand. I think any remaining Atom users at this point are likely already painfully aware that Atom has long since lost the war in developer mindshare, but don't let that stop you from pouring salt on the wound.
IMO you correctly summarized the forces they are dealing with. These people are just trying to make money. Idealism is problematic for the people invested in the company that aren't there for idealism, but money.
At the same time, I am also aware of free and cheaper alternatives for some of the options there.
a) Embrace
b) Extend
c) Extinguish
Nat is the CEO of GitHub, not Microsoft, and despite any promises made on a Reddit AMA a year ago, why would they devote resources to two competing editors?
It offers very little solace to the few Atom users still hanging on, but I think the least he could do is end the speculation, and provide some certainty on Atom's future as a GitHub/Microsoft funded project so we could decide to either move on or stick around for longer.
Please realize that there still hasn't been an official statement that Atom's development at GitHub/Microsoft has been halted/dramatically reduced, or that they hope to transition it into a community led project, or anything to that effect.
I hope an official nail in the proverbial coffin is not too much to ask for.
EDIT: This comment was a lot snarkier in an earlier iteration. In hindsight, I realize that was in bad taste, so I've reworded it and adjusted the tone. I don't think being needlessly confrontational adds any substance to the discussion here (or anywhere else for that matter), so I would like to apologize for that and hopefully de-escalate so we can resume civil discourse.
https://news.ycombinator.com/item?id=22601557
Specifically:
> But the words of the linked Reddit comment from Nat Friedman were "we will continue to develop and support both Atom and VS Code going forward"; that's a true statement today. Atom is currently being developed and supported. That's a case of adhering to the letter of the statement rather than the spirit, I know. But that circles around to the problem of VSCode's rapid ascent in mindshare -- if your company ends up owning two very similar editors and they both have roughly equal downloads and community interest, you might try to support both equally. But if one of them has orders of magnitude more downloads and community interest than the other, you're going to focus your efforts on the popular one.
GitHub has pull requests, actions (mini CI integrations), other fuller integrations running off github hooks.
It's the issues, and pull requests that are the most immediate lock in. Transfer away and you lose your issues and PR history.
But more deeply it's the integrations. Even if it's all theoretically possible through other providers, if you have a working CI system set up to "just work" through GitHub then there's little chance you'll want to migrate to a different provider and have to re-do all that configuration.
Even with a dedicated dev-ops team it's weeks of disruption, not to mention the possibility to get half way through and discover something doesn't work the same way in [Competitor].
If you're up and running with github PRs driving JIRA issues and JIRA issues feeding into GitHub issues. And you have paid github marketplace integrations delivering value, then you're not going to look at a competitor unless that competitor is offering something that GitHub doesn't do.
Up to now the competitors have only differentiated on price as far as I can tell. There's certainly no killer feature of GitLab that people talk about.
For once, I'm not going to complain that something is made in Electron :) It was unusable to me in other ways too.
This was why we got nuked.
If only we knew that 4 days ago when we first got banned, and not, well, 4 days later.
The issue is github works by report only.
You can do what ever you want in a github repo, but if you make a video game on github, and ban the wrong person, they can just go through your repo and look for ToS violations to troll you.
We are literally removing the in game chat word filter for the n word out of fear it could be used to git us banned again by somebody else mad their buggy pr got rejected or their character got banned in game for breaking the server rules
"everyone deserves GitHub" is marketing, not a corporate strategy.
How does GitHub stand to benefit from this change? How does more non-paying users help the company?
I am not trying to be a tinfoil hat jerk here. Life in the age of information has taught us all that (again) "nothing is free". So what am I paying here?
Microsoft could open source GitHub and it wouldn’t make one bit of difference to their strategy, as it would not pose any danger to GitHub’s defaultness.
Gitea implementing a federated mentions model, plus easy cross-instance linking and federated notifications, plus one-click $5/mo hosted instances on a bring-your-own-domain model would, however.
I am beginning to think we need something along the lines of go modules for the javascript world. Cryptographically assured via merkle hash root, fetchable from any url with a standard protocol, and a public caching proxy. Go got it right, rubygems/pypi/npm most assuredly did not. (To be fair, go modules were designed latest of all of the members of that list, giving them the benefit of hindsight.)
Maybe yarn can go this route ifwhen npm breaks fetch for non-first party tools.
I wonder what would be involved in forking npm (the hosted package repository, not the cli tool).
We got a sales call (seminar) from elastic.co. Despite all the positives, it was a hard value proposition. Why would we switch from Amazon's offering? For us noobs, elastic.co wasn't enough better to entice us to switch.
AWS is clearly scooping up the vast majority of users with their "good enough" offering. (I assume Azure, GCP, do the same.) I'm not saying it's right or wrong. I'm just saying it happens. And now Microsoft has much better forward looking intel.
I've been chewing on this ever since. Feels just like the 90s. I used to write AutoCAD add-ons. We third party developers knew in our bones that eventually Autodesk would steal our lunch money.
FWIW, I closed my personal repos on GitHub, in case any of my wares some day become popular.
--
[0] Amazon Has Gone From Neutral Platform to Cutthroat Competitor, Say Open Source Developers
Community leaders say AWS increasingly poses an existential threat
https://onezero.medium.com/open-source-betrayed-industry-lea...
However, I wish GitHub supported GitHub Pages for private repositories for free as well.
Thanks for reminding me that it really is to each their own, and good luck to you on your path.
This is not the Scunthorpe problem, this is a culture one.
Abuse can be exposed and punished, and very often is.
I think it's interesting how British English pluralises companies and groups in general, in recognition of this fact. For example, "Boeing have made a big mistake with the 737 MAX", where American English would use has. Or, "the family next door are lovely".
How does this price change affect me?
Also, has the number of minutes for Actions gone down from 10k to 2k monthly?
Meanwhile, I work in a relatively conservative industry that also happens to have one of the largest budgets of any 'company' in the world. I have seen first hand when vendors were being evaluated for multi-million (or even billion) dollar projects, both Google and Github being crossed off the list without a second thought due to some of the publicly made political statements and actions of their executives and employees.
See https://github.com/education/classroom/commit/a824a057b939c0...
The comment is not asking for an explanation about supporting an open source product.
They're asking for an explanation about promising continuing support for something and then apparently doing nothing to back that claim up.
You seem to be implying that integrity in public statements should only apply if you're referring to non-free commercial software.
If not, what's the goal of the complaints? I.e. why do you keep bringing this up if you know this is water under the bridge?
I'm a github user, though I wouldn't call myself a fan exactly, and I don't really know how "teams" works or why it's valuable. I came to this thread to learn more, and I find your comments grousing about Atom again. Hence my question.
(because I'm sure MS wouldn't mind if GL's IPO went less than swimmingly because GH duplicated a number of their selling points "for free" ("for now"))
Microsoft Invoice has transitioned to a cloud-based product, so again, they didn't end support. You might not like the new purchasing model, but that's very much different than them burning the product to the ground.
https://einvoice.microsoft.com/Default.aspx?MSIStateKey=f513...
Sharepoint is the backend for onedrive for business, and fully integrated in to Teams. What on earth would make you think it's going away?
This is kind of hilarious. What are you hanging on for? It's damn editor. Pick a new one and move on.
Freeing the code is a check-and-balance issue. It doesn't remove their core power, but it provides more of an escape hatch if they abuse the power. Sure, people could go to GitLab, but (A) if GitHub gets strong enough, they could hurt GitLab's business and progress and (B) it's a much more trivial move for a project to switch from Microsoft GitHub to an alternate GitHub host.
In other words, the easier it is for people to leave, the more incentive Microsoft has not to abuse people too much.
If we were going to go for the most ethical and trustworthy directions, it would probably be stuff like Fossil or SourceHut.
Docker was developed because a cloud provider (Dotcloud) wanted a better way to package their own and their customers' software. As it turned out, Docker was succesful while Dotcloud failed spectacularly. So Docker became the main product.. and now that failed too, as of a few months ago.
The same kinds of "censorship" that you talk about coming from "the left" can be found in extreme parts of every ideology. Conservatives (probably of the rich and christian variety) have pushed many platforms to completely remove all even slightly adult content (the latest example being Tumblr), all sides of the political spectrum have been pressuring sites like YouTube to the point where no political discussion from any side can be monetized...
This is not an issue of political sides - it's an issue of politics (and society) in general.
As for the part about companies not knowing about the people who don't approve of this behaviour: they do. They know exactly how many of us there are: not enough. Losing even a single big investor will make a company lose more money than if everyone who disagreed with them completely stopped using their services.
You're principled minnows to that one profitable shark.
These companies understand profit, and that's where they derive their morality. I'd say it's probably more accurate that most US companies simply don't share your morals, not that they don't have morals at all.
Follow the money. This is a much more useful lens to analyze the situation than to consider the left/right political spectrum.
I looked through my own post history and it looks like I did reply in a thread about this topic a while ago: https://news.ycombinator.com/item?id=22606843
(same thread that I linked above)
I can only speak for myself as to why I posted here. And I really just want an answer for the question I posted (I'm not naive enough to believe a post like this has any chance of changing project priorities at a megacorp). I wrote about this in a bit more detail here: https://news.ycombinator.com/item?id=22875388
And judging from the upvotes, a decent number of people want the same question answered. If you don't care about the answer, my recommendation would be to simply collapse the thread, downvote if you must, and move on.
I'm honestly puzzled as to why so many people seem to be actually offended by the very fact that I'm asking the question, and even seem to be taking it somewhat personally, even though it's not directed at anyone other than the OP.
Because that's definitely one reason why some developers still don't use GitHub.
Take a look at this request which has been open for years and remains unfulfilled:
https://github.com/dear-github/dear-github/issues/74
Is there a reason that such incredibly basic functionality doesn't exist on GitHub but does on all your competitors' offerings?
Comment quality and civility has dropped in the last few months.
I don't use or even like Atom but if this natfriedman says it will be continue to be supported post-merger, then it isn't, then he needs to clear the air.
Mostly I'm curious, just like you. You're curious "what happened to Atom development", I'm curious why people bring this question up over and over on unrelated GH threads when they already seem to know the answer–to wit: active feature development on Atom by Github/MSFT has stopped and will not resume.
I don't see the point of derailing threads/starting editor flame wars over this question, but I am frequently missing some crucial point. So I ask: What am I missing? What's the point of these "what about atom!!" questions when you know the answer already?
These are the actual questions I'm trying to get at:
What made Github/MSFT stop funding Atom development when their CEO went on record to say they won't?
And why haven't they announced that was the case officially?
If the very same CEO then goes on an AMA on Hacker News, surely it's fair game hold him accountable to previous public statements and ask him to clear the air. If this was just some random scrub posting their thoughts on the acquisition I definitely wouldn't have wasted my time to bring this up.
> What made Github/MSFT stop funding Atom development when their CEO went on record to say they won't?
Because circumstances changed and it made no sense to continue to do this. Atom shrank as VSCode grew by leaps and bounds, there's no clear business case for continuing to develop a withering product.
> And why haven't they announced that was the case officially?
Why would they? Why go out of their way to print upsetting news (to some) in a 40pt headline, when the writing is already on the wall for anyone who cares to read it? i.e. what's the benefit to the company of doing this?
I think the better question for the Github CEO was "why did you ever promise to continue supporting Atom? You either knew this was not possible, or were making a promise you could not keep, either one is bad." And the answer to that is probably "to avoid creating a furor around cutting Atom off at the same time as the acquisition was announced." But yeah hearing him say that would be useful.
https://www.wsj.com/articles/amazon-scooped-up-data-from-its...
Surely they wouldn't also spy on their own cloud customers.
I’ve actually had comments deleted for discussing things in this mode: Human X did thing Y.
I think our society doesn’t like it when we highlight personal responsibility for things people are only choosing to do to get a paycheck to pay their bills.
It’s easier for everyone involved to say “Google developed AI software that allowed military drones to decide who to kill” than to say “John Smith developed AI software that allowed military drones to decide who to kill”.
Not that I think we should not use both forms. Individual choices matter, and facts are facts.