I get really annoyed by comments like this. The comments was that there may be a systemic risk. Pointing out that there are mitigating controls available is simply not sufficient to refute the concern. To refute it you'd need to show that enough repos do have sufficient backups and are capable of recovering adequately from the loss of github.
If I asked a colleague at work if a project was properly backed up and they said 'well there's an enterprise backup solution that is appropriate for it', I'd metaphorically kick their but into next week. I'd want to know that they are actually backing it up and that the backups have been verified, not that they could be backing it up.
If you'd said something like 'there are options available to mitigate the loss of github and projects should be taking advantage of them, and here they are' that would be a good and useful comment, but I don't think a practical concern can be reasonably dismissed with a theoretical counter. I find it dismissive and lazy.
The point is the risk is the same as it's always been and the mitigation steps are the same. And that git mitigates some of the worse effects naturally.
If project sites were still mostly individually hosted using a wider variety of services and software, then a single outage wouldn't be a big deal.
Now, an outage at github would be difficult because you would not only have to get your stuff available again, but you might also have to track down a long list of dependencies that are also hosted at github.
If I asked a colleague at work if a project was properly backed up and they said 'well there's an enterprise backup solution that is appropriate for it', I'd metaphorically kick their but into next week. I'd want to know that they are actually backing it up and that the backups have been verified, not that they could be backing it up.
If you'd said something like 'there are options available to mitigate the loss of github and projects should be taking advantage of them, and here they are' that would be a good and useful comment, but I don't think a practical concern can be reasonably dismissed with a theoretical counter. I find it dismissive and lazy.