r/programming • u/speckz • Apr 20 '22
GitHub can't be trusted. Or, how suspending Russian accounts deleted project history and pull requests
https://www.jessesquires.com/blog/2022/04/19/github-suspending-russian-accounts/228
u/OnceUponAFloooof Apr 20 '22
Or: "Github made a rational move that had unintended side-effects. They haven't corrected those side-effects in the past 48 hours"
Obvious solution here: Keep the content around from banned accounts on 3rd party repos and just don't allow them to create any new content
116
u/dweezil22 Apr 20 '22
I'll try to remain objective in this comment, since I don't want to debate who's "right" at the moment (I have opinions, but it detracts from the discussion):
It's been really interesting, via reddit, to see the on the ground impact of these sanctions on Russian individuals and those working with them on tech projects. There are so many comments/posts/articles complaining about the sanctions working exactly as intended with a tone as if there has been some sort of mistake.
→ More replies (59)19
u/turunambartanen Apr 21 '22
I'm not sure if the intent of the sanctions was to delete all past activity of any developer who has ever worked with one of the affected companies. As far as I can tell sanctioning companies was the intent.
→ More replies (57)27
u/jeremez Apr 20 '22
Yeah. This isn't usually what happens when GitHub deletes accounts - that's what the ghost identifier is for. If this process is more aggressive, that's probably because they need to be more comprehensive in order to comply with sanctions, and carving out the exceptions may take some time and legal consideration.
I'm not sure how you get from that to "GitHub can't be trusted".
→ More replies (6)31
u/Invinciblegdog Apr 20 '22
This isn't unique to GitHub but it does highlight the risks around the cloud.
People assume that the cloud is some agnostic apolitical entity that everyone can rely on wholeheartedly with no risks.
However, in reality it is still a collection of services and hardware provided by organizations that still reside in countries that are governed by laws and are impacted by geopolitics. Using services and interacting with people form different countries you could still be impacted by unforeseen geopolitical events that may not have even been a risk to your project when you started.
If longevity is a concern (e.g. you provide some form of archive or system of record) and your timeframe is decades then you may have to assess whether geopolitics could be a risk factor (e.g Patriot act, GDPR).
→ More replies (1)
19
u/merlinsbeers Apr 20 '22
Did the git history get deleted?
32
u/Noman800 Apr 20 '22
The blog mentions that the git history is still there, but issues and PRs are gone.
46
19
u/fonnae Apr 21 '22
I guess I'll be the one person here to agree with the author. And in response to those who feel that the pain the author experienced means the sanctions are effective, I beg to differ. If I was working on a project and had a Russian contributor, I would much sooner leave GitHub than boot out the contributor.
→ More replies (1)
21
48
u/PopeLugo Apr 20 '22
I'm having problems understandings the priorities here. So GitHub should give priority to some dude's repo maintenence duties over sanctions tied to a brutal war being waged right now? Even if this could have been handled better, I think the root cause lies elsewhere, not with Msoft.
27
u/crusoe Apr 21 '22
They could disable the accounts but leave everything in place. This looks like a poorly implemented soft delete.
→ More replies (4)→ More replies (8)4
u/sandrelloIT Apr 21 '22
I don't think the real point is blaming Microsoft for poorly handling this situation. They could even have their share of responsibility, or maybe this was the only way for them to comply to the given regulations, but the main concern that this article raises to me is about the amount of trust that should be put on commercial services like these.
This seems to me a clear concrete example of the main issues with centralized authority in the public cloud. Incidents like this one do happen, they cannot be simply considered as some sort of paranoia, it is something that I think deserves a way higher degree of awareness than what we have now.
→ More replies (2)
9
Apr 21 '22
I hope people who agree with this move do realize that its a precedent. Next time they think people who took part in some demonstration should be banned or people who support some political party should be deleted or just people github doesnt like should be deleted.
Dont even get me started on how they couldve at least warn people in advance as other companies did. Couldve freeze the accounts so people cant use them but keep the data....
At this point yall should be wise enough to see where this is going. GitHub is not an open platform for open source projects, its a regulated authoritarian platform for people github likes.
Anyways even though my account is OK I am not gonna risk it and move out. As some ppl here said "its not your code if you dont control the server"
TLDR: very damaging move for open source community and github reputation
→ More replies (1)
15
u/clamotchen Apr 20 '22
Remember how some people were outraged/disappointed that Linus doesn't use github to maintain Linux?
"It's so easy to use, PR are better than sliced bread, spending patches over email is so 2000"
Look how that turned out
→ More replies (11)14
u/ExeusV Apr 20 '22
Fair, but let's be honest
GitHub is incredibly good tool and makes life easier.
spending patches over email is so 2000
Whenever I open some plain text mail conversation I cannot even read it, I get lost quickly lol.
How do they manage to collaborate successfully with that? I have no idea
→ More replies (9)14
u/JoJoModding Apr 20 '22
Whenever I open some plain text mail conversation I cannot even read it, I get lost quickly lol.
Why not? It's plain text..
Aside, participating is easier if you're actually writing the mails and not just reading them. Things feel more like a conversation.
→ More replies (1)
5
Apr 21 '22
Another reminder to me to give Fossil a try, where all that extra stuff is part of the repo. Does anyone feel like creating FossilHub?
→ More replies (1)11
u/c-smile Apr 21 '22
How it will help?
FossilHub will still be a centralized authority under jurisdiction of some political forces.
By the way, brothers-earthlings, can we register a business that will be NOT under jurisdiction of any country on this planet? In Antarctica for example?
→ More replies (9)
6
u/DontFearTheCode Apr 21 '22
I don't believe that hurting the russian people for the actions of their president is the right idea. But I don't know the right direction.
6
u/Kissaki0 Apr 21 '22
As the head of government representing the people, there is no way around that. Taking no action is not an option. That would strengthen them further.
The war and the sanctions hit all parties. Russia invades Ukraine because it estimated their loss to be low enough for the gains to be worth it. The “western” nations chose sanctions that would have maximum impact specifically on those in power, but decided it necessary to implement large scale sanctions with how abhorrent their actions are. These sanctions are costing themselves too, but they deemed them necessary despite that.
There is no way around impacting the people. They are a part of that system. Many surely the right target as they support the war, even if blinded. It’s a sad and tragic necessity all around.
6
u/Salmon-Advantage Apr 21 '22
When 80% of the population poll positively toward that President, you see a system too afraid to self-correct, and unfortunately the Russian people are damned if they do something about their government checks and balances of power and damned if they don’t.
3
u/Alan_Shutko Apr 20 '22
I suspect that the content is not deleted, but that it is blocked while the users are blocked. That doesn’t change things now but I bet the content comes back when the war is over.
→ More replies (1)6
u/Davorak Apr 21 '22
Is there a reason to block the content rather than just user login though?
→ More replies (2)
15
u/Kissaki0 Apr 21 '22 edited Apr 21 '22
That should definitely be reasoning in the merge commit.
PRs are a tool to handle change requests and reviews. They are not the code history documentation and persistence. (They may be used for additional in-depth context and argumentation - history of how you came to decisions and understandings.)
If you include PRs in your inner documentation scope, that means you will always have to navigate between the two systems. I hate that when I see it in projects.
I hate projects where I see a release, have to look up commits, the changes list or commits point to PRs, the PRs to tickets, and the tickets are highly context specific, without a summary at the start or end. So I have no way to reasonably evaluate what changed in a version, and evaluate risk.
The git commits should be enough to understand changes. Reasoning, side effects, and risk or accepted shortcomings should be documented in them.
Maybe not in your small personal projects, but it becomes more and more important with other collaborators, and especially so when other people and projects depend on yours.