157
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 03 Sep 2026
157 points (99.4% liked)
Programming
28405 readers
386 users here now
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Rules
- Follow the programming.dev instance rules
- Keep content related to programming in some way
- If you're posting long videos try to add in some form of tldr for those who don't want to watch videos
Wormhole
Follow the wormhole through a path of communities !webdev@programming.dev
founded 3 years ago
MODERATORS
This might be a problem for many projects. Rust, comes to mind, that pulls everything from Github and is 100% dependent on it. Same as Go. They pull everything from Github.
It might make sense for them to use something like radicle, a distributed git. Many people can easily pick what they want to distribute. Scripts can be written that make the local node only host the projects you depend on. That would naturally make popular projects more available.
I'm worried about nix, honestly. An absolute truckload of nix packages pull their source from GitHub. It's the primary way to distribute flakes, too.
nixpkgs is literally a GitHub repo
Flathub
Nixos
GrapheneOS
uBlue (Bazzite, Bluefin etc), Secureblue
90% of android and linux apps
github is scary big
Wait, doesn't rust cargo pull from crates.io?
crates.io pulls everything from github.
No true at all.
The index used to be from github but now it pulls from a CDN by default and doesn't do a full clone of the index. Crate downloads have always been pulled from a CDN.
The index was quite small in the beginning this is why it worked.
The service itself pulls from github to create the crates. Cargo pulls from crates.io, that is correct.
Who pulls from Github to create the crates? The crates are pushed by
cargo publishto crates.io's API, not to github.crates.iodoes have an index in GitHub, but that's legacy and pretty much unused for reads now. GitHub doesn't store the crates themselves.It seems that's not the case. Crates.io only needs Github for logging in. Publishing a package uploads a .tar.gz to crates.io with the source code.
https://users.rust-lang.org/t/publishing-crates-without-github-and-some-criticism/134597/11
Does all of that access really need to be anonymous access? I get that it's convenient. But let's be practical; they have to manage anonymous bot spam somehow.
Yeah I'm not managing several different accounts for each vm in qubes os.
The only real way to maintain any semblance of digital privacy is to build information silos.
That will always be more important than Microsoft's hosting costs. (Though probably not to them.)