Packaging now standard, dependency proxy next? | Hacker News Reader

Packaging now standard, dependency proxy next?

about.gitlab.com

69 pointsreimertz61 comments

I feel as though this announcement caught GitLab by surprise and it scrambled to put a strong message out there that it already had similar offerings in place. At the same time, however, I don't think their choice of phrasing is the most appropriate. It'd probably have been better handled more subtly.

But does it matter at all? If I host critical code somewhere, it has to be available, and GitLab's uptime history[0] is so much poorer compared to GitHub's[1], with service disruptions and degradations being more common, and far more severe. I don't understand why GitLab doesn't focus on improving the quality of their service. It's not like this is new.

Edit: I feel like I came across as very sour, and I am. But I do like GitLab. I've actually used its CI and Docker image repository in the past and prefer how everything is in one place. I've even written fairly a fairly comprehensive article outlining a deployment pipeline leveraging their tech, but I just don't like service disruptions, especially when they're normalized.

[0]: https://status.gitlab.com/pages/history/5b36dc6502d06804c083...

[1]: https://www.githubstatus.com/history

> I've even written fairly a fairly comprehensive article outlining a deployment pipeline leveraging their tech

Link?

Sorry, I didn't think it was relevant nor appropriate to promote my own content, but here: https://www.toptal.com/devops/effective-ci-cd-deployment-pip...

I don't use their container system here, though. It's just GitLab CI.

Maybe's it's just me, but it seems like Gitlab lists every issue they suffer, while Github is listing when it's (practically) down and non-functional. Would be interested if someone could fill in some details though.

This. I use GitLab most days and I personally haven't had a disruption for well over a year. The only thing I notice is the free runners are sometimes slow to pick up my jobs, but I certainly can't complain about that since they're free runners.

Now if I was going to complain about something it's that they STILL sort images in the registry alphabetically instead of chronologically. I can't even imagine a scenario where that makes any kind of sense.

So maybe the opposite is true. Maybe they're totally focused on reliability and common sense fixes have been ignored.

I hate when companies steal from competitors. There are many examples to that unfortunately. Sometimes the copycat is thought to be the original because it meets a bigger audience sooner, or provides same services cheaper[0].

I respect the open source culture at GitLab. I like how transparent they are, how they handle issues together with the community. But, this is a feature that is very generic. You can't blame a phone company to put a camera to their phone because company-x had it before.

> It'd probably have been better handled more subtly.

I don't think they should've handled it at all, because of their past. Today's GitLab is very different than when it was first launched as an open source project - while the logo was more like a cat[1][2]. But being passive aggressive to GitHub, the company that they think that is stealing their ideas, while still having parts that are remnants of a copy/paste job from that same GitHub, I don't know. This shouldn't mean that GitHub or anyone can steal freely GitLab's ideas. It's hard to find a solution as to how one can fix such past mistakes, but maybe an acknowledgement/owning before going defense mode help.

> If I host critical code somewhere, it has to be available…

+1, GitHub had hiccups too, but they have been pretty solid.

[0]: https://venturebeat.com/2014/03/30/threes-vs-2048-when-rip-o...

[1]: https://web.archive.org/web/20130602065750im_/http://www.git...

[2]: https://web.archive.org/web/20131228051528/http://gitlab.org...

GitLab's primary focus is on selling a product, not GitHub-like services. The hosted instance at gitlab.com is incidental to this. The number of commenters on HN who don't seem to get this is weirdly high.

GitHub is competing for your attention and trying to convince you to use github.com similar to the way that Facebook wants you to use their site. GitLab is not.

If you don't want to use gitlab.com because of low uptime, GitLab doesn't care. GitLab cares about whether you want to buy a GitLab license. If you're not in the market for that, then you were never a potential customer, anyway. Expecting GitLab to care about what you think about the ops history for gitlab.com is like thinking that a car dealer cares about how satisfied the people are who come in to have a coffee, eat a cookie, and test drive a car from the showroom, and never intend to buy anything. That's what gitlab.com is: a showroom.

> GitLab's primary focus is on selling a product, not GitHub-like services ... The number of commenters on HN who don't seem to get this is weirdly high.

You're mistaken. This was true at one point, but no longer. GitLab maintains a document comparing itself to GitHub[0], has mature pricing tiers that go up to $99 per user[1], encouraged users to switch during the Microsoft acquisition by giving discounts on their higher tiers[3], and has paid me $500 in a bug bounty for reporting business logic flaws that allowed free users to leverage APIs that they shouldn't have had access to according to their plans.

If you're actively pulling devs to your product, and even charging them. Make sure your product stays up.

Also, please don't scorn people that disagree with you. Some times it's not them that "don't seem to get" it.

[0]: https://about.gitlab.com/devops-tools/github-vs-gitlab.html

[1]: https://about.gitlab.com/pricing/

[2]: https://about.gitlab.com/2018/06/03/movingtogitlab/

[3]: The report is redacted, but you can see the bounty at my HackerOne profile: https://hackerone.com/gilani

I had no idea Gitlab already did this well before Github.

I think it's absolutely an appropriate response.

This is the correct answer.

I use GitLab daily and for everything and I didn't know this. I know of the container registry and build artifacts, but they don't have an actual registry, do they? I can't point pip to something on GitLab and do "pip install mypackage" and it will work, correct?

It doesn't for python. It does for npm, java and docker though. I've been using the Docker one and it works fantastically well.

I use the Docker Registry as well, it does work great. Is there some special integration for npm/Java, or is it because you can just download the artifacts if you specify the URL?

There's an auth layer to implement + publishing APIs, I believe that's all there is though.

If only there was some standard for package hosting + publishing across all languages… stares at The Update Framework

Gitlab might want to rethink their PR strategy. Every knee jerk reaction they toss out there in response to things like this makes me want to try their tech less and less.

Your loss. At least they have a self-hosted open source version for you to try. That is way more than GitHub offers.

They are apples and oranges, really.

Whole heartedly agree. Gitlab is a cool product and I'm glad it exists, but the one thing that annoys me about the company is these passive aggressive responses to everything GitHub does. It comes across as nothing more than jealousy.

I'm not sure I get the point of this post. Is is to convey that Gitlab did it before GitHub did it? If it's not, then, I really don't get the point.

I’m in the same boat as you. I don’t get the point either. Can someone help?

Now you know Gitlab has this feature

GitLab has this feature and it can be self-hosted.

Yes - Gitlab is basically saying "we did it first, and more. Now that MS has finally caught up with one bit of it, hopefully they will catch up with the other features we already have".

I agree that the verbiage could be better; it looks like they tried hard not to poke fun, gloat, or otherwise prod the blue giant.

Gitlab offers some compelling advantages, but I think they realize “we did it first” isn’t a strong defensible position as Github chooses to offer the same features. (After all, Github offered the main feature first)

It's really good to see GitHub embracing the work that GitLab has been doing for a while (more than 5 years) now. While its healthy competition, it also shows how Open Source companies/projects like GitLab are ahead of proprietary companies and in fact lead the industry with their innovation.

I'd just like to note here that the only part of this in GitLab that is open source is the container registry. The NPM and Maven registries are proprietary.

How GitLab is not proprietary? It is a private commercial company.

How GitLab is open source? It open sources a non-essential portion of its software, and so does GitHub.

Gitlab is like the most open source company out there. It sets examples in transparency that even Mozilla should learn from.

Calling what it open sources "non-essential" is so ridiculously misinformed that I'm really wondering what your goal is here.

I agree they open more than the non-essential parts. It's worth noting that what we are currently talking about isn't an open source innovation however. It's a proprietary offering by a company that does a lot of open source: in both cases. Github opened Atom, contributes significantly to Rails, etc.

Have you seen GitLab CE? You can deploy it in Docker or on Kubernetes using their official Helm charts. It has a ton of features compared to GitHub.

True.

But EE, the product they are making money from, is not free, and not open source. Thus GitLab is not "Open Source company", as stated by arnieswap at the beginning of this thread.

Yes they are. Most of everything they do as a company is public and done on GitLab, including their docs, meetings and more. They are like 100x more open source than GitHub and I've seen GitHub trying to advertise as the company of open source.

> They are like 100x more open source than GitHub

I don't think this is a fair (or accurate) quantification.

While Gitlab's principal product probably has more open sourced code, Github makes tremendous contributions to open source. Atom is open source. They contribute significantly to projects like Rails (for example, the multiple database feature was extracted from their codebase). This doesn't even begin to address the dependency upon Github the entire open source ecosystem has. How many millions of dollars do they spend in infrastructure every month just to keep projects like RubyGems and npm viable?

I think Gitlab is a spectacular offering, and having a single source for your entire dev-ops story is extremely compelling. However, spinning a narrative that Gitlab is more open source than Github is extremely disingenuous.

Gitlab isn't entirely open source. Many of their features require a commercial license. For instance, in order to use the NPM package registry, you must be on a plan (managed or self-hosted) at the $19/user level or above.

Have you seen all the features they offer for free, as well as their self-hosted version? Wayy more than GitHub.

They do offer a lot of features for free, absolutely. Still doesn't change the fact that the features we are discussing aren't on that list.

It's somewhat rich for Gitlab to passive-aggressively complain about Github releasing a feature they released first.

You can either love or hate Gitlab/Github, but this competition is always fantastic for their users.

It's a shame we lost BitBucket along the way. They were the first to spearhead the "all private repos free for individuals" model that the others eventually adopted.

Wait we lost Bitbucket?

Why do you say BitBucket has been lost?

Bitbucket is currently lagging behind Github/Gitlab in pretty much all areas. Usability-wise, even in its most basic features, it is simply terrible at the moment. And there is no social effect whatsoever - in fact, placing your stuff on BB right now is practically a declaration that you hate talking to people. It clearly is not a priority for its new owners (Atlassian).

Having been at a company that was a heavy Atlassian/Jira/BB user, it seems the only reason for companies to ever use BB was because they already used Jira, and/or because of pricing differences vs Github (although that has changed a few times since I've left there).

The only reason people pick them is because someone in the tech department got some sweet kickbacks on an expensive deal.

Being a Bitbucket user is pretty distressing right now. We're invested quite heavily into it, but moving to Gitlab would really address some of our major pain points (having to run Sonatype Nexus, and some Bitbucket Pipelines restrictions).

I hope they can catch up before it becomes too tempting to bail.

They could start by adding syntax highlighting.

I work at GitLab and I completely agree with this! Choices for users and our industry is moving forward embracing the single application philosophy.

Lol, if we are thinking that way, they stole their entire business idea from GitHub!!! They are upset GitHub copied a single feature! Unbelievable.

No they didn't. There were plenty of similar SCM's before GitHub. GitLab quickly outpaced them and added a lot of valuable unique features.

Please. In the earlier days, Gitlab was shameless about copying things from GitHub. At one point, they even styled their website to be almost indistinguishable from the GitHub Enterprise site. If I recall correctly, there may have even been some copying of HTML/CSS from the GitHub Enterprise site.

The reason those things were never widely known is because GitHub never made whiny passive aggressive blogs posts about it. That's one thing Gitlab should have copied from GitHub.

I think you're thinking of Gogs or Gitea. GitHub should have been building a self-hosted open source version and CI platform. Now they're well in the dust and still don't have an open source version.

I'm not. I'm thinking about Gitlab. There is a long history of Gitlab shamelessly copying things from GitHub, and GitHub taking the high road. I would be so much more likely to support them if they didn't act like complete tools any time GitHub releases a new feature, especially considering their history.

> Now they're well in the dust and still don't have an open source version.

GitHub is massively larger than Gitlab. It's not even close. You're focussing on one relatively unimportant thing, and missing the bigger picture. I would wager a year from now, GitHub's lead in the market will have increased, not decreased.

What would you like to wager? I'll wager GitLab will be even further integrated into Kubernetes and the go to for open source CI/CD.

Why are you so hyper focused on products being open source? With a very very small number of exceptions, this has never mattered, and likely will never matter.

I wager GitHub will be a significantly larger company, with more users both free and paid, hosting a significantly larger portion of notable open source projects.

Because I care about innovation for distribution of social benefits and environmental improvement, as opposed to profit.

And I can understand why you like Gitlab the open source project. However, we're talking about Gitlab the for profit company. My criticisms apply only to the company, not the project.

I think the design was Inspinia [1] which can be licensed for commercial use.

[1] https://wrapbootstrap.com/theme/inspinia-responsive-admin-th...

Not following here. GitHub looks nothing like that. There was a point in time where Gitlab made changes to their homepage to look exactly like the GitHub Enterprise marketing page.

Are they upset Microsoft didn’t buy them instead?

I'd expect Google or someone comparable to buy them (you know they are already having those conversations)

I think they are probably very happy Microsoft didn't buy them. The culture at Microsoft would have been so terrible everyone would quit.

Reply on news.ycombinator.com