#### # ##### # # # # ##### #### # # #### # # ####
# # # # # # # # # # # # # # # # # #
# # # ###### # # ##### #### # # # #### ####
# ### # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # #
#### # # # # #### ##### #### #### #### # # ####
reasons github is hostile to decentralization, developer autonomy, and the long-term health of free software.
github was acquired by microsoft in 2018. the company that spent decades fighting free software now owns the largest public forge. whatever the current marketing says, the strategic interests of a hyperscale proprietary software vendor are not the same as the interests of independent developers or the free software commons. control of the primary discovery and collaboration layer for open source is a powerful lever, and it is no longer in neutral hands.
github succeeded by making git hosting frictionless and social. the cost is that a single commercial platform became the default place where free software lives, is discovered, and is discussed. when one company hosts the majority of public repositories, issues, pull requests, and ci configurations, the entire ecosystem inherits that company's uptime, policies, pricing, and political decisions. decentralization was supposed to be a feature of distributed version control. github turned the social layer back into a single point of failure.
github actions, packages, codespaces, security scanning, project boards, and the rest are convenient. they are also proprietary and github-specific. repositories that lean heavily on these features become harder to migrate. the more a project depends on github's value-added services, the more expensive it is to leave. this is classic platform strategy: free hosting up front, switching costs later.
github can and does suspend accounts, remove repositories, and restrict access according to its own policies and external pressure. projects that are legal in some jurisdictions but controversial in others have been affected. developers have lost access to their own code and issue history with limited recourse. a forge that can disappear your work is not infrastructure you should treat as permanent.
large platforms inevitably become political actors. github has removed or restricted content under pressure from governments, advocacy groups, and internal policy. the criteria are not always transparent, and the appeals process is opaque. when the dominant forge starts acting as a content moderator for the entire free software world, technical projects inherit non-technical risks.
github (via microsoft) trained large language models on public repositories. many developers never consented to having their code used this way. the legal and ethical questions around scraping public code for commercial ai products remain contested. the same company that hosts the code also profits from models trained on it. the power imbalance is obvious.
github actions is free for public repositories up to certain limits, then becomes a billing surface. workflows are written in a github-specific dialect and often assume github-hosted runners. moving a complex ci setup off github is non-trivial. many projects now treat "runs on github actions" as a de-facto requirement for contribution, further concentrating the ecosystem.
stars, forks, watchers, and the network of who follows whom are proprietary data. github uses this graph for recommendations, search ranking, and product decisions. developers and projects that invest years building visibility on the platform cannot take that social capital with them. the reputation system is not portable.
the collaboration features that make github sticky are not part of git itself. issues, pull requests, project boards, and discussions live on github's servers. if the account is suspended or the service changes terms, that history is at risk. distributed version control was supposed to make the history of the code resilient. the history of the conversation around the code is not.
most people find free software through github search, trending lists, or github-linked documentation. alternative forges have far less visibility. this creates a feedback loop: projects stay on github because that is where users and contributors already are. the result is that "open source" and "github" become synonymous in practice, even though the license and the hosting are separate questions.
outages, policy changes, acquisition fallout, or regulatory action against microsoft all become risks for every project that treats github as primary hosting. free software is supposed to be resilient precisely because it is not owned by one vendor. concentrating the social and collaboration layer reintroduces the very fragility that distributed tools were meant to avoid.
before github, many projects ran their own git servers, trac, redmine, or mailing-list-based workflows. github made the hosted option so convenient that self-hosting became the exception. convenience is real, but the cultural shift is that developers now treat a commercial platform as the default home for free software instead of infrastructure they control.
security alerts, dependency graphs, secret scanning, and other enterprise-oriented features are pushed onto public repositories. some are useful. others increase the surface of github-specific metadata and further normalize the idea that the forge should be deeply involved in the development process rather than merely hosting the git data.
github hosts a lot of free software and provides free accounts. that does not make github itself free software. the platform, the actions runner images, the search index, the social features, and the policy engine are proprietary. using a proprietary platform to develop free software is a pragmatic compromise many people accept. it is still a compromise, and it should be recognized as one.
every project that stays on github because "that is where the contributors are" makes it harder for the next project to leave. the collective action problem is real. individuals can migrate their own repositories; entire ecosystems move much more slowly. the longer the concentration continues, the higher the eventual cost of decentralization.
you do not have to put your code, issues, and collaboration history on a microsoft-owned platform.
(c) 2026 vextoly