[pixlmint]

GitHub centralizes 2 things: Authentication, as well as Repository Hosting.

Does the code really need to be hosted in a central location like this? (Clearly not, which is why people are leaving GitHub in the first place)

But the one part GitHub provides that's genuinely valuable is the social aspect, and when you get a PR from a user named torvalds you can trust that this is in fact Linus. This isn't the case with more distributed systems.

That's why I'd really like to see some entity handle just the auth/identity providing. Forgejo/ Gitea/ Gitlab instances can then choose to use that. Then, for example if you want to take on another contributor and they have their own forgejo instances, you can invite them through this provider, when they fork your repo it ends up in their own forgejo, and they can easily create PR's into your repo.

[Ritewut]

Tangled is working on something like that. I believe they are federating on the @protocol.

https://tangled.org/

[Zambyte]

I am very active on bsky and I also use some other ATProto applications like tangled. I think this is the first time I have seen anyone refer to ATProto with an '@'

[hooverd]

It's less used but the @ is the atproto logo. I default to saying aye-tee instead of at though. It just sounds better.

[mjw1007]

GitHub also centralises abuse detection. I'm not thinking about sophisticated attacks here so much as dealing with plain old spam. That's fairly easy to deal with on a tiny scale, and possible on a huge scale, but it's a great pain at a medium scale.

[account42]

Do they though? Slow PRs have been a consistent pain point for GitHub hosted projects lately.

[chris_money202]

I would argue GitHub does a lot more centralization than just those two. It's an entire developer platform centered around Git. It does hundreds of other things that some developers use, and some don't.

[SpaceNoodled]

GitHub really doesn't have hundreds of additional working features beyond git.

[chris_money202]

Collaboration, issue tracking, Actions (CI/CD), Codespaces, Security, AI, Identity, social, hosting. Those are like broad categories I can think of off top of my head too you could fit probably 10-15 "features" into each of those.

[IanCal]

Lots of those aren't centralisation/decentralisation issues though - codespaces, actions, issue tracking, multiple users, all that is repo/org level.

[chris_money202]

GitHub is centralizing all those features. If GitHub was just for repo hosting, then you would need to link your repo to another platform to do CI, another platform for issue tracking relative to the code, etc.

[IanCal]

They have those features but those aren’t decentralisation issues, as far as I’d understand the term, but those already can be done elsewhere right now. They’re purely tied to one repo really, it’s only the user accounts that I can see being more of a cross repo concern.

And global search but I don’t feel like that even really works.

[giancarlostoro]

> That's why I'd really like to see some entity handle just the auth/identity providing. Forgejo/ Gitea/ Gitlab instances can then choose to use that. Then, for example if you want to take on another contributor and they have their own forgejo instances, you can invite them through this provider, when they fork your repo it ends up in their own forgejo, and they can easily create PR's into your repo.

Agree, I feel like a true alternative should focus on this missing piece to bridge the gap.

[ndriscoll]

The "missing" piece is just everyone implementing OAuth Dynamic Client Registration. Then kernel.org could be its own OAuth provider, and Linus could log into someone's Forgejo with his kernel.org login.

Just like "log in with Google", you should be able to do "log in with OAuth", you type your email or domain (or your browser fills it), and it triggers a redirect flow for login. Then people can use GitHub or Google or Apple or their own provider, just like email. Every email provider could also be an OAuth provider.

[bombcar]

GitHub is to git like Reddit was to forums. Centralized usernames and such were very nice, but it also has downsides that we’re now living with.

GitHub is still really, really nice in that it’s five seconds to throw up a repo that’s accessible worldwide (98% of the time lol) and everyone’s on there. Whatever replaces it (just like whatever replaces twitter) may be better in many ways, but it will be “worse” in others, even if just in splintering.

[lorecore]

Signed commits could solve this in a more decentralized way if people post their public keys on their own domains.

[skydhash]

Own domains is the real deal. My preffered model is tarball releases with checksums, or better yet, with signatures (like remind[0] or msmtp[1]). Such pages are trivial to host properly and loads quickly.

[0]: https://dianne.skoll.ca/projects/remind/

[1]: https://marlam.de/msmtp/download/

[account42]

I was confused for a bit what those two projects have to do with signatures but I guess you are just using them as examples of having (PGP) signatures for downloads?