5/13/2026 at 1:10:58 PM
Everyone seems to be leaving GitHub, and forgetting the entire spirit of what git is in my eyes. Git was always meant to be decentralized, the problem here is that all the tooling around git was centralized to GitHub because it was a cleaner experience, they scaled nicely, and were properly maintained. I would prefer to still see mirrors on GitHub that are auto-synched because I've seen projects for years either self-host or go somewhere niche, then the GitHub mirror dies or is removed, and said projects go poof to the sands of time for one reason or another, completely gone. Everyone seems to be picking some random git host alternative, and some of them are really simple to use.Git is decentralized, GitHub is just another place you can host your code in, but you can push your code to multiple remote servers.
by giancarlostoro
5/13/2026 at 1:18:30 PM
While I'm not forgetting the spirit of what Git is, I'm also remembering how GitHub used "all open repositories" to train their first Copilot without telling anyone.So, no thanks. I'll not be committing any personal code there anymore.
And no, I don't care for the social aspects either. Discoverability, stars, and AI bot powered issue bombardment.
I'm fine like this.
Also, remember, "Open Source is not about You".
by bayindirh
5/13/2026 at 3:36:51 PM
I completely share your sentiment about feeling irked about open source code being used to train commercial AI models. However, I think the battle is already lost - the nature of copyright and open source code philosophy (currently) means that there isn't any real way of preventing your code being used to train AI. Look at the legal precedents being set in courts where many of the BigTechs have actually pirated copyrighted media to train their AI, and the court has said "that's acceptable". (Ofcourse, the actual act of piracy - like Facebook did by downloading copyrighted material through torrents - may not be legal, but the courts may be lenient here too as there seems to be an undercurrent of government approval to do anything to win the "AI Race").And, even if you move your repository somewhere else, can you really prevent anyone from uploading it to Github? To do so, you may have to create your open source license.
by thisislife2
5/13/2026 at 3:57:27 PM
> However, I think the battle is already lost - the nature of copyright and open source code philosophy (currently) means that there isn't any real way of preventing your code being used to train AI.Laws should make it a double-edged sword, make distillation explicitly legal.
Not much else they can do.
by lelanthran
5/13/2026 at 4:46:23 PM
> Laws should make it a double-edged sword, make distillation explicitly legal.Knowledge-distillation is already legal. Current case law says none of outputs of any model are protected by copyright, so one could use model outputs for whatever they want - including distillation. That is why AI companies resort to ToS clauses to block distillation and/or training competing models.
by overfeed
5/14/2026 at 8:20:53 PM
Its completely 100% legal, to ask LLM to write detailed spec of any closed source project based on the code. Then ask another LLM to implement it to make it public domain.Its already proven based on previous specification laws.
Hilarious as it sounds its true. We can make “any” code a public domain woth LLMs.
by pojzon
5/14/2026 at 12:40:29 PM
Make all LLM output licensed as AGPLv3 - the license is viral, right ? ;-)Unless you can actually prove what your model has ingested & if you have the license for it in court.
by m4rtink
5/14/2026 at 3:42:30 AM
Distillation is totally legal and I highly encourage itby bloppe
5/18/2026 at 8:57:57 AM
Even if you cannot do anything to prevent it you don't have to make it easy - and you can make it clear that you don't approve by boycotting GitHub over this.by account42
5/13/2026 at 3:05:36 PM
What exactly did they train? Copilot is powered by claude, gemini, or ChatGPT these days.Did they train autocomplete? I mean the code is open source so anyone can scrape it and train it too. I'm kind of glad they did train it because otherwise we'd still be stuck with Apple level AI models right now.
The whole reason we have so many models, including open weight models, that are all competitive with each other is because the data is free and anyone can be training off it. If the goal was to monetize the source code I guess the authors shouldn't make it open source.
by chrischen
5/13/2026 at 3:21:36 PM
> "GitHub Copilot is powered by generative AI models developed by GitHub, OpenAI, and Microsoft. It has been trained on natural language text and source code from publicly available sources, including code in public repositories on GitHub."https://azure.microsoft.com/en-us/products/github/copilot#fa...
by skinfaxi
5/13/2026 at 4:19:18 PM
Yeah have to agree here, Github Copilot itself doesn't have any first party models they use the frontiers. So, they didn't "train" using public repos but they probably allowed (or didn't prevent) the frontiers from pulling the repos along with the rest of the internet when creating their models.by chris_money202
5/13/2026 at 5:38:20 PM
Is y'alls collective memory so short? Copilot just a few years ago was auto complete on steroids that was entirely first party and trained by GH on users' code.by ramblurr
5/13/2026 at 7:15:50 PM
It used OpenAI's Codex model (see: https://en.wikipedia.org/wiki/GitHub_Copilot?wprov=sfla1)OpenAI did train the model on GitHub repos. The next question is whether this was enabled by Microsoft's investment in / partnership with OpenAI. I suspect yes, but I haven't gone searching for this yet.
by Leynos
5/15/2026 at 1:50:24 PM
I guess it doesn't matter if they allowed OpenAI to do it or not because it seems other models were allowed to train off it too. I guess we should probably be giving kudos to GitHub and Microsoft for not trying to charge for access to this data.by chrischen
5/13/2026 at 6:00:26 PM
It was even returning some code verbatim with the correct prompts.by bayindirh
5/13/2026 at 2:43:09 PM
It did so in direct violation of the licenses of the code held there as well and then sold code snippets they had no rights to and still do.by PaulKeeble
5/13/2026 at 5:32:17 PM
How did you draw those conclusions? They don't seem to be in line with court rulings (i.e. Anthropic), which hold that training is fair use. Code is being treated the same as any other copyrighted content that is used for training, from blog posts to PR announcements from companies and everything in between. Of course the blog posts are PR announcements have their copyright held by their authors, with no license provided at all, so if OSS code being used in training is a violation, then so would everything being trained on (to a first approximation...public domain works excepted). But no court has every taken that position to my knowledge.There's just so much confusion around this. In this thread alone:
* Distillation is legal under copyright; the violations would come as ToS violations, which is contract law, not copyright law.
* Training is legal as well, so long as the original material was obtained legally.
* Moving code off of GitHub doesn't change any of this: AI companies are free to download your git repo no matter where it is hosted, just like they can any other content on a publicly accessible website.
* Liability comes into the picture when the models are used to infringe copyright in their output. We'll have to see the outcome of the NYT case here, but that is proceeding at a glacial pace.
I am not a lawyer; I'm an interested amateur that's been following the saga for years. I wish the discussion here on HN were more nuanced.
If anyone has legal updates that render any of the above incorrect, I'd love a pointer to the decisions. One area I'm particularly weak is the legal status in countries that are not the US: I don't follow those laws nearly as carefully, nor the court cases brought.
by rpdillon
5/14/2026 at 12:42:59 AM
>> * Moving code off of GitHub doesn't change any of this: AI companies are free to download your git repo no matter where it is hosted, just like they can any other content on a publicly accessible website.C'mon, I'm not even apart of the movement to move away from GitHub, but that's not really a valid argument. Sure, they CAN download the source code, but its not nearly as automatic. They don't get to download it all, en masse, from copying hard drives/databases they already own. They have to go over the internet. They don't get automatic notifications when new code gets pushed. And finally, if one wanted, they can make it harder for bots.
I certainly believe that these companies do get away with a lot more than the average Joe - see: Facebook downloading Anna's Archive, every pirated eBook - but that doesn't mean you have to hand it to them on a silver platter.
Plus, even if your code is private on GitHub, you can guarantee that they can't train there models on it anyway; unlike if you host it yourself, or somewhere else.
Does anyone else find it ironic when closed-source GitHub claims it's some super hero for open source?
by mkhalil
5/13/2026 at 5:55:06 PM
I have written about this numerous times, so I won't repeat myself with the long form writing. Maybe I need to keep a list of comments somewhere, so I can reference them. I digress...In short:
- GPL code requires attribution and sharing of code. Models strip license, so GPL is effectively violated.
- Source available licenses are "for your eyes" only, so training on source available code is also violates said code's licenses.
- MIT requires attribution, but forgetting it has no consequences, so it's a more gray area.
About moving from GitHub:
- Some public repositories provide visible and invisible anti-scraping protections. So it's not always that easy.
- GPL says I need to share code to the people who downloads the application itself, so I can move to cathedral model.
Moreover:
- US Government has a stance of "If we need to take permission for everything, AI industry will die". Hence, as an outsider, the court rulings have no weight in my eyes. They are taking stance to enable and not hinder the industry. If one reads Fair Use doctrine, it's very possible to rule otherwise. OpenAI's whole non-profit research arm was an instrument to circumvent Fair Use doctrine's "earn money from copyrighted works" clause and support "we only do research pinky promise" requirement of the said doctrine.
When courts said "go ahead, we're not looking", people started to torrent e-books (ahem Meta ahem) to train models or buy/cut/scan/ocr books to train their models (Anthropic).
So the situation is left murky to allow Silicon Valley to thrive. Not to protect people's blood, sweat and tears. These works are provided by peasants anyway, so why bother.
Addenda: Courts said models' outputs can't be copyrighted. So, copyrighted code gets in, non-copyrightable code gets out. It's effectively license-washing.
by bayindirh
5/13/2026 at 7:48:07 PM
I don't think your understanding of Fair Use matches mine, but it is important, since it invalidates the concern about licensing.I wrote a nearby comment giving some resources on the current state of Fair Use for training, but in short: it depends.
https://news.ycombinator.com/item?id=48125071
> Hence, as an outsider, the court rulings have no weight in my eyes.
My only focus in on legality, so this doesn't track for me. If we're not talking about what courts are ruling, then there's nothing to talk about legally, since the copyright office is waiting on courts to rule here.
by rpdillon
5/14/2026 at 1:57:01 AM
The GitHub terms of service has always granted GitHub additional rights. If you put up code with a license incompatible with those rights, then you are the responsible party for the violation, again as per GitHub's terms of service.This was true before AI, and the ToS now explicitly includes AI training to avoid confusion.
In short: it has never been a good idea to put anything with a copy left or strong license up on GitHub if you wanted them to abide by it.
by zdragnar
5/18/2026 at 9:11:03 AM
> If you put up code with a license incompatible with those rights, then you are the responsible party for the violation, again as per GitHub's terms of service.This is not how copyright law works or any other law for that matter. The issue is foremost between the copyright author and GitHub. The ToS may or may not allow GitHub to sue the uploader for damages for a ToS does not magically give them rights that the uploader isn't legally able to give.
by account42
5/14/2026 at 12:44:03 PM
IP law is a farce, and the open source licenses are built upon that farce. If a single good thing comes out of LLMs, it will be forcing society to recognize “intellectual property” for the dystopic stupidity that it is. I doubt it though.by NeutralCrane
5/18/2026 at 9:12:48 AM
That is a pipe dream. The current direction is the opposite of that - knowledge becomes even more centralized and only rented out to individuals.by account42
5/18/2026 at 3:00:47 PM
Knowledge being rented out to individuals is the status quo. Already there are court rulings dictating that “training” on data is legal, but model weights also are non-copyrightable, which seems like a step in the direction of sanity.by NeutralCrane
5/13/2026 at 3:45:01 PM
> (...) I'm also remembering how GitHub used "all open repositories" to train their first Copilot without telling anyone.This is a silly opinion to hold, isn't it? I mean, you release projects under a license with the express purpose of freely distributing your code among anyone in the world that may have any interest whatsoever, and even allow they themselves to share it with anyone they feel fit. But you are somehow outraged if people actually use said code?
Please make it make sense.
by locknitpicker
5/13/2026 at 4:04:34 PM
> This is a silly opinion to hold, isn't it? I mean, you release projects under a license with the express purpose of freely distributing your code among anyone in the world that may have any interest whatsoever, and even allow they themselves to share it with anyone they feel fit. But you are somehow outraged if people actually use said code?You're making things up: the outrage is not that people used it, it's that the licence requires attribution at least, and opening the derivative product at worst. Token providers that trained on open source did neither.
> Please make it make sense.
I am skeptical that you didn't know the reason for the outrage because it's been repeated in every single thread where this was discussed.
I myself repeated it multiple times each time this feigned confusion you display appears.
Like I am doing now, yet again.
by lelanthran
5/13/2026 at 8:28:36 PM
idk, all the code i've seen produced by an llm doesn't appear to be derived from anything. Also, the source code they were trained on does not exist in the model, it's impossible for the llm to return a code snippet from some other code base. The code snippet doesn't exist in the model in the first place. I guess another way to put it is show your code in the output of an llm that isn't being attributed correctly.by chasd00
5/13/2026 at 9:09:17 PM
At least on GitHub there was a special flag to exclude code that matches publicly available source code. Thus the chance is higher than 0. Which matches my experience last year when multiple Copilot chats got redacted for that reason.by mhitza
5/14/2026 at 4:19:00 PM
> Also, the source code they were trained on does not exist in the model, it's impossible for the llm to return a code snippet from some other code base.So? Just because a piece of output data is encrypted or compressed and does not resemble the input, does not mean that the process did not take the input.
We have decades of law that regards zipped files as infringment, lossy compression (MP3's) as infringment, etc.
> guess another way to put it is show your code in the output of an llm that isn't being attributed correctly.
Well, a better way of putting it is answering the question "Will that model have existed had none of the code used as input existed".
IOW, can that model be generated or created without first having all that copyrighted code used as input?
by lelanthran
5/13/2026 at 3:48:16 PM
Because there's no way the code is distributed properly according to any of the OSS licenses. In fact, it claims authorship with nonsense bylines saying the LLM wrote it.by dylan604
5/13/2026 at 5:45:18 PM
They key issue is whether the training is considered to be fair use; but this can only be determined in court. We have some preliminary indications that it definitely can be, but also may not be, depending on four factors, but predominantly the first and fourth factor (how transformative, how it affects the market for the original works).National Law Review covered some of those nuances last year: https://natlawreview.com/article/federal-courts-issue-first-...
US Copyright Office has a substantial document discussing each of the four factors, and making it clear this is an unanswered question, and details of the particular case will decide which way courts go. It is a prepublication version, and it's over 100 pages, but it covers the issues well, citing arguments on all sides.
https://www.copyright.gov/ai/Copyright-and-Artificial-Intell...
by rpdillon
5/18/2026 at 9:21:44 AM
No, the key issue is whether the training is socially acceptable and sustainable. Court decisions based on pre-existing laws are only a small part of that discussion.by account42
5/13/2026 at 3:52:01 PM
> Because there's no way the code is distributed properly according to any of the OSS licenses.What are you talking about? There is no distribution, only read access.
by locknitpicker
5/14/2026 at 12:48:15 AM
Reading means downloading. Downloading is equivalent to making a copy. To make a copy of a copyrighted work, you need a license, unless your activity is fair use. Licenses have terms and conditions that must be followed, such as retaining attribution in all derivative works.That said, FOSS licenses are non-exclusive. Regarding the original upthread topic of GitHub's copilot training, iirc GitHub's terms and conditions involve granting them a license in order to host your code. Depending what else is in those terms, they may have had the ability to use all hosted code for LLM training through that license, instead of the FOSS licensing on any given Open Source repo. But that would only apply to GitHub/Microsoft, not third party scrapers.
by evanelias
5/13/2026 at 7:08:12 PM
What is the difference?by CyberDildonics
5/13/2026 at 4:20:24 PM
The training on "all open repositories" is the only training we heard about. I wouldn't be surprised if it wasn't beneath these greedy companies to train on other data, and respond "oops! we didn't that would happen" (by which they mean get found out).Leaving is still the right move. But this applies to all centralized large services: Our use of Google and Google Drive, any Microsoft products, Adobe products, etc.
by mannanj
5/13/2026 at 2:22:16 PM
Don't forget a achievement badges.by dandellion
5/13/2026 at 2:46:14 PM
I mean, I never put my code on GitHub, but other people put it there, as they use GitHub: you can't not use GitHub. (Hell: even closed source projects, even ones that were never distributed even as a binary, if the code leaks, end up mirrored on GitHub.)by saurik
5/13/2026 at 9:40:07 PM
> While I'm not forgetting the spirit of what Git is, I'm also remembering how GitHub used "all open repositories" to train their first Copilot without telling anyone.As long as your code is out in the open anywhere the slop factories can train their models at it, regardless of whether it's on GitHub or your private server. So you might as well keep using GitHub at least as a gratis mirror. My reasoning is that if I'm going to be milked anyway I might as well freeload off GitHub.
by HiPhish
5/18/2026 at 9:33:31 AM
Just because they technically can grab it doesn't mean you have to make it easy.by account42
5/13/2026 at 5:03:45 PM
Agreedby onesandofgrain
5/13/2026 at 1:14:24 PM
Yes, but GitHub is more than just git. The most important aspect of the platform that everybody seems to forget is the social component and how easy it made to create a persistent, off-site repository and collaborate across repos.by gchamonlive
5/13/2026 at 1:21:20 PM
The "social component" is a big problem in actual FOSS.by MrFurious
5/13/2026 at 1:31:32 PM
People forget what FOSS is, and you get a world of unclear expectations. FOSS is code + a copyright license. How the code is created is an entirely different matter, and where FOSS projects often fall short. As FOSS projects come Forgejo is well-organized around a community governance model.by rapnie
5/13/2026 at 2:49:09 PM
Indeed, the fact that maintainers didn't have until only recently the control for disabling Pull Requests tab in a GitHub repo, is what drove a lot of issues in FOSS collaboration over the past decade.FOSS and open source licenses never ever granted entitlement for contributors to have their proposals reviewed/merged by maintainers. Neither it ever offered entitlement for users to ask for free support.
FOSS is about giving people access to source code so they can do with it whatever they want, and maintainers/authors should have always had the ability to "publish and forget" the source code, without having to deal with those "entitlements".
by brunoborges
5/13/2026 at 3:50:24 PM
> The "social component" is a big problem in actual FOSS.You're confusing things. The "social component" refers to people interacting with each other. Such as two developers working on a bug or a feature. Or a tester reporting a bug.
This is a big part of actual professional software development work.
by locknitpicker
5/15/2026 at 2:23:01 AM
To be generous to OP, none of this is intrinsic to FOSS.I write a library. I put it up online, for other people to use, if they like. At what point did I assume any responsibility to play nice with others? Or work with others at all?
There's FOSS licenses, and then there's the social expectations around collaborative online development, and the latter is nowhere implied in the former.
FOSS was not historically weighed down with all these social expectations. Forking was not seen as some community failure, but the basic purpose of FOSS. Sites like GitHub were a major part of this shift.
by troad
5/18/2026 at 9:36:44 AM
Spot on. And with the slop pull request currently plaguing the open collaboration model I foresee more projects moving (back) to the take-it-or-leave-it model.by account42
5/29/2026 at 6:09:45 PM
Late to the party, but you can also do KYC on contributors, no need for black and white take it or leave it return to the dark ages.by gchamonlive
5/13/2026 at 6:34:00 PM
What do you mean? Why is the social component a problem in FOSS?by nozzlegear
5/13/2026 at 7:57:03 PM
I assume they are referring to the large number of open source users and developers that are particularly bad at people skills and acting calm and rational.Or maybe they mean there aren't good collaboration platforms in general, not sure.
by majorchord
5/13/2026 at 3:59:37 PM
Yes, what's one more reason to abandon the largest platform.by marcosdumay
5/13/2026 at 3:23:29 PM
IDK, it's hard to criticize the community too much given how wildly, absurdly successful it is. If I arrived on Earth yesterday and you tried to tell me how much software is Free/free in an otherwise-capitalist economy, I wouldn't believe you!I really really am not trying to start a political argument, but just as food for thought: this is exactly why I have faith in socialism (read: 'prosocial institutions and norms'). And whether socialism is eu- or dys-topian, it certainly cannot happen in the first place without a "social component"!
by bbor
5/13/2026 at 4:58:56 PM
What on earth is the social component of GitHub? I assume I’m missing what’s useful to people here as it keeps getting brought up, but what is it? Is it the stars on a repo? Are people doing something else big with all of this?by IanCal
5/13/2026 at 5:11:14 PM
https://news.ycombinator.com/item?id=48123524by gchamonlive
5/13/2026 at 7:09:38 PM
The vast majority of that doesn’t require anything like GitHub though, that’s just having multiple users.At a push you could have the same thing massively more spread out using GitHub purely as auth.
by IanCal
5/13/2026 at 10:36:17 PM
https://news.ycombinator.com/item?id=9224by gchamonlive
5/14/2026 at 5:59:53 AM
Totally different thing, and if you don’t want to engage don’t, this is simply rude.by IanCal
5/14/2026 at 10:38:21 AM
> this is simply rudeLook, you are the one that opened with "What on earth is the social component of GitHub?". What's the semantic function of that specific construction if not being completely ironic, like you decided I was wrong before engaging?
> if you don’t want to engage don’t
I am engaging, you just don't like that I'm not spelling it out. This is perfectly within the community guidelines.
> Totally different thing
It's just the same thing, you both are ignoring how important convenience is.
by gchamonlive
5/14/2026 at 11:23:30 AM
I'm not sure how to make it clearer. I do not understand what the "social" component of github is that people are using so heavily that it's a big thing to break from and requires huge centralisation, that it is the "most important aspect of the platform". I said that I assume I am missing something because I don't see much that really ties all these things together, and nothing like the network effects of, say, X or facebook.All you've pointed to is devs working together and people filing bugs. All that requires is auth, no? Is that it? Is an SSO button really this enormous hurdle?
> It's just the same thing,
Saying dropbox is irrelevant because all end users could just "build such a system yourself quite trivially by getting an FTP account, mounting it locally with curlftpfs, and then using SVN or CVS on the mounted filesystem." is not the same as saying "what is the social aspect of github?".
Closer is what I've argued elsewhere, which is that multiple different hosts running (something like) gitea selling cloud based storage as a service would be extremely close to github for end users. And it would be identical for what you've talked about wouldn't it?
> you both are ignoring how important convenience is.
The convenience of what, specifically? Not having to click an SSO button on a new website?
by IanCal
5/14/2026 at 11:43:33 AM
> All you've pointed to is devs working together and people filing bugs. All that requires is auth, no?Collaboration is a form of socialization. GitHub made a social network on top of a SVN to create a forge that people can interact with each other creating issues, pull requests, reviewing and commenting on them, engaging in discussions, forking and improving upon each others works... These are not "just auth" and it's not something git solves by itself. I really don't know how to make this clearer either, sorry. Maybe it's this is the kind of thing that you see it and you get it or you don't, I don't know. For me and apparently for lots of people in this thread that makes sense.
by gchamonlive
5/14/2026 at 5:14:29 PM
I know git doesn't do this by itself, but then we're not talking about github vs raw git - perhaps that's where you're confused by what I'm saying.All these other services have what you're talking about, and the only cross-repo/org work I can see here is:
* Aligned accounts (person X on one service is person Y on github), if you want that continuity across services
* Forking
And the whole forking/branching/merging side is handled by raw git.
That's why I've been asking what githubs huge centralisation gets us. It has a UI and features that are useful, great, those exist in other projects too, so what is the stickiness?
by IanCal
5/14/2026 at 5:29:55 PM
Either you understand or you don't understand the value of UAC in social networks, I can't explain it anymore than I had. Sorry.by gchamonlive
5/15/2026 at 12:06:13 PM
That’s literally the thing I called out as being cross repo, auth.by IanCal
5/15/2026 at 4:58:43 PM
Auth isn't UGC. And it's not enough to have a GitHub clone, you need people there doing work, therefore the value of the social component.Edit: I've written UAC in both my posts by accident, but I actually meant UGC: User generated content.
by gchamonlive
5/16/2026 at 6:42:23 AM
Good lord. Yes, people adding the content is important. What is the social component bringing people there? I’m repeatedly asking and you’re never covering this. Please try and actually read what I’m saying and engage with that because at no point are you covering the question I’m asking. I am not asking why people use GitHub. I am asking why there needs to be a single central place everyone goes, like social networks, because the vast majority of interaction is so focused within projects that if they were all isolated and you had one sso provider I’m not sure what you’d lose (and this is the extreme case).I find repos because of search engines, links from project pages, links from package managers, hn, all external sources. If it’s from linked issues that’s user generated and can easily link off site (and often do).
Are you following users and finding repos like that by seeing that they commit to? Having GitHub recommend repos?
by IanCal
5/16/2026 at 2:33:22 PM
Why so impatient? Do you think opening up with "good lord" will make people more interested in helping you?> What is the social component bringing people there?
We've answered that again and again, pull requests, discussions, comments, following people. These bring people value. There isn't much more to it. And these aren't "just auth over cross repos". You reached the ocean here and you are still thinking it's just water, expecting it to be something greater. This is just it. That's the social component and the value it brings to the community.
by gchamonlive
5/13/2026 at 6:47:31 PM
Before everyone started plopping their one-off AI bullshit[†] onto Github 40 times per day, I used to love going to Github's homepage feed to see what people I follow were interacting with on Github (contributing to, forking, opening issues on, and yes, starring). It was a great way to discover new projects and tech that I might want to use. I'd found many open source dotnet packages that way, which made their way into my projects' dependencies. I've sponsored some and contributed to others as well, all thanks to Github's discovery.[†] I occasionally have AI write one-off bullshit too, so I'm not casting stones. It's just overwhelmed the discovery signal with noise.
by nozzlegear
5/13/2026 at 11:15:27 PM
Issue tracker, code reviewsby nijave
5/14/2026 at 5:57:19 AM
Is that what people mean? Just the multi user side of it?by IanCal
5/15/2026 at 2:34:25 AM
Issue trackers and discussions on FOSS projects are effectively a public forum, and on any public forum people start building brands and identities. Add comment reactions and GitHub stars into the mix and you have a vicarious karma system whereby people's projects jostle in popularity and people try to build reputations. For some people, GitHub is more of a social network than a VCS tool.GitHub is also somewhat entangled with junior hiring in compsci, meaning there's a tangible economic incentive in building a hireable profile that a recruiter might like. (Or at least that is a widespread belief.)
None of this has much to do with git, the VCS tool, nor is GH-as-a-social-network objectively very important, but it's natural to place outsized importance on a community in which one is active, and there's a significant overlap in the HN commentariat and GH users. So you'll probably hear more about the claimed social utility of GH here than in the real world.
Hope this helps clarify what people are talking about. :)
by troad
5/13/2026 at 1:14:01 PM
Forgejo is doing a lot of work to make the tooling decentralized, too. They are using open protocols and standards to link self hosted forges together.by limagnolia
5/14/2026 at 2:21:37 AM
Plus as TFA notes, they went full copyleft:> As of v9.0 in August 2024 the project relicensed from MIT to GPLv3+, with the explicit goal of staying copyleft and resisting future commercial capture of the codebase.
The value of copyleft for decentralization is too often overlooked.
by spopejoy
5/13/2026 at 1:49:38 PM
I can’t wait for federation in Forgejo. With that, there’s honestly no reason not to host your own forge.by hperrin
5/13/2026 at 2:18:49 PM
The reason will be that not everyone wants to deal wit maintaining a self-hosted box.by Ritewut
5/13/2026 at 2:54:25 PM
my eyes have been glazing over it feels like our infra/devops dudes have proverbially given up and they're just looking to buy cloud services to do everything now. security guy looks like he wants to jump off a bridge and i keep trying to nudge them into waking up to not needing 99.9% uptime we'll settle with 95% uptime and no one needs to be on call, and you can go to sleep at night knowing all the code lives behind your damn fort knox firewall company intranet and 75 layers of authentication.it's interesting because the more paid services these guys bring on board the more complex the security shit gets for them. the head of our IT is a fucking lunatic though and he is steering shit towards utter disaster, he's obsessed with being the guy who picks the next cloud service that "makes things so much better".
my small team is actually considering just getting some mac minis and making a cluster of servers. we decided we don't need infinite uptime for hosting m-f office tools and we can just ... not interface with our infra/devops guys who have lost their damn minds and say no to everything now. they're supposed to be the compute tower under the tragedy known as TBM and they haven't approved a single VM in like 2 years.
by trueno
5/13/2026 at 5:23:12 PM
It's about offloading blame. If a server nukes, it's on infra to get a guy to unscrew it. If a service nukes, infra guy says "welp it's down", keeps on clicking.It doesn't matter what happens 6m-2y down the road, your odds of being laid off or job hopping are high in the current regime so this all makes sense. You pay some amount of your budget to make your life "easier" in the now.
The trouble comes 2-5y down the line when the service is bought out by <insert MEGACORP here>, and you have to scramble to replace it or hold your nose and pay up.
(tbh, migration is not that hard, but the org will act like it is)
The matrix of authentications, compliances, and intranets will only go up as your company grows and often are enforced by people who do not suffer them daily.
by anarticle
5/18/2026 at 9:42:03 AM
> tbh, migration is not that hard, but the org will act like it isIt actually would be hard to impossible if done properly - meaning no lost information and no dead links.
by account42
5/18/2026 at 2:22:28 PM
Not your problem under the hot potato model. It's not impossible and here's the other thing: it often doesn't matter if things get broken to your megacorp as long as you keep up appearances with clients.Sorry if this sounds really grim / cynical, I've simply seen enough of these kinds of migrations to know that it is fundamentally opposite of my perception of engineering philosophy. It often becomes more of a question of business rather than correctness. (Can we simply fire the smaller customers? -> yes.)
by anarticle
5/13/2026 at 4:08:26 PM
What would you use a cluster of mac minis for?I mean, if you're going that far, a couple of refurbished servers gives you far more compute and far more capacity and much better maintainability.
by lelanthran
5/13/2026 at 2:59:17 PM
it's just a few clicks, starting at 2 bucks a month.by hirako2000
5/13/2026 at 4:21:49 PM
I would love to see it happen, but an internal service vs something exposed to the internet can be challenging.I think services like Cloudflare could play a role if they were able to provide some kind of forward auth and preferential treatment of core users during overload. My self hosted systems would have to be the source of truth and Cloudflare would have to be replaceable for me to consider using it.
Think along the lines of automated pre-auth that coordinates with the origin based on some standard.
by donmcronald
5/13/2026 at 7:59:00 PM
There is already federation support in radicle and vervis.by ranger_danger
5/13/2026 at 6:06:43 PM
Not everybody uses git because they're infatuated with "the spirit of git". Only a tiny minority have ever even used it with the patches-by-email model it's intended for, and I would guess the vast majority of the rest have no interest in learning. People use git basically because it's what github uses, or slightly more generously because it works well when paired with a centralized host like github. The model of developing code locally and dicussion issues and patches via a web portal is the model people are taken with. Only a small portion of that is provided by git proper.by f33d5173
5/14/2026 at 6:02:13 AM
Although that only requires a centralised host per repo.by IanCal
5/13/2026 at 4:21:32 PM
Something nobody's really calling out: Forgejo is genuinely hackable. I just added a "showcase" mode to my instance: private repos can show their README and root file listing publicly (so I can advertise that a project exists and what it does), but viewing actual code, cloning, issues, PRs are all locked behind group membership.About an hour of work, small and frankly trivial diff: https://peoplesgrocers.com/code/forks/forgejo/pulls/1
I didn't have to fight the architecture at all, the seams were right where I needed them. Added migration adding a boolean column to the repo config table, a few tweaks in permission middleware, and voila, it just worked. Really excellent decoupling in the Forgejo codebase [1]
You can't do anything like this with GitHub. That's the actual freedom! Separate from the where-do-I-host-my-git question. There is a big difference between software that "sure technically I can change it since I have access to the source" vs software that's been constructed specifically to be customized and changed.
[1] Permission checks live in obvious places, the template system let me modify UI without touching unrelated code. Someone (many someones) clearly cared a lot about keeping this codebase modifiable by outsiders, and it shows. That's hard to do and should be more celebrated.
by marxism
5/13/2026 at 1:55:17 PM
I agree with this. Moving the git repo is easy, moving the whole project surface is the hard part.Issues, releases, CI, docs, security advisories, search and discoverability all tend to get coupled to GitHub over time.
For open-source projects, I like the idea of self-hosted as the source of truth, but still keeping a read-only GitHub mirror so people can actually find it.
by perkovsky
5/13/2026 at 3:26:42 PM
The ideal situation is to eliminate thinking that the thought process for "actually finding" a project == GitHub.We let Microsoft parasitize our brains with this. The software community has long had alternate forums. GitHub isn't even a particularly good one, and it's recently just become a swamp of generated content, fake stars, and mining your content.
In the last couple months at least once a week I get some LLM generated phishing spam from some bot that "found your projects on GitHub and want to collaborate" etc.
And it's well documented now how you can just go out and "buy" GitHub stars.
Please. Cut the umbilical.
by cmrdporcupine
5/13/2026 at 1:59:26 PM
...Maybe that's the answer, we need a "hub" for the smaller missing things to start, you pop in your git repository when you join, and it can sit as a thin layer over your repo with issues, releases, etc... Sounds like a lot of work, but doing it piecemeal would do it.I think trying to re-host git itself might be more trouble than its worth. My kingdom for someone to build this so I don't have to use ADO boards anymore.
by giancarlostoro
5/13/2026 at 2:54:24 PM
Like some kind of UI over a database scraped by code which understands Github, Forgejo, Gitlab, sr.ht, etc?One issue is that issues tend to be monotonically increasing numbers, and references to old issues vs. new issues get confusing over time.
by radlad
5/13/2026 at 1:58:21 PM
GitHub centralizes 2 things: Authentication, as well as Repository Hosting.Does the code really need to be hosted in a central location like this? (Clearly not, which is why people are leaving GitHub in the first place)
But the one part GitHub provides that's genuinely valuable is the social aspect, and when you get a PR from a user named torvalds you can trust that this is in fact Linus. This isn't the case with more distributed systems.
That's why I'd really like to see some entity handle just the auth/identity providing. Forgejo/ Gitea/ Gitlab instances can then choose to use that. Then, for example if you want to take on another contributor and they have their own forgejo instances, you can invite them through this provider, when they fork your repo it ends up in their own forgejo, and they can easily create PR's into your repo.
by pixlmint
5/13/2026 at 2:20:19 PM
Tangled is working on something like that. I believe they are federating on the @protocol.by Ritewut
5/13/2026 at 3:04:31 PM
I am very active on bsky and I also use some other ATProto applications like tangled. I think this is the first time I have seen anyone refer to ATProto with an '@'by Zambyte
5/13/2026 at 4:30:22 PM
It's less used but the @ is the atproto logo. I default to saying aye-tee instead of at though. It just sounds better.by hooverd
5/13/2026 at 2:39:18 PM
GitHub also centralises abuse detection. I'm not thinking about sophisticated attacks here so much as dealing with plain old spam. That's fairly easy to deal with on a tiny scale, and possible on a huge scale, but it's a great pain at a medium scale.by mjw1007
5/18/2026 at 9:46:51 AM
Do they though? Slow PRs have been a consistent pain point for GitHub hosted projects lately.by account42
5/13/2026 at 4:23:16 PM
I would argue GitHub does a lot more centralization than just those two. It's an entire developer platform centered around Git. It does hundreds of other things that some developers use, and some don't.by chris_money202
5/13/2026 at 5:09:22 PM
GitHub really doesn't have hundreds of additional working features beyond git.by SpaceNoodled
5/13/2026 at 7:57:22 PM
Collaboration, issue tracking, Actions (CI/CD), Codespaces, Security, AI, Identity, social, hosting. Those are like broad categories I can think of off top of my head too you could fit probably 10-15 "features" into each of those.by chris_money202
5/14/2026 at 5:17:58 PM
Lots of those aren't centralisation/decentralisation issues though - codespaces, actions, issue tracking, multiple users, all that is repo/org level.by IanCal
5/14/2026 at 7:08:20 PM
GitHub is centralizing all those features. If GitHub was just for repo hosting, then you would need to link your repo to another platform to do CI, another platform for issue tracking relative to the code, etc.by chris_money202
5/15/2026 at 12:05:09 PM
They have those features but those aren’t decentralisation issues, as far as I’d understand the term, but those already can be done elsewhere right now. They’re purely tied to one repo really, it’s only the user accounts that I can see being more of a cross repo concern.And global search but I don’t feel like that even really works.
by IanCal
5/13/2026 at 2:01:35 PM
> That's why I'd really like to see some entity handle just the auth/identity providing. Forgejo/ Gitea/ Gitlab instances can then choose to use that. Then, for example if you want to take on another contributor and they have their own forgejo instances, you can invite them through this provider, when they fork your repo it ends up in their own forgejo, and they can easily create PR's into your repo.Agree, I feel like a true alternative should focus on this missing piece to bridge the gap.
by giancarlostoro
5/13/2026 at 2:17:25 PM
The "missing" piece is just everyone implementing OAuth Dynamic Client Registration. Then kernel.org could be its own OAuth provider, and Linus could log into someone's Forgejo with his kernel.org login.Just like "log in with Google", you should be able to do "log in with OAuth", you type your email or domain (or your browser fills it), and it triggers a redirect flow for login. Then people can use GitHub or Google or Apple or their own provider, just like email. Every email provider could also be an OAuth provider.
by ndriscoll
5/13/2026 at 2:10:05 PM
GitHub is to git like Reddit was to forums. Centralized usernames and such were very nice, but it also has downsides that we’re now living with.GitHub is still really, really nice in that it’s five seconds to throw up a repo that’s accessible worldwide (98% of the time lol) and everyone’s on there. Whatever replaces it (just like whatever replaces twitter) may be better in many ways, but it will be “worse” in others, even if just in splintering.
by bombcar
5/13/2026 at 2:08:37 PM
Signed commits could solve this in a more decentralized way if people post their public keys on their own domains.by lorecore
5/13/2026 at 2:36:32 PM
Own domains is the real deal. My preffered model is tarball releases with checksums, or better yet, with signatures (like remind[0] or msmtp[1]). Such pages are trivial to host properly and loads quickly.by skydhash
5/18/2026 at 9:50:14 AM
I was confused for a bit what those two projects have to do with signatures but I guess you are just using them as examples of having (PGP) signatures for downloads?by account42
5/13/2026 at 3:59:58 PM
This was the original model of launchpad.net, it was supposed to be a hub of Foss that pulled in from the decentralised VCS's, and provide them all via bzr.But bzr lost the battle, Canonical was slow to adopt Git, lack of investment in the platform, so it was another lunch that got taken from them.
by Daviey
5/18/2026 at 9:51:22 AM
Canonical should just rename themselves to Not Invented Here. Their inability to work with others and instead reinventing the same thing badly is beyond comical at this point.by account42
5/18/2026 at 10:08:34 AM
Interesting, got some examples of things they reinvented?by Daviey
5/13/2026 at 4:51:06 PM
Nobody’s forgetting anything. People want tooling around git bare repos. GitHub was cool because of forks and instant forked repos. That’s how they’ve established their moat.by throw1234567891
5/13/2026 at 5:47:03 PM
That "everyone" is just a small, vocal community if you look at the total numbers of repos on GitHub (which is still climbing)[1]Yes, I understand that people are upset about the Copilot issues and maybe even the "frequent" outages (which usually only affect fringe parts of the site not everyone uses daily)
It's good that there are other solutions (forge, sourcehut, whatever) but most projects are still alive and very well on GitHub and my guess is that this will stay for a while.
Also, personally I have no issues with GitHub training AI on my (badly-coded and bug-ridden) code if they really want to :)
[1] https://www.reddit.com/r/github/comments/1snqyj3/is_there_an...
by dark-star
5/18/2026 at 9:53:46 AM
Why do you think total numbers of repos is a relevant metric here? If anything, the slop spam on GitHub is a problem and a core part of why people are leaving.by account42
5/18/2026 at 6:06:44 PM
that might be true, yes, but still: the burden of proof (that "github is dying") lies with the original poster. A statement like "last week, these 3 big projects left GitHub" is not thatby dark-star
5/13/2026 at 1:16:37 PM
I think you're forgetting issue tracking and CI.by _flux
5/13/2026 at 1:31:33 PM
Forgejo has both these things, I'd even argue Forgejo has a better runner than GitHub actions as it's less resource heavy and easier to debug when issues arise (only ran into one, and it was self inflicted).by shimman
5/13/2026 at 2:15:53 PM
I have no trouble believing it is better :), but it is not as easy to mirror a Github issues, or CI configuration, to Forgejo or back as it is to handle the git side.I think Radicle is interesting. It doesn't solve the CI bit, at least not yet, but I suppose it's possible to hook up some local runner for it.
There's also a bug tracker which I believe was called bug, but I can't find it ;), that tries to bridge different issue trackers and providing offline mode for working with them.
People of course also love free CI capacity where they can run even untrusted code, so in that sense Microsoft resources might be difficult to compete against.
by _flux
5/13/2026 at 6:44:46 PM
There is some CI service in Radicle but it's still very barebones[1].[1] https://radicle.network/nodes/seed.radicle.dev/rad:z3qg5TKmN...
by xvilka
5/13/2026 at 4:45:38 PM
Radicle CI does exist but it is admittedly fairly early on in developmentby amusingimpala75
5/13/2026 at 2:26:42 PM
I really wish people would drop the GHA model because it's so bad and insecure by design. GitLab's CI is miles better and easier to use.by treyd
5/13/2026 at 2:32:04 PM
True but GitLab is going to run into the same issues as GitHub, maybe even worse because GitLab doesn't have a trillion dollar multinational benefactor. Public corporation and developer tooling has never boded well, a current look at GitLab reflects this sentiment perfectly.Which is why we should always champion FOSS for dev tooling as it's the only way a community can have a say in an industry dominated by unregulated tech behemoths.
by shimman
5/13/2026 at 4:57:58 PM
> True but GitLab is going to run into the same issues as GitHubWill they? Has Gitlab doubled down on "Agentic AI" and thus require 30x capacity to support current users, while being kneecapped by Azure?
by overfeed
5/13/2026 at 6:41:17 PM
Well GitLab has to deal with a board that hasn't seen exactly great returns since they went public and the situation is unlikely to get better if they continue being a public corporation. Recent leadership statements instill zero confidence on their plans to do anything meaningful.Same problem, capitalism, but different constraints.
by shimman
5/13/2026 at 4:44:08 PM
Is the tooling really centralized around Github? I use TortoiseGit, and that doesn't seem to care which service you are using. Although it does seem to have special authentication features specifically made to help you log in to Github.by Dwedit
5/13/2026 at 4:22:18 PM
I do not mean for this to come across as a nit, but think it's worth stating explicitly:> Everyone seems to be leaving GitHub
A small minority is leaving Github; this group is more likely to write articles about the choice than those who still use Github.
by the__alchemist
5/18/2026 at 10:13:09 AM
It always starts with a small minority. In this case, it already includes some very well known projects.by account42
5/13/2026 at 9:46:04 PM
> Git is decentralized, GitHub is just another place you can host your code in, but you can push your code to multiple remote servers.That's precisely what I have been doing for years, I still get to keep one foot in the GitHub ecosystem. I still get most contributions on GitHub, and that's fine by me. When a PR comes it I check it out locally, review it, and when it's done I merge locally to master, push to origin, and then origin pushes to GitHub which then automatically closes the PR and gives the author attribution. I never actually have to interact with GitHub after the initial pull.
by HiPhish
5/13/2026 at 11:16:58 PM
Where do review comments go? What if changes are needed?by nijave
5/13/2026 at 6:34:10 PM
Everyone knows git is decentralized. What people are searching for is a space for the social component of development such as issue tracking. Being able to reference lines of codes in issues is a killer feature of github. Gitea and gitlab do it too but not as well.Also "just use multiple remotes" doesn't solve the problem. If you don't trust GitHub you shouldn't be pushing code there to begin with. So the ideal platform for hosting an equivalent platform as Github needs to be a trusted one as well.
by midtake
5/15/2026 at 4:27:57 PM
I will not put anything on GitHub for a couple of reasons.1) MSFT is using our free labour to train its AIs.
2) Being Canadian, I do not want any dependence on a US-based company, seeing as the US can no longer be considered a trustworthy ally.
by dskoll
5/13/2026 at 1:39:00 PM
I don't think anyone is forgetting that, but most people don't care that much about the decentralized part. They care about it being user friendly, free and for companies if it has all the enterprise features / SSO etc. that they need.by dewey
5/14/2026 at 12:42:48 AM
While that is true, the real power of git being decentralized is that you have a local repo and a remote repo. Typically, you’ll have a dozen local repositories from developers cloning the projectby hk1337
5/13/2026 at 3:38:46 PM
> Everyone seems to be leaving GitHub, and forgetting the entire spirit of what git is in my eyes.And here lies your misconception: services such as GitHub are really not about git. That's a red herring. It's not about tooling either. People use services such as GitHub because of things like issue management, access control, release management, project pages, and CICD integration. You click on a button and you create a repository that's automatically added to your organization, with all access controls sorted out. You click on a button and you grant read access to someone. You click on a button and you onboard a whole team.
Underneath it all, it's completely irrelevant if you are even using Git. Some people even use github's CLI interface instead. Does it matter if it's git or not? Do you even care?
I have personal projects hosted and mirrored across GitHub, Gitlab, and BitBucket. That works, but only as far as backups are concerned. Even in projects that onboarded onto a third party CICD system, git is really not the reason for picking one service over another.
by locknitpicker
5/13/2026 at 4:44:09 PM
A lot of the complains in the blog post would still be there, though, even if GitHub was just a mirror (the AI training stuff, the US jurisdiction concerns).by cortesoft
5/13/2026 at 2:10:53 PM
"Git is decentralized"Because is a kind of filesystem.
How a TEAM operate IS NOT.
And that is the point of Github.
There is no escape to the coordination problem!
(And if you say mails, patches, and other asynchronous ways: same thing, more complex)
by mamcx
5/13/2026 at 8:06:26 PM
github's draw is the community and exposure.by tonymet
5/13/2026 at 4:53:43 PM
[dead]by mattlutze