Hacker News new | ask | show | jobs
by amelius 2769 days ago
Github is just the storage medium.

It's a bit like saying that the paper on which the law is printed may not be produced by a private company, which of course, doesn't make sense.
1 comments
seba_dos1 2769 days ago
Paper -> Git. I don't think anyone has any problem with using Git as a medium.

The only bookstore chain where you can find the trusted, canonical copy of the book -> GitHub.

The government should host the canonical copy itself. Then, and only then, it can be replicated to any other commercial service willing to host a mirror. Be it GitHub, BitBucket, GitLab, sr.ht or anything else. Git architecture is so well suited for it that it's particularly striking to not see it done there.

link
dgreisen 2769 days ago
Even if the canonical copy were hosted on the Council's website, you would still be trusting the hosting provider, the DNS system, and the certificate authority - all private entities.

What is needed is cryptographic authentication so that the git servers can be completely untrusted. This is also necessary to comply with the Uniform Electronic Legal Material Act (adopted by DC here: https://code.dccouncil.us/dc/council/code/titles/2/chapters/...). We will be rolling out such a system based on TUF in Q1 2019.

link
seba_dos1 2769 days ago
Although it's important matter, it's not only about the trust. I wonder what, for instance, GitLab could have done in order to get this kind of advertisement coming right from the Council.

Regardless, I would expect hosting, authoritative DNS and certificate to all be handled by the government itself. It's not a startup that's getting free vouchers for AWS to burn, public infrastructure should be either handled internally, or via some public auction on government's terms.

link
true_religion 2769 days ago
I do not know why it matters. Why bother adding expenseses to a government department when they can simply pay someone to do the work. Github is a private company. It is subject to the government, not the other way around...

It is really common for the government to outsource this kind of thing, and most times it results in users paying fees to the private company for access. With GitHub, no fees are necessary. So win win.

link