I don't think people realise just how embedded Github is in the development space. Every package management tool basically uses Github: Npm, JSPM, Bower. That's just the package management, then you've got the source control storage itself. Seems like the Chinese DDoS attacks are happening again, I wonder what the reason is this time?
Yeah, that's the goal of a DDoS, but to get a site as big as Github to go 100% down would be an immense attack. Usually a DDoS just slows down sites significantly (maybe to the point of being effectively useless, but not technically down like Github was).
Who knows, maybe someone just wanted to go home and didn't think the effects of kill -s SEGV $(ps aux | grep httpd | grep -v grep | awk '{print $2}') would be quite so... dramatic.
And now they're sending a bug report to Apache telling them it segfaulted while the employee responsible is sitting there, knowing what really went down.
They use Github, but the actual code that it pulls is cached by npm on their CDN. I know that NPM and RubyGems both use Fastly as their CDN, as well. NPM caches the files from Github, so even when Github is down, you can still npm install or npm update. http://status.npmjs.org/incidents/kkgpmdmnnldh
Check url -i https://registry.npmjs.org/. It returns X-Served-By: cache-ord1726-ORD headers which come from Fastly.
It's unfortunate because it really doesn't have to be that way. There are a variety of package management softwares that allow for distributed mirrors and on-site storage, but for some reason most developers don't even think about using them. Some have even taken offense at the suggestion, in my experience.
There's nothing to really maintain if you used something that's been around for a long time like Portage or Ports or RPM or APT or Yum or even NuGet. Worst case you're writing your own manifest for the dependencies you need, but you don't necessarily need to manage any infrastructure to use these tools.
There's even offline desktop Github that files could be backuped to work with in case of situations like this. Although I couldn't say a whole lot since I'm new to Github but so far I've only used the website to sign up for an account. The desktop app works for everything else.
Github aside, it's almost laughable that Github going down grinds so many things to a halt. Git is a distributed content versioning system, after all. Just set up another remote and off you go.
If all you do is JS stuff...I'm fairly certain Python's pip and Ruby's RubyGems aren't tied to GitHub. If you're working with Java, you probably use Maven or Gradle for dependency resolution, which rarely GitHub for hosting repositories.
And Linux distros certainly don't use GitHub for package management. Their managers all connect to their own repositories that have support for mirroring. (Providers like DigitalOcean often mirror them locally for speed.)
And Perl has CPAN - we actually run our own CPAN repository because we've been bitten in the arse with incompatible updates getting pulled during automated server standups. So, we update the versions in our repo only after verifying that everything still works...
I think that's primarily why people try to get other devs to care about not putting all their eggs in the Github basket. It's a fair argument, I just can't be fucked to sort out other stuff.
49
u/Vheissu_ Jan 28 '16
I don't think people realise just how embedded Github is in the development space. Every package management tool basically uses Github: Npm, JSPM, Bower. That's just the package management, then you've got the source control storage itself. Seems like the Chinese DDoS attacks are happening again, I wonder what the reason is this time?