[mholt]

Of course they're down while I'm trying to address a "High severity" security bug in Caddy but all I'm getting is a unicorn when loading the report.

(Actually there's 3 I'm currently working, but 2 are patched already, still closing the feedback loop though.)

I have a 2-hour window right now that is toddler free. I'm worried that the outage will delay the feedback loop with the reporter(s) into tomorrow and ultimately delay the patches.

I can't complain though -- GitHub sustains most of my livelihood so I can provide for my family through its Sponsors program, and I'm not a paying customer. (And yet, paying would not prevent the outage.) Overall I'm very grateful for GitHub.

[gostsamo]

have you considered moving or having at least an alternative? asking as someone using caddy for personal hosting who likes to have their website secure. :)

[mholt]

We can of course host our code elsewhere, the problem is the community is kind of locked-in. It would be very "expensive" to move, and would have to be very worthwhile. So far the math doesn't support that kind of change.

Usually an outage is not a big deal, I can still work locally. Today I just happen to be in a very GH-centric workflow with the security reports and such.

I'm curious how other maintainers maintain productivity during GH outages.

[Kenny_007]

For us the main shift was accepting that “being able to work locally” and “knowing whether users are affected” are two different problems.

Local dev usually survives outages just fine. What hurts is losing external signals and assuming things are okay when they’re not.

After a few incidents like this, we stopped relying on a single monitoring setup. One self-hosted probe plus at least one fully independent external check reduced blind spots a lot. It doesn’t prevent outages, but it avoids flying blind during them.

[gostsamo]

Yep, I get you about the community.

As an alternative, I thought mainly as a secondary repo and ci in case that Github stops being reliable, not only as the current instability, but as an overall provider. I'm from the EU and recently catch myself evaluating every US company I interact with and I'm starting to realize that mine might not be the only risk vector to consider. Wondering how other people think about it.

[Nextgrid]

> have you considered moving or having at least an alternative

Not who you're responding to, but my 2 cents: for a popular open-source project reliant on community contributions there is really no alternative. It's similar to social media - we all know it's trash and noxious, but if you're any kind of public figure you have to be there.

[jeltz]

Several quite big projects have moved to Codeberg. I have no idea how it has worked out for them.

[Zambyte]

Zig has been doing fine since switching to Codeberg

[Macha]

I would have said Codeberg’s reliability was a problem for them but… gestures vaguely at the submission

[mring33621]

LOL Codeberg's 'Explore' link is 503 for me!

[malfist]

N.I.N.A. (Nighttime Imaging 'N' Astronomy) is on bitbucket and it seems to be doing really well.

Edit: Nevermind, looks like they migrated to github since the last time I contributed

[gostsamo]

I get that, but if we all rely on the defaults, there couldn't be any alternatives.

[indigodaddy]

You are talking to the maintainer of caddy :)

Edit- oh you probably meant an alternative to GitHub perhaps..

[gostsamo]

no worries, misunderstandings happen.

[cced]

Which security bug(s) are you referring to?

[NewJazz]

Presumably bugs that may still be under embargo