Since yesterday a lot of users in Europe found their workflows failing due to Github seemingly randomly throwing HTTP/401 on git clone/git pull when interacting with public repos without authentication.
It was now confirmed by staff member that this indeed is intentional and no further steps are planned at this point.
This might be a problem for many projects. Rust, comes to mind, that pulls everything from Github and is 100% dependent on it. Same as Go. They pull everything from Github.
It might make sense for them to use something like radicle, a distributed git. Many people can easily pick what they want to distribute. Scripts can be written that make the local node only host the projects you depend on. That would naturally make popular projects more available.
I’m worried about nix, honestly. An absolute truckload of nix packages pull their source from GitHub. It’s the primary way to distribute flakes, too.
nixpkgs is literally a GitHub repo
Wait, doesn’t rust cargo pull from crates.io?
crates.io pulls everything from github.
No true at all.
The index used to be from github but now it pulls from a CDN by default and doesn’t do a full clone of the index. Crate downloads have always been pulled from a CDN.
The index was quite small in the beginning this is why it worked.
The service itself pulls from github to create the crates. Cargo pulls from crates.io, that is correct.
It seems that’s not the case. Crates.io only needs Github for logging in. Publishing a package uploads a .tar.gz to crates.io with the source code.
https://users.rust-lang.org/t/publishing-crates-without-github-and-some-criticism/134597/11
Who pulls from Github to create the crates? The crates are pushed by
cargo publishto crates.io’s API, not to github.crates.iodoes have an index in GitHub, but that’s legacy and pretty much unused for reads now. GitHub doesn’t store the crates themselves.yikes, what a terrible design lol. And here I thought cargo was actually pretty solid.
You can only publish packages via github, so it’s not a surprise, IMO. I don’t know why they did that in the first place instead of using email like every normal service.
Does all of that access really need to be anonymous access? I get that it’s convenient. But let’s be practical; they have to manage anonymous bot spam somehow.
Yeah I’m not managing several different accounts for each vm in qubes os.
The only real way to maintain any semblance of digital privacy is to build information silos.
That will always be more important than Microsoft’s hosting costs. (Though probably not to them.)