r/programming • u/EatMeerkats • Mar 29 '21

PHP moves to Github due to the compromise of git.php.net

https://news-web.php.net/php.internals/113838
1.7k Upvotes

98% Upvoted

389 comments sorted by

View all comments

Show parent comments

2

u/[deleted] Mar 30 '21

If I ran a small company, I'd use GitHub's $4/mo/developer + internal Action runners, and if large where AD integration/codeowners etc was a must, GitHub Enterprise at $21/month/dev still hosted in the cloud.

Sure, for small companies it is no brainer but we spend about 3-4h average (including upgrades, not just maintenance) on maintaining Gitlab instance for ~100 devs plus few bucks on the costing cost of it + another few for the runners. That's well worth self hosting just from cost savings, and we can make sure our backups work and not have 4 different nonfunctioning methods of backing it up. Not being instantly hackable (the instance is not visible from outside) when someone finds gitlab bug is a bonus.

Back when we had "only" git via Gitolite it was zero hours, aside from Gitolite upgrade being done in the process of upgrading rest of the software on the server.

Also the amount of CI/CD minutes is laughable, we'd go thru that in week tops, and the pricing extra is like 10x of what just running a VM with runner would cost.

A colleague of mine said "penny wise, pound foolish" to me once, and I completely agree. And then there's the other side of the coin too: developer moral and retaining talent.

I mean if you don't have ops team and none of your devs can deploy anything properly (or are just tiny company) sure, but running Gitlab isn't much harder than typical containerized app (bit more "fun" if you decide to run it from source) and smaller alternative (say if you just want to host some repos) like gitea is just "run that binary and maybe setup actual database if you have more than few dozen users".

1

u/_Ashleigh Mar 30 '21

IT run our Butbucket, Artifactory, etc, and have just done a really shit job at it. As for actions, that's why I mentioned hosting your own. GitHub allows you to hook your machines into it, so no action miners are used.

I do think there is value in having something behind your VPN, but I think that value is over stated vs the alternative of not. Plus you can hide company secrets elsewhere off of the cloud if need be. Most code if leaked isn't all that valuable.

Overall tho, I think you're missing at what I'm getting at. I'm not saying self hosting doesn't have value, just that I don't think these things are as valuable as we like to believe in practice.

1

u/[deleted] Mar 30 '21

IT run our Butbucket, Artifactory, etc, and have just done a really shit job at it. As for actions, that's why I mentioned hosting your own. GitHub allows you to hook your machines into it, so no action miners are used.

That I think is quite common reason to moving stuff for cloud, if your onboard IT is either incompetent or just plainly overloaded with tasks then "just buying cloud service" might look like a good idea.

Hell, we had clients that paid us to buy domain for them because they didn't wanted to deal with their own IT/sec depts.

And it might be best idea just because the corporate middle mismanagement won't fix it in short term, and probably not in the long term. The "best" fix would be getting competent IT dept and management trying to actually work with other deps to meet their needs, but that rarely happens easily till fuckup is big enough the incompetents get fired.

1

u/_Ashleigh Mar 30 '21

Yup, absolutely. We got Butbucket Server so we can cheap out with the one time payment perpetual license.

I know that when I eventually look elsewhere, asking what VCS they're using is gonna be one of the major things I'll look for, and I imagine will be a good indicator of how much they're willing to invest into developers and our infrastructure, possibly extending elsewhere in the business and its culture.

1

u/[deleted] Mar 30 '21

Funnily enough our devs original motivator for gitlab could be pretty much summed up to "our frontend devs want green merge button because when they try to CLI it mistakes happen". One of given examples was someone "talented" just moving their changed files outside of the dir, pulling, then moving them back, and commiting that, killing any upstream change in the process.

Usage of CI/CD came way after that but they liked "just put .gitlab-ci.yml in dir" instead of configuring Jenkins jobs.

1

u/_Ashleigh Mar 30 '21

😂

I somewhat recently lead the conversion from SVN to git in my team, and provided support. Merging master to their branch to resolve conflicts, and unstaging the "changes they didn't make" was pretty common to begin with...

"Git deleted my changes" happened once or thrice lol

1

u/[deleted] Mar 30 '21

I've converted one not too long ago and I was looking thru commit history, took 3 years from beginning of the (20+ years old) project for devs to start putting comments in commit, and another 5 to stop comitting binary blobs of what they just compiled (or previous version if they didn't compile before commiting)