Hacker News Reader

Comment by fourthark | Hacker News Reader

What does this mean?

Arm was using GitHub for source code hosting. But most of the new core infrastructure that Arm is deploying is on proprietary hardware, and "GitHub is a black box and so we would have to work with them or let them do the work, and it wouldn't necessarily be correct," Wafaa says. "Then we'd have to do reviews. We wouldn't necessarily be able to do the patch reviews because it's all private and proprietary code… that was a big factor for us choosing GitLab."

Seems garbled, what does the proprietary nature of GitHub have to do with code review process?

Are they just saying they can’t host a lot of the code publicly?

View on HN

I’d think it’s issues like CI runners and the like?

I don’t think you can handroll github dedicated runners (e.g. I read recently that there’s still no support for M1 dedicated runners).

If ARM wants to run CI directly on the ISAs they’re developing, or with complicated custom toolchains such that they can run tests on ISA under development from a host machine, they probably need pretty extensive customisations on the runner site, which would require contracting github to do that for them, or having to work directly on github code, for ARM-exclusive needs.

Either way a lot of collaboration work for something which isn’t really collaborative, or of any concern or value to github as a company. And with possible risks of information leak one way or another.

I think they are referring to on premesis GitHub Enterprise Server, which won't work for them because they are using new CPU archs like arm64 which it doesn't run on?

That's my guess but not very clear at all...

part of the supply chain is your source forge and builders. On GitHub, you can point the builders to your own infra.. and then maybe check cryptographically that all source code that lands on the builder is correctly signed and trusted.

But it's nearly impossible to do that for the forge itself (GitHub).

I recommend https://slsa.dev (vendor-neutral effort from the Linux Foundation) for a better picture of a secure supply chain.

Yeah I’m sure this is garbled by a VP. Sounds like they want more control over the CI process and keep more of that process private.

I would guess they're likely referring to the proprietary / black-box nature of (one of or a combination of) the Github API for automation tasks, the Github Apps marketplace & associated APIs, and the Github actions infra & archs.

Pretty easy to understand if you have the context. They're probably using Github Enterprise (GHE). GHE may not run on their proprietary hardware. When things fail, they can't fix it because they don't have access to the source. When there is an update, they need to review the patches to make sure that stuff will work on their hardware.

Simply put, the open source is a beneficial thing for Arm here.

IMHO they are talking about reviewing 3rd party software, not their own developments.

But is not a great reason they probably have more products where the source is not available to them...

He's saying Microsoft can spy on your stuff and that they dont want that.

Reply on news.ycombinator.com