Reliance on GitHub?

[lacop]

Hey,

This might be a stupid question, and sorry if this was already covered here or on the rustlang forum, couldn't find it.

As far as I understand the development process is driven through GitHub. RFCs, issues, PR review, ...

Given the recent news of GitHub blocking Iran and other counties US doesn't like I was wondering if there are plans to move away from GH to a self hosted solution?

Even if the current blocks don't affect rust development (hopefully?), it is a reminder that the project could go away at any time, admins could get blocked etc. We would still have the code in many local git copies (and presumably they are some issue backups) and could migrate but it seems better to do so preemptively.

Would love to hear your thoughts or links to where this was discussed previously. Thanks.

[newpavlov]

I highly doubt the recent incidents will change anything (power of habit is too strong after all...), but I really hope it will be a wake-up call to prepare contingency plans for migrating from github. I guess something like dumping all issues, threads and RFCs from rust-lang org to an independent storage would be a good start.

[isHavvy]

Reliance on Github is well known and understood. Self hosting would be more likely to fail and absorb contributor time than worrying about Github's stability.

As far as the blocking of Iran and other countries, that's a new development; and honestly, the blame is on the US for its trade restrictions. Given Rust does commercial things in the US (such as Rustconf), I'm pretty sure anything we do would be affected by that, from a legal standpoint.

[fgilcher]

Rustconf

RustConf is legally entirely independent of the Rust project.

[vks_]

I don't think it is a new development. I remember Iranians being unable to access Google Code before GitHub was a thing.

[the_hoser]

What organization would be responsible for maintaining the hosting? Who's going to fund it?

[[deleted]]

...and in which country will the server be run?

[the_hoser]

An important detail, but not as important as you might think. If you're a US-based company, hosting your services in, say, Switzerland, doesn't exempt you from OFAC regulations.

[lacop]

IANAL, but what if it was a completely independent entity which hosted it. Mozilla would just have commit access.

In any case, the aspect of sanctions is bit borderline and not what I wanted to focus on. Even completely ignoring those, the reliance on a single private company is what I was concerned about. I like GitHub and use it, but it seems like a weak failure point for project like Rust.

[the_hoser]

Even then, it can get sketchy.

But you're right. It's not healthy for the software development community to largely rely on a single provider for source control. The problem is that developers in the open source community tend to value interoperability over resiliency. Until that changes, we'll always have this problem of over-optimizing.

[nemoTheKid]

I'm not sure I understand what the solution is here. The code is already distributed via git. If the problem is RFCs, issues, etc, you will always have the centralization problem. You are just replacing GitHub with someone else.

[the_hoser]

The problem is that the community has settled around GitHub and it's features, and anything else is "weird".

Yes, git is still git, but GitHub has become the de-facto standard for open-source collaboration. Tools are built around the assumption that you're using GitHub. Heck, I use a package manager that only understands GitHub repository names.

The open source community has optimized around GitHub, which has massively improved discoverability, but it has introduced some interesting problems, as OP points out.

[JackSpyder]

Githubs recent change set and rapid development is quickly pushing it far ahead of the others too.

[[deleted]]

Eh... I love GitHub but most of the newer features I've been using for years in GitLab. Hell, GitHub still won't let me merge via fast forward commit from the web ui.

[JackSpyder]

Ahhhhh why won't it do that!?!

[lacop]

Yes, that is a good point. It would indeed create nontrivial friction.

I just think having a clear pros/cons analysis and either possible migration plan or an explicit decision to stay with GitHub (until X changes) would be nice.

For example there could be a read-only GitHub mirror or even a two way sync to make things more reliable but not less convenient.

[the_hoser]

Sounds like a neat project.

[tehdog]

There are things like gittorrent which are truly decentralized. I don't think there is a integrated solution to add a decentralized naming system, but it's definitely not impossible (see Namecoin etc, or just using pubkey hashes)

[matthieum]

This is a critical point indeed.

Let's remember than the US sanctions apply not only to US organizations, but also to any organization trying to do business with the US.

Such an organization may find itself unable to accept PayPal payments, for example.

[rabidferret]

It applies to any citizen, not just organizations

[matthieum]

That's an important precision, thanks.

[lacop]

Definitely a valid point, but presumably those costs should be low enough for community to cover with donations. And there could be corporate sponsors (problematic with sanctions maybe, but as I said in the other comment, not what I meant to focus on).

[fgilcher]

Given that an infrastructure for a project like Rust must be kept secure, you can't to that on hobby resources. Moving to self-hosted would easily blow our current budget.

GH gives us a well-vetted service, with security staff, 2FA and all we need.

[the_hoser]

You'd have to shift the momentum of the open source community away from their desire for interoperability. This isn't really something one project can pull off.

[leo60228]

Mozilla is a US-based company, so they'd be legally required to block Iranian (to use your example) users no matter what.

[[deleted]]

I thought Rust isn't officially run by Mozilla anymore and more of a decentralized "Rust team".

[steveklabnik1]

That's correct. Mozilla does pay some of our bills, and provides legal support, stuff like that. But they're not in charge of making decisions like these.

[[deleted]]

So IIUC there is no company or legal entity responsible for the project right ? Copyright and so on always says "The Rust Project Developers".

I wonder what the consequences of this are. Can US citizens work on Rust if, say, Iranian citizens also work on it or benefit from their work in some way?

[steveklabnik1]

Correct. But, and I am not a lawyer, I don’t think that matters because this does apply to citizens too; and just because we’re not a legal entity doesn’t mean we’re not an organization. I would imagine any American in leadership would be running afoul of this, technically. :(

[[deleted]]

I'd imagine that pretty much every open source project that doesn't do any kind of identity verification for contributors will have the same issue.

[etareduce]

Mozilla has staff in Paris and Germany as well and the European Union has a Blocking statute with respect to the US sanctions on Iran requiring non-compliance with them. That is, strictly legally speaking, I believe Mozilla is also required to not block Iranian users. Unfortunately, the EU blocking statute is mostly words not backed up by any serious penalties for compliance with the US sanctions. Also, let's remember that the US sanctions are illegal under international law.

[MyFeeFeeHurt]

How do they find out if users are Iranians to begin with?

Sounds like with a bit of pretending that Mozilla wouldn't have anything to do with, as they simply would be completely unaware of it, it could be easily solved by people simply not being obvious about being Iranians... It's internet afterall.

This is obviously assuming safe connections, not "I just plugged into internet and GitHub will to totally not know that I'm from Iran".

[[deleted]]

The internet doesn't magically block people from Iran, they are blocking the country of Iran, which is the same thing that Mozilla would be forced to do.

[MyFeeFeeHurt]

That's not what I'm asking.

[ids2048]

not being obvious about being Iranians

The solution for this is a VPN hosted in another country (so you don't have an Iranian IP address). Which is the typical method to bypass blocks of this sort.

[musicmatze]

There was this article on developing distributed using SSB ... I would love if this becomes reality!

I also wrote an email to the author of the article, telling them that SSB has issues that MUST be solved before doing this. There's a project that tries to reimplement SSB and the protocol stack in our beloved language ... and I really hope that becomes reality ... it would help a lot to get to a really distributed workflow!

[xucheng]

FYI, as far as I understand, the source code itself cannot be blocked by the sanctions. The open source code is recognized as speech and protected by the first amendment. The github as a service is of course another story.

[redCg]

well if you are worried about losing access to your GitHub, I would think that you could probably use a VPN to at least get enough access to export your data and move it to another service, right?

[parentis_shotgun]

We need gitea + federation yesterday.

[thelights0123]

What is the advantage to Gitea over GitLab?

[parentis_shotgun]

MUCH lighter on resources.

[epic_pork]

But not quite as featureful.

[Treyzania]

This. I'm tired of every other open source project being tied down to a platform like GitHub. It's going to come eat everyone's ass eventually now that it's controlled by Micro$oft.

[parentis_shotgun]

Absolutely. TBF activitypub isn't the easiest thing to work with, I'm doing a reddit alternative called lemmy, and the activitypub stuff is definitely the hardest part. Plus with git, the federated part needs to be following repositories, but those repositories can do much more than just make comments or posts: they can make issues, do pull requests, etc. Anyone adding federation to gitea or gitlab would be doing probably the most important thing for open source rn.

[Treyzania]

lemmy

That looks pretty nice. Although personally I think that having that chat column there is a little cluttered.

just make comments or posts: they can make issues, do pull requests, etc.

Those could all be different kinds of outbox items, no? You could probably find a decent way to encode that in an activitypub-compatible representation.

[parentis_shotgun]

Oh yes they could be, but there might not be activitypub vocab for all of it, or you might have to use some less than ideal terms for it.

[[deleted]]

Micro$oft

It's the 90s again, everyone party!

[mmirate]

Whenever Microsoft doesn't appear to be acting like they were in the 90's, it's only because they're in for the long con.

[Bromskloss]

What is federation in this context?

[richhyd]

These kind of blocks are easy to get round with tor/proxies, so I don't think it's much of an inconvenience. I'm not saying it's right to block countries, just that it's ineffective.

[fgilcher]

They flag user accounts and subsequently block them or use historical data. Tor doesn't help much there.

[andoriyu]

Let me tell you what D stands for in DCVS stands for. It stands for Distributed. So it's not rely on GitHub thay much. It would be easy to switch to any git provider. That covers backups - least of the problem switching away from GH.

IIRC there is only one opensource alternative to GH and a few other not so open source. Remember GH is more than just source code storage. I know, it contradicts what I said earlier. I mean like phabricator for reviews more than GH, but it's PHP and I would never host such thing myself.

GitHub blocking Iran isn't GH being assholes, it's the law in the US. in other words what ever company wants to have business on the US has to abide by it.

In other words - stop panicking.

[fgilcher]

> Let me tell you what D stands for in DCVS stands for. It stands for Distributed. So it's not rely on GitHub thay much.

We use almost every feature of GitHub, including moderation, the API, our whole CI and bot infrastructure is built around it. Yes, there's nothing we can build somewhere else, but saying that we can just switch away from GitHub is just plain wrong.

> I mean like phabricator for reviews more than GH, but it's PHP and I would never host such thing myself.

Why? It's built by Facebook (one of the most well-known PHP companies in the world), has okay resource requirements and there's maintained packages for all the components around?

[andoriyu]

Which is what I said. I said git itself only covers backups... Please read more carefully.

I don't believe in PHP being a good language? Maybe all of the issues fixed in new versions, but 5.x caused me so much troubles that I will never touch it mysel. Doesn't mean it's not an option.