What's Wrong with GitHub
51 points by tusharhero
51 points by tusharhero
The GNU project has published ethical repository criteria and evaluated common forges on them. The only forge (besides their own Savannah) that scores "good enough to recommend" on them is Sourcehut.
For anyone wondering Codeberg.org would score F, just like GitHub. One reason is that it requires JS, and while Codeberg's JS code is free software it isn't labeled in the GNU approved way.
I am disappointed that the GNU project tells everyone how wrong they are but seems unable to create new software that aligns with their values and vision.
Yeah, I somehow wound up on the mailing list for that project, and the discussions around Codeberg are just a dumpster fire. (And IIRC, the "improperly labeled" javascript isn't even used for a critical function!)
The funny thing about all of that is that Codeberg is probably even better aligned overall with GNU mission than sourcehut. Sourcehut allows private, non-free repositories, where Codeberg does not. The fact that they can't recommend codeberg.org because of these criteria is a sign (to me) that the criteria need to be fixed.
I don't recall whether there was more than just the javascript labeling, but if there was, it was similarly nitpicky. Things like wordsmithing just how they recommended a particular license, etc. I do believed someone suggested a perfectly reasonable way to address this in the recommendation (along the lines of saying to potential users "we know the javascript is free, so you can approve it in librejs") but no consensus could be developed.
It's sad to watch one project pick at another project that's so neatly aligned.
Forbidding users to use your software whichever way they see fit is not consistent with open-source software, according to freedom zero of Stallman's manifesto.
While your statement is correct, it's an absolute non-sequitur here. The ethical repository criteria don't discuss the software used to run a repository, but rather repository hosting services. And Stallman's organizations have aways restricted certain uses of their services.
A good example is Savannah; that is only for hosting Free software, just like Codeberg.
FWIW, all 3 of the services I've mentioned here (Savannah, Sourcehut, Codeberg.org) are run using Free software, which is self-hostable and carries no restrictions on what you can do with it as long as you comply with the terms of the copyleft license it's released under.
The criteria that ~pyfisch linked, which Stallman had a heavy hand in writing and editing, state explicitly that in order to receive an "A" grade, a service:
Does not permit nonfree licenses (or lack of license) for works for practical use. (A4)
I am not sure what you are alluding too. Codeberg is a platform and therefore can impose limits on what content they host (e.g. ban cryptocurrency and vibecoding content). Forgejo, the software used by Codeberg, is released as free software so users can use it however they want.
I went out of my way to properly label Anubis' JS in the GNU approved way and I still got accused of being malware by them, so there's no winning.
I am disappointed that the GNU project tells everyone how wrong they are but seems unable to create new software that aligns with their values and vision.
Huh? I thought Savannah was their aligned software?
As @yossarian noted my emphasis was on "new" software. Savannah is dated, doesn't have modern features projects expect and doesn't appear to be a forge developers want to use. (Even GNU projects like GUIX and GIMP use Codeberg and GNOME Gitlab instead.)
EDIT: Ideally there would be a "GNU forge software" that is so good it's actually used widely beyond GNU.
I wish they would run a forgejo instance for savannah.
They do use gitlab for CI though: https://emba.gnu.org/emacs/emacs/-/pipelines
I am disappointed that the GNU project tells everyone how wrong they are but seems unable to create new software that aligns with their values and vision.
both this and almost every piece they put out feels like someone is paid by the "gotcha", or by the snide sidebar. for some reason it's impossible for them to deliver a message without simply ridiculous asides that add nothing to the piece other than thinking "huh, that's childish". communicating like an adult is not proprietary, actually.
Per the "Extensive Use of Nonfree JavaScript" bit, avoiding "nonfree" software is getting more challenging in life beyond coding. It's getting harder to feel it's "wrong" when I see it in more places.
For example, my town is amazing and set up free, underground composting bins all over parks and neighborhoods and stuff. However, random people used them as trash cans if left unlocked. So they set up a program where you register with the town online and then can open the bins via bluetooth and smartphone app. But only a smartphone app. The only way to participate is to use a proprietary, nonfree app.
So when I read things like
users who refuse the JavaScript Trap find that any interaction beyond simply viewing repositories is impossible
in this article, I wonder what the general solution is. "Avoid Github" means not using it even though friends and colleagues are there. "Avoid $SMARTPHONE_APP" means not participating in my community's environmental efforts. Neither of these seem "right", even though free software seems "right".
Beating the drum of avoiding nonfree software seems like it's gotten less effective as software shows up more in real life. I would get more out of articles like this if they came with recommended alternatives. Not just "Use Source Hut or Codeberg" or whatever, but alternatives meaning how to participate differently within a societal mesh that otherwise doesn't think about software freedom when locking compost bins.
I think it's instructive in this case to imagine how much better your life would be if all of GitHub's client-side JS was unminified and GPL. The answer, of course, is "not at all". So, I wouldn't stress too much about the second-order effects of avoiding it on that basis alone.
probably "avoid" means to make a smart choice when you publish something by your own. consuming a repository or "pull requests" are not much of a choice.
sad that their list (linked in the piece) is so outdated. they do self-advertising (git, savannah), mention source hut, but don't list codeberg or heptapod. they say git but forget that mercurial, fossil and others exist too.
you still have a choice.
I really like this point, IMHO it show the difficulty of rejecting the bad status quo.
Life has become intertwined with technology and refusing to use it is arguably harder and harder each day. And when the power is in few hands, it multiplies the difficulty. Recent example was the EU App ID requiring Google Play Integrity, tho at leas the discussion seems to be going on.
While some arguments have merit, others are pedantic and plain silly; for example, the whole JavaScript argument. The internet and society need fewer people screaming from their increasingly less relevant soapboxes.
Also, in the very first sentence: "GitHub is not software at all." It's not? Isn't the AGPL entirely about software run as a service?
Sites with less reliance on JavaScript and absolutely less fragile and load quicker.
I'm not saying I agree with their "non free" blathering, but making your app/site work without JavaScript (and then using JavaScript to make enhancements) used to be a common mantra among web focused developers.
Javascripts sluggishness is more the case of Javascript having a long history of frameworks which are build on top of poorly designed dependency morasses. The dependency morass is the fragile element, not Javascript itself.
Writing non-framework Javascript is remarkably easy these days and quite efficient, even when you render a lot of stuff with Javascript.
I know it's hard to convince FSF to adjust their approach, but is it too much to ask for a clear date on posts like this? There's a RCS(!?) date at the very bottom of the page in smaller type, but an actual dateline at the top could help people understand the context.
Very funny to see a list of problems with github and copilot isn't even mentioned.
Edit: not sure what I was thinking with this.
fsf continues to fall from relevance. we’re beyond the point of OS’s and compilers, bazaars and cathedrals - we need a technomoral vision for the new world we find ourselves in, not yesteryear.
I wish I could delete my account. I need more projects to move (name Nix + Nixpkgs)… I’ve talked ad nauseam about all of these points but I still get slapped with “network effect” as if developers aren’t technical enough to move elsewhere. Realistically, it seems often the last bit is that their YAML-spaghetti CI is free as in beer.
Very interesting, I have personally started to dislike Github because of the decline in quality and the company associated with it (Microsoft).
Personally, I am kind of forced to use it as it has become ubiquitous when it comes to our industry. I have started using Codeberg for my own projects and have been doing great, especially ever since they started to allow private repositories.
Exactly this... I stupidly defended MS during the TS / LSP / VSCode / C# open source push.. but with github, its trending to embrace extend extinguish
I can't lie, TypeScript is GREAT. That has been a huge addition to the web development industry and has improved it by a substantial margin, but that's about it. I don't particularly like C# (I don't dislike it, haven't used it much, I saw that it was similar to Java, it's fine - I don't think we needed it). I don't particularly like VSCode (even though for many beginners but also advanced programmers it has become central in their workflow).
But TypeScript man, TypeScript is great.
As per usual, the GNU Project's obsession with pointing at Javascript winds up discrediting way too much of the actual criticism worth pointing to. It's a bit hard to take this obsession with how Javascript is bad and evil seriously, when literally every single modern web feature is Javascript, since we stopped trying to overload HTML with things.
It's just such an incoherent and backwards criticism to me, with no clear origin point besides "it's really easy to execute Javascript", which just reeks of GNU demanding a certain level of operational complexity to run software... which is a bit odd.
As for the other criticism, it's... just a mixed bag. The less picky ones are that the Choose a License stuff is meaningless minutiae, the Copilot criticism is on point.
The centralization argument is just... odd? There's still remarkably little within Github that creates platform lock-in besides the network effect. Achievements are a feature hardly exclusive to Github (my least favorite forum software, Discourse, notoriously also uses them; it's hard to consider this a criticism of Github when plenty of OSS software has similar things). The patch workflow Github uses is odd, but it's undeniably a lot more user friendly than patch submissions, in the sense they don't have to learn git's data model.
The criticism of actions is just bad. Preventing people from running insecure actions as a negative point is a real "we don't believe passwords should exist", which at one point was a real position held by the GNU if memory serves me right. Similarly, the reality of actions is that there's just very little incentive to write any Action that does anything more complicated than compile and push to some sort of artifact/container registry or runs a linter you can run on your own device. I dunno, I'd believe this was a bigger issue if porting to a different kind of runner wasn't at most a single afternoon of work/you can just run builds on your own system.
As for email addresses not being shown; I'd personally argue that requiring email in git is a problem in and of itself, and tellingly both GitHub and GitLab offer git mail masking services that let you hide your mail, while still attributing it to your account. It permanently nails an unnecessary piece of information most people would consider to be rather sensitive PII (even if email gets leaked all the time) as part of a workflow's history. Saying GitHub refuses to expose them easily is if anything more of a positive to GitHub. Ideally it'd be made optional within git itself, the only thing you really need is the name field so that attribution is taken care of.
both GitHub and GitLab offer git mail masking services that let you hide your mail, while still attributing it to your account
I don't know how well GitLab's works, but for GitHub the answer is that it just keeps your email off the most obvious places in the Web UI. If you can clone a repo, you can see the email address used for commits, naturally. And if you don't feel like cloning a repo, you can view a commit in the web UI and append .patch to the URL to see the raw patch file, which includes the email of the committer.
This doesn't strike me as a big deal, so I guess I'm not in the "email addresses are rather sensitive PII" camp. My larger gripe is that they go stale, and I'd prefer if git had UI to map old ones to new when looking at logs.
The masking service is actual masking, not web UI masking.
They allow you to generate a noreply email for your account, and you can configure git to use that email. As long as you do that, your email shouldn't end up in any git logs, while still being associated to the right account on the Github/Gitlab forge.
There's a reference to it here on Github's site, and the same documentation for gitlab.
As per usual, the GNU Project's obsession with pointing at Javascript winds up discrediting way too much of the actual criticism worth pointing to. It's a bit hard to take this obsession with how Javascript is bad and evil seriously, when literally every single modern web feature is Javascript, since we stopped trying to overload HTML with things.
Believe it or not. They are not arguing for JavaScript to be not used at all. They are asking against nonfree JavaScript, which is actually most of JavaScript that is sent to users computer. What they basically don't like here is that the users don't even realize that they are running random nonfree programs on their computers.
I thought recently HTML and CSS have getting nicer features which allow you to do a lot without JavaScript, maybe I am mistaken.