Fog Creek Software
Discussion Board

Hosted source control

Anyone have any recommendations for a vendor who hosts source control systems (CVS, subversion, etc)?
This would seem to have a lot of advantages (automatic remote backup, professional rather than amateur management, etc) but I haven't been able to identify any companies by googling around.

Friday, June 18, 2004

The point that springs to mind here would be that if I were in charge of a software team, the last thing I would want to do would be to risk losing the source code, both permanently or "temporarily".

For example:

- Arrive at the office one day, their connection or your connection is down; no source access.

- Arrive at the office one day, they've gone out of business.  This can be mitigated somewhat by having a decent backup strategy.

Another argument against this I guess would be that if you're small enough to warrant outsourcing source control, you'd be small enough to have and manage a good-enough server and backup strategy in place on site.

Matt ".NET 247" Reynolds
Friday, June 18, 2004

No, you want to host your source locally and then send encrypted backups out to external servers on a regular basis.

Even if you have a distribtued team, you don't need a hosted source control.

The last thing you need is to have to stop work if your connection goes down.

Friday, June 18, 2004

Oh, and having a dedicated source control box is cheap and easy.  I'm running cvs and subversion together on a little P2 200 that sits under my desk.  I have it backup its filesystems every 2 hours to different network drives, but the bulk of the work is done on this box.

Friday, June 18, 2004

I disagree with the sentiment that your source code should "never" be given to a third-party.  These days many companies use Application Service Providers to host mission-critical functions.  There's nothing *inherently* wrong with outsourcing management tasks (not core competencies).

I'd make sure you have redundant processes in place, in case something happens to the hosting company.  Most importantly, ensure that your hosting company can't hold your data hostage.  The recent story just illustrates this point further.  A large hosting provider shut down his free service without any advance notice.  This left his users with no way to retrieve their data.  He has, in effect, "stolen" the intellectual property (the writings) of his community of users.  There are other mitigating factors in that situation, but regardless, don't let this happen to your business.

Anyway, a couple of years ago, my company used the hosted PVCS service from Merant.  We had major problems with their web-based client software.  It was very buggy, and also quite slow.  Unfortunately I don't know if they've improved or not.  I would be much more comfortable using a hosted SCM service that used a standard, proven, bug-tested client.


Friday, June 18, 2004

Outsourcing source control is not like outsourcing other things... managing your code
and its deposition in a source control repository is so cheap and easy that there's
no excuse not to do it.

And I'd argue that doing these tasks *is* a core competency for a dev shop.  If I could,
I'd make my developers order barebones systems and assemble the damn things
themselves.  I don't like it when someone sits around all day because IT can't do
a simple drive swap-out until tomorrow... and I don't because everyone I employ
can do that trivial task if it's critical to progress.  It's like a soldier being able
to field-strip his or her own rifle.

I run a FreeBSD box with CVS.  I started out using an old P1 system with
automatic (home-grown) backup to a JAZ drive.  The JAZ drive controller got all
funny on me and I got cautious.  These days, it's an old P2 system with a pair of 60G
hardware-RAIDed (mirrored) drives.  It almost never goes down, and I can't remember
it needed meaningful maintenance.  Everyone runs WinCVS on their desktops at present
and except for one annoying bug it's fine.

Backups?  Oh that's another machine... the old P1 that used to be the repository.
It sits around all day doing lots of nothing.  In the wee small hours, the CVS server
ftps the repository as a tar ball and this box drops it on to the end of a tar that is
(so help me) actually on a cartridge tape.  It just about never fails and the tape lasts
two to three weeks.  I swap it out semiregularly and they off-site it for me in IT.
This machine runs headless with a serial console to the CVS repository... I can
reboot it and watch the console boot sequence from my desk.

This arrangment means that:
  * a driver failure relating to the backup device brings down that little old P1.
    The repository's availability is unaffected.
  * The repository runs on a machine that serves very little other than the
    repository.  It doesn't run Apache, it doesn't run X, it's not for anyone to use like
    it's a desktop machine.  It's all behind a firewall and has no external IP.  I don't
    chase around lots and lots of security updates.

This thing almost never needs attention, and the computer with the tape
drive almost never fails.  It's cheap:  you can have the whole things for less than $300
these days.

On one possible system of thinking can you make this simpler by jacking yourself into
someone else's server out on the net at large and paying them every month to do
something that could cost you nearly nothing per year?

And remember:  you *should* know how to do this... it's part of your core competency.
Who *really* *thinks* that software development is just the part of it where you're
sitting there laying in code with a trowel (answer:  too damn many managers, but that's
beside the point... we know better... right?).

Thomas Kammeyer
Friday, June 18, 2004

I forgot to mention:  we use Oracle through an ASP.  I would never
subject myself to that kind of frustration over my source control needs.

Thomas Kammeyer
Friday, June 18, 2004

Thanks for the feedback everybody.

I'm probably NOT going to do this...but just in case people are curious, I did identify one company that does this (for $15 dollars a month).

I personally find troubleshooting problems with open source systems on windows boxes a real headache. For example, I've just discovered (through posting to the svn list and interacting with the developers and onther users) that svn seems to have a real problem with virus control software that has any kind of "autoprotect" functionality. This has been causing sporadic, very scary failures when my developers try to check code in or out.

I personally don't want to have to know or think about these kinds of issues any more than I want to understand how my (outsourced) mail server works. However, holding onto your own data is probably more important, so I'll probably NOT go with wush.

Wednesday, June 23, 2004

*  Recent Topics

*  Fog Creek Home