Ask HN: Due to spam on GitHub, what platforms can I move my projects?

https://news.ycombinator.com/item?id=48611303

by ciwolex • 1 month ago

61 64 1 month ago

news.ycombinator.com

I have a few projects on Github. I am receiving a lot of spam PRs and requests from vibe coders and bots. Most of them to prop up their profiles. The stars are obviously exaggerated too.

What other platforms are you using for your projects?

comrade12342• 1 month ago

Git is pretty simple to host yourself. For literally decades I've used git and gitolite to host git for me and a revolving team of developers.

But if you want it to be public though where anyone can access/fork it then you have to deal with "spam".

fhdkweig• 1 month ago

I'm not familiar with git, but can you post a read-only version publicly so others can still access all the commit history but not be subjected to pull requests?

JTrehan• 1 month ago

If you have somewhere to host it you can go with https://forgejo.org/ and have control over everything.

1313ed01• 1 month ago

That's pretty much what git over https does by default (is it even possible to do read-write to a git repo over https instead of ssh?).

https://git-scm.com/docs/http-protocol

8ig8• 1 month ago

Fossil

https://fossil-scm.org

danillonunes• 1 month ago

I think cgit is the simplest one that provides a browsable http version of the repository if that's what you want. It's used by the Linux Kernel itself. Example: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

ciwolex4• 1 month ago

How do you deal with bot traffic and traffic from AI that's trying to get training data from your codebase

ben_w• 1 month ago

Same way you would for any other server. And I mean that 100% literally, given that at the command-line level the remote is simply a URL: https://git-scm.com/docs/git-remote

comrade12342• 1 month ago

Only developers that have sent me their public ssh key have access to

ruuda• 1 month ago

Codeberg

sixtyj2• 1 month ago

PROJECTS: 608267

It seems to be alive.

FabCH• 1 month ago

Codeberg hosts some decently high profile projects.

It’s probably the one to go for.

Consider donating for their hardware costs. They are completely transparent about their costs and where the money goes.

ciwolex4• 1 month ago

That's awesome, I didn't know they went to that level of transparency. I think this is a strong consideration.

tocariimaa• 1 month ago

Codefloe

ciwolex4• 1 month ago

I think one important factor would be still being able to interact with a community of people who care for software and would like to put genuine thoughts. Whether it be for submitting bug reports, issues, PRs or security reports. Of course other platforms are not diverse as GitHub, it would be nice to see which other platforms are attracting such people. This in turn has a higher chance of interacting with such people.

sixtyj2• 1 month ago

Gitlab

rurban• 1 month ago

Pretty easy to setup a PR block for anybody you dont like. Like every other people. Or new people

cobertos• 1 month ago

Related question, is there a web-based self-hosted git replacement that's _light-weight_ (i.e. resilient to scraping)? Should have things like file view, file browser, etc but is not taxing on the server.

motoroco• 1 month ago

gitea runs well on a low end server in my experience. self hosting on hetzner and it's somehow the holy trinity of cheap, fast and reliable. I previously (years ago) self hosted gitlab but I remember it being very slow which was the reason I moved on

xrd• 1 month ago

Forgejo. A single tiny golang binary, I think about 200mb. It has 75% of the functionality of gitlab with 5% of the resource requirements. I migrated to it and have never missed gitlab.

mfenniak• 1 month ago

Forgejo is lightweight relative to some other options, but it is not resilient to scraping. Scrapers can access, commit-by-commit, each individual file, each file's "git blame", and each commit's repository archive... and they do. Most public Forgejo instances need to rely on a reverse proxy like Anubis or Iocaine in order to prevent server resources from being exhausted by bad actors. Or require sign-in for all access.

https://codeberg.org/forgejo/discussions/issues/320

sneak• 1 month ago

I like Gitea.

unsungNovelty2• 1 month ago

sourcehut.org would be my choice. Drew is pretty adamant about stuff and his morales. You will dislike somethings (UI and some policies) but will like majority of the things (tech like CI/CD etc). It's OSS and can be self-hosted as well. But I think drew fighting LLM scrappers on our behalf is good for us. It's also cheap and should progressively improve going forward.

It's my long term plan. And the project and company is setup in a way to be here for the long game. So, I am progressively moving my projects (private and in small numbers, but still...) from gitlab to sourcehut over this year or next.

Link - https://sourcehut.org/

velebak• 1 month ago

I second this. Ive been using sourcehut for a few years for personal stuff. Worth every penny at twice the price.

atmosx2• 1 month ago

Drew is pretty adamant about stuff and his morales.

Which is, by all accounts, a double-edged sword. Cuts both ways.

unsungNovelty2• 29 days ago

I mentioned it right? Some you'll like, others you won't. :)

I don't have to like all of his policies. Cos I have a ton of things I don't like about GitHub compared to Sourcehut.

rolph• 1 month ago

New repository settings for configuring pull request access [feb13-2026]

https://github.blog/changelog/2026-02-13-new-repository-sett...

abraham• 1 month ago

Limiting the number if PRs per person also just launched.

https://github.blog/changelog/2026-06-17-limit-open-pull-req...

drakmail• 1 month ago

Self hosted forgejo is pretty good for me

ratg13• 1 month ago

Set up a GitHub action to auto-close any pull requests from anyone not on an approved list.

Leave a message in the pull request that if they want to argue their case for a pull request they can send a message through a communication channel of your choice, and say that anyone sending a message with AI generated text, even to help with language and grammar will be banned.

lostmsu• 1 month ago

Not sure how the options suggested in this thread except closing the PRs to collaborators only are going to solve spam problem. Obscurity?

ciwolex4• 1 month ago

This works, but you stop being the community from engaging.

senorcrab• 1 month ago

Codeberg.org is really great.

Also I recommend self-hosting Gitea for private projects and backing-up public projects

shimman• 1 month ago

I use forgejo myself but both are great choices. Self hosting has improved dramatically over the last decade. So many things that I would never think we'd have access to, like open source PaaS software on-par with what VC companies offer (dokploy, coolify, or komodo).

maxdo• 1 month ago

Move it to private GitHub repo. Really weird question if you open to public , pr is what’s expected .

jasonriddle• 1 month ago

It depends on what you are looking to get out of the next platform.

For me, I'm not interested in the social aspect of coding anymore, so I have a Synology NAS running a git server accessible via ssh and I push my code there.

I use klaus (https://github.com/jonashaag/klaus) as a read only git web ui. My NAS is connected to my tailscale network so it's easy to view things on the go. It's a simple setup and works great.

ElectronBadger• 1 month ago

Codeberg.org

ryandrake2• 1 month ago

This is evidently not a popular opinion, but git repositories don’t need to be hosted on any platform. Your local repo is a complete copy and can be pulled and pushed from and to. If you really want a backup or “source of truth” copy, you can clone it anywhere you have shell access. We make so many simple things hard unnecessarily.

iLoveOncall• 1 month ago

If this was a viable option, OP would just private his GitHub repos, but it's pretty obvious that he wants to make them available publicly.

krapp• 1 month ago

If they have a blog or use a static site generator they could host their github repos online and use a plugin or something to display them. Or even just post links to the repos. It might cause bandwidth issues for popular projects and you wouldn't have any of the "social" features like stars (which in this case would be a feature) but it should be possible. Depending on how the backend is set up you might not even need to put the repos in the web path at all.

But I'd still say just use Codeberg. And see if there's an option to turn off PRs wherever your projects are hosted.

aquariusDue• 1 month ago

Obligatory reminder that you can clone a git repo around your local filesystem and so on too. Same goes for other git operations as well.

https://thehorrors.org.uk/snippets/git-local-filesystem-remo...

thayne• 1 month ago

That only works if you are only using Github as a place to store your code. I'm not the OP, and maybe their situation is different, but I want to continue getting sincere human PRs and issue reports on my projects, but want to reduce or eliminate the amount of AI produced spam.

xeonmc• 1 month ago

You can disable PRs and Issues on GitHub. Though still good to migrate away for reliability considerations.

ctdinjeu8• 1 month ago

Today in: Non-issues

hstaab• 1 month ago

For read-only code sharing, I would say use cgit and a VPS.

If you need a forge with all the bells, grab a copy of Forgejo and modify it to your liking.

Either way, consider using a VPS or a machine you own with Tailscale/VPN. It can be as simple as you'd like it to be.

sam_lowry_3• 1 month ago

Git. Move your platform to git.

See here for a howto: https://mikhailian.mova.org/posts/305-looking-for-a-european...

gwbas1c3• 1 month ago

Did you mean something else? GitHub is based on Git.

Git isn't a platform for hosting source code, it's a program / protocol that GitHub and other platforms use.

sam_lowry_3• 1 month ago

Click on the link above.

jurschreuder• 1 month ago

Codeberg. They ONLY host open source software, it's sponsored by European institutions, Zig moved there too.

In the near future I'm also adding Forgejo to our Kexxu servers. Forgejo is basically Codeberg (but you need to host it). If you want a private repo on Kexxu just ask.

altairprime2• 1 month ago

Anywhere you accept unvouched pull requests will end up being spammed. You might find some respite at other sites, but whether you stay or go: you’re better off disabling pull requests on your projects for everyone but you, and then using discussions (like ghostty) where people petition to work on a feature; if they can convince you it’s a feature that’s valuable to you, then you can pull from their branch (like Linus) and merge them yourself when ready. That will halt the PRs and give you a much reduced pool of noise, as most fly-by-night sloppers won’t be interested in spending the extra tokens on both code and discussion. (You’ll still get entitled human beings who demand you add and maintain their solution to their needs, but that’s much easier to sift out and discard once people have to discuss their needs in written words rather than code.)

analog_daddy• 1 month ago

Really surprised that this is not the first thing everyone does on their repositories.

I am not a celebrity on github and not even agents bother with my repositories, however, even before the bot pull requests/issues, I always made sure to enable only the things I felt I would want to use and provide a way for someone to reach out in case I was expecting collaboration/feedback.

I realized that anyone can create a PR to upstream, when I accidentally did so using the github web UI on mobile. Felt embarrassed and immediately closed it. But, then it made sense that why people were frustrated with this sort of thing happening to big repositories.

altairprime2• 1 month ago

I only thought to do this a few months ago. Change is rarely obvious and never evenly distributed.

gwbas1c3• 1 month ago

I kind of wish there was some kind of way to be licensed as a professional (or amateur) in a way that could be used to block AI-originating PRs.

Not that it would be perfect, but if I could set the bar to "only licensed software engineers" can open PRs, it at least sets the bar that only accounts controlled by people who know what they're doing can open a PR to my repo, as opposed to letting anyone in the world who knows how to prompt open a PR.

(That being said, I personally haven't encountered AI SPAM on my github repos. Maybe my projects just aren't popular enough?)

pan692• 1 month ago

Does anyone has experience with AWS CodeCommit? It might not be what OP is looking for but since we're talking about moving away from GitHub. Personally I already pay for GitHub so I don't mind paying for something else. Just wondering if anyone has experience to share.

https://aws.amazon.com/codecommit/

winstonlee• 1 month ago

I don't have much confidence in it. I moved away after this.

https://aws.amazon.com/blogs/devops/aws-codecommit-returns-t...

The branch view and PR UI is terrible last I used.

pan692• 1 month ago

Ah, right. I never knew it went away (sott of) then then came back. That is kinda worrying indeed.

austin-cheney• 1 month ago

Forgejo looks really popular right now. I have also heard good things about codeberg.

https://forgejo.org/

schmookeeg• 1 month ago

I'm enjoying forgejo as a self-hosted repo. No complaints, and the actions I was using on GH transferred over cleanly. I understand it's not quite fully compatible though, but worth an exploratory smoke test.

I hate the name though and resist saying it aloud. But that's been true of a few of my tools over the years :)

paulsmal• 1 month ago

forgejo was already mentioned,but I also found this interesting fork recently https://upd.dev

Ask HN: Due to spam on GitHub, what platforms can I move my projects?

Related Stories