1 |
On 2021-04-11 08:26, Joonas Niilola wrote: |
2 |
> Can we still offer Github mirror as an alternative in the handbook? And |
3 |
> adding a disclaimer about everything you said above. Or at least provide |
4 |
> a link to wiki page how to switch into git-syncing, somewhere in the |
5 |
> "Finalizing" section or "Portage introduction" perhaps? |
6 |
|
7 |
No or only if we can do that by providing a Gentoo-controlled DNS name |
8 |
pointing to GitHub (or any other service not controlled by Gentoo) but I |
9 |
don't know if this is possible with git/Github at all. |
10 |
|
11 |
However, telling people in official documentation to use something we |
12 |
don't control will cause major problems in case we have to take actions. |
13 |
That you cannot think about any possible problem at the moment ('if |
14 |
Github decides to "go away" quite many distributions will be far more |
15 |
screwed') is a very weak argument from my POV. |
16 |
|
17 |
Imagine there will be another security incident and we will lose access |
18 |
to our GitHub mirror and we won't be able to sort the issue in a timely |
19 |
manner... |
20 |
|
21 |
We should be prepared. |
22 |
|
23 |
And I think we are only discussion about GitHub because some of us |
24 |
aren't always happy with the state/reliability of our infrastructure. |
25 |
But it doesn't help to ignore the root problem and move instead to third |
26 |
parties. If we want to be a real, serious, distribution with own social |
27 |
contract and not just a random project which will show up and disappear |
28 |
we should be able to run our own infrastructure in a way which makes us |
29 |
proud without the need to talk about any third party services. |
30 |
|
31 |
|
32 |
-- |
33 |
Regards, |
34 |
Thomas Deutschmann / Gentoo Linux Developer |
35 |
fpr: C4DD 695F A713 8F24 2AA1 5638 5849 7EE5 1D5D 74A5 |