I do not understand why GitHub get attacked so often - honestly it's not like they are doing anything wrong, they are a fabulous service and the go-to place for most (if not all) developers for all sorts of projects, be it open source or in an enterprise/corporate context.
Just a PSA Git is distributed, fire up a quick instance with git daemon.<p>git daemon --verbose --export-all --base-path=.git --reuseaddr --strict-paths .git/
Can someone with experience mitigating an attack like this describe how it's done? A known set of hosts/address spaces is fine, but it's the "distributed" part I don't understand how to deal with.
This is getting really problematic. It stops our whole team every time.<p>Anybody has experience with Gitlab and Gitlab CI? How's the flow compared to Github, especially for pull requests, commenting and collaboration?
Why is this happening to them almost every day? Is someone jealous? Proving a point? If so, what point?<p>Surely by now, GitHub must know who's responsible and putting more in place to mitigate as much as possible before this happens. Right?
What a coincidence. We actually just finished migrating all our projects over to GitLab about an hour before this outage.<p>I still very much love GitHub, it just ended up not scaling for us (we have a lot of repositories that seldom needs to be touched, which results in a $20 / month Linode + Backup being a much better solution)<p>GitLab also allows us to group repositories and gives a little bit more flexibility in regards of git server-hooks. Also, server-side branch locking! (Does anybody know how to lock branches server-side with GitHub?)
Snarky comments about distributed version control aside, the bigger problem is the ecosystems which revolve around GitHub. Two which are immediately screwing my day up are Composer and Homebrew. Currently, both are totally dependent on GitHub.
You git what you pay for.<p>(Actually, there are long established yet less high profile alternatives with decent features and better pricing for commercial teams, like beanstalk or unfuddle or codebasehq. No hip cred, but for example supporting archived projects that you can read w/o using up your repo count license.)