GitHub banned us without notice — Is Microsoft the risk we didn’t consider?
Like most SaaS companies, here at ProWritingAid, we do regular risk assessments. In the last week, Microsoft, both directly and indirectly (through its new ownership of GitHub), have caused me to add not one, but two completely unexpected new risks to that assessment. At our next risk assessment meeting, we’re going to have to be a lot more creative in our thinking.
As with most SaaS companies, we have APIs. Our grammar checking API lets people check for grammar mistakes, style improvements, and terminology issues. Although our API is not our main source of income, it does form a significant part of it, and like many companies, we host the code for our API on GitHub. We have 13 repositories that contain SDKs for different languages, along with a number of repositories that contain plugins for different text editors allowing people to easily integrate real-time grammar checking. All of this code is open source, as we actively encourage people to use it. For example, we’ve written a plugin to ProseMirror that allows people to integrate real-time grammar and spell checking. I’ve actively encouraged people on the ProseMirror forums to re-use this code to integrate services other than our own.
So, imagine my surprise when one of our developers doing some manual testing on our new release told me that our GitHub account seemed to have disappeared. I went to GitHub and logged into our account and was confronted by this lovely message.
Note the passive voice: “has been flagged”, not “We have flagged your account”. As a writing pedant, I immediately wondered who had flagged our account. This is a great example of using the passive voice to completely absolve themselves of responsibility, a trick beloved of defense attorneys. I’m assuming that GitHub has some automated process that runs in the background flagging accounts.
My next thought was that we must have missed an email from GitHub where they kindly informed us that our account had been flagged and maybe gave a more specific reason for this flagging. It turns out that they hadn’t. So they’d just blocked our account with absolutely no notice or warning.
When I contacted support, I explained that we are a genuine company, doing genuine business and using GitHub to host our SDKs like many other SaaS businesses. Here’s a picture of Stripe’s GitHub account where they do exactly the same.
A few hours later I received this response:
Hi there, Chris,It appears that you may have set up a profile solely to link to an external website and service.We are a code hosting service and collaboration tool for software developers, so we'll have to keep your account hidden for now.
We do have repositories that link to our website, but so does virtually every other SaaS company in the world. I assumed I must have missed something in GitHubs T&Cs but on further reading them I found nothing that states that what we’ve done is not allowed. So I wrote back to GitHub’s support suggesting that this must be a mistake and asking them to kindly reinstate our account.
Still no response from GitHub, nearly 24 hours later so we’ll need to instigate plan B — move to another provider. Following the news of its acquisition by Microsoft, GitHub saw record numbers of repositories moved to other services such as Bitbucket and GitLab. It seems that GitHub is now actively encouraging its remaining users to leave as well. Could this be a sign of things to come on GitHub, with Microsoft acting like an authoritarian regime and shutting down repositories and even whole accounts with no warning for undisclosed reasons? I’m not sure. I hope this is just a simple misunderstanding and GitHub will choose to reinstate our account, but who knows. For me, in these sort of situations, good communication is the key. GitHub have definitely failed in that respect. Unless there is evidence of gross misconduct GitHub should engage its customers in a discussion before shutting down their accounts. They should, at least, inform the user that this is what they’ve done, outline the reasons and remedial steps.
And what was the second incident that I had to add to our risk assessment? Well, the whole of the Azure cloud going down. We host all of our services in Azure. If one region goes down then we should be fine as we’d failover to another region. However, we hadn’t considered what would happen if the whole of Microsoft Active Directory went down, which is what happened. You can read more about it here. We couldn’t even log into the Azure Portal. Even the Azure Status page went down — surely they should host this on AWS!
And all this happened in the week our CTO decided to go on holiday: another risk I hadn’t considered!
So, if you’re hosting your SDKs on GitHub and there’s a potential disruption to your revenue stream from your customers not being able to access them, consider having a contingency plan as part of your risk assessment.
The other key things we’ve taken away from these experiences are:
1) Be more imaginative when risk assessment planning. Look at everything that could affect your revenue and customer experience, particularly services out of your direct control.
2) Store database backups outside of your hosting provider. You might not even be able to access your backups.
3) Favor containers for hosting agnostic deployment. Don’t get tied down to a particular hosting provider unless you really need to. You never know when you might need to switch providers in a hurry.
4) Be careful of relying on third party services that you’re not paying for.
[UPDATE: After a few more emails we finally heard back from GitHub and they restored our account. An apology would have gone a long way though!]
Have you tried ProWritingAid yet? What are you waiting for?
This story is published in The Startup, Medium’s largest entrepreneurship publication followed by +368,366 people.
Subscribe to receive our top stories here.
