I asked for specifics because no one in the thread provided them and the prognosis was unclear to me. Thanks @marcus_of_augustus for providing some context for us plebeians.
You didn't read what marcus said either (nothing about what Microsoft might do to change Github, which was your apparently pertinent question).
I have a radical tip for you (again): read the thread (and the replies of anyone you attempt to employ as argument)
What are these "arrogant polemics" you speak of.....? What argument was I even employing.....?
I never made an argument, and I certainly never employed one against you. Literally, what are you talking about?
By your own words, no one in the thread provided specifics or said what would actually happen. So I'm at a loss for how repeating "read the thread" multiple times is helpful, but thanks for the advice. I thanked marcus_of_augustus for providing some additional
context, though I'll note his mention of "the inevitable changes in Terms of Service for Github rolling out" as well. Between his reply and
Wladimir's comment that "[Github] could certainly mess with reviewing" the picture became clearer for me: this doesn't affect the security of the repository itself at all, but it could potentially throw wrenches into the review process.
I never had any strong opinion and was actually seeking clarity, so it's frankly
bizarre that you keep accusing me of making polemics and arguments. I saw
this comment by sipa and thought it sensible, not really understanding what the big fuss was about, hence my original post:
While I believe we should always consider other options, and would support in the long term moving to other infrastructure, I don't believe there is an issue here.
We are already not relying strongly on GitHub. All merges of code into the master branch are PGP signed by the maintainer who merges, which is automatically verified. The code itself is mirrorred by developers themselves, and we could easily add other mirrors too. Finally, release binaries are distributed using
https://bitcoincore.org, and again use a well-audited system (gitian deterministic builds).
We mostly use GitHub for its ease of access and community, and not so much for actually managing or controlling or source tree. Unless that changes, I see no reason why the company running it should influence our choice.
I
still don't understand what the risks are specifically (beyond "Microsoft is bad"), but I'll concede this discussion is going nowhere and there's no point continuing.
