2026-08-25 · Distribution
The most valuable node is the one you don't own
I spent an evening checking the links on this blog. Fourteen of the seventeen posts that were here this morning point at github.com/holetron.
That organization returns 404. It was never registered.
The same string sits in our desktop app's auto-update config, which means the Windows and Linux builds we shipped in April have been asking a nonexistent account for updates ever since. Nobody complained, because nobody complains about an update that never arrives.
That's the small, embarrassing version. Here's the large one.
The node you don't own
Draw your project as a graph of the things it depends on. Your server. Your database. Your DNS. Your package registry. Your CI. For most projects, the node with the highest degree — the one that holds identity, history, discussion, issues, releases, and the number people use to decide whether you're serious — is a single account on a platform where you have no administrative rights at all.
You can't audit its decisions. You can't appeal to anyone in particular. And it can be switched off from the outside, automatically, by a system that owes you no explanation.
This is not hypothetical, and the failure mode is stranger than "they banned me for a violation." Accounts get flagged by automation, with no notification and no stated reason. One developer's account was suspended in 2026 and the eventual explanation traced back to a rejected Student Pack application from 2022 — a four-year fuse. Others get suspended with no message at all and find out when a push fails. The recovery path is a form. Your public repositories can still be cloned by anyone who had them; the private ones are reachable only through a collaborator who still has access.
So the practical question isn't "is the platform good" — it is. The question is: how much of your project lives at an address you can't administer, and what exactly happens to it on a Tuesday when the flag fires.
The number that can be bought for three cents
Stars deserve a paragraph of their own, because they're the metric everyone treats as a quality signal and almost nobody treats as data.
A star is a row in someone else's database, joined to an account that can be suspended by automation. You can't export it. You can't transfer it. You can't prove it. If the account goes, the number goes with it, and there is no receipt.
And the market is exactly as bad as you'd guess. StarScout — Carnegie Mellon, NC State and Socket, published at ICSE 2026 — walked 300+ million GitHub events between 2019 and 2024 and identified roughly six million suspicious stars across more than 18,000 repositories. The going rate is three to ten cents for a star from a throwaway account, twenty to fifty for one with a plausible history. Seventy-eight of the flagged repositories made it onto GitHub Trending.
The finding I keep thinking about is what happens next: the boost from purchased stars decays within about two months and then goes negative. Buying the number doesn't just fail to work — it eventually works against you.
Which tells you what a star actually is. Not a measure of quality. A consequence of quality and fame, lagged and noisy, with a spoofable component. Reading it as a quality signal is reading the shadow instead of the object.
And the part that isn't GitHub's fault
Here's what I don't want lost in a complaint about a platform: the platform isn't the reason mediocre software wins.
Distribution is purchasable. Quality is not. That asymmetry is the whole game. A tool with a few hundred stars is very often better than the one with forty thousand — it simply lacked the twenty-four million dollars that turn an adequate product into a default, after which the default gets to charge rent on features that used to be table stakes. The star count is downstream of the raise, and the raise is upstream of everything.
So the honest reading of the leaderboard is: it ranks attention, attention follows money and time, and the competition for attention right now is savage. That's not cynicism. It's a spec for where to aim, because it tells you which channels can be bought and which can't.
Three can't:
- An agent reading a tool registry. It doesn't see your banner or your star count. It reads what your server can do.
- A model citing you in an answer. What gets cited is an extractable, checkable claim — a number with a method attached — not a tagline.
- Being the source of a number somebody has to quote. You cannot outbid someone for having measured the thing first.
All three reward the same behaviour, and it isn't marketing. It's publishing something specific enough to be wrong.
What we're doing about our own graph
Not leaving. We publish to GitHub and we'll keep publishing there — that's where people and their agents look, and pretending otherwise would be posturing.
What changes is which node is load-bearing.
The source of truth is a Forgejo instance we run, on a server we hold, next to the database it describes. GitHub is a mirror and a front door, not the origin. This blog isn't on a platform either — every post here, including this one, is a row in a table in our own Postgres, rendered to markdown on read.
And we froze the namespace, permanently: Holetron-lab. Not holetron, not a rename later when something sounds better. A name that changes is a link that dies, and we just spent an evening looking at seventeen of ours. Lab is also the accurate word — this is a working laboratory that publishes its numbers, including the ones that make us look bad. There are two of those in this post already.
The fourteen dead links are fixed as of today. The desktop update feed is on the list, and until it's fixed, we're not handing that binary to anyone.
Five minutes on your own project
Worth doing tonight:
- Push your repository to a second remote you control. Not a backup — a remote.
- Check what your release and update mechanisms point at, and confirm those addresses resolve. Ours didn't.
- Export your issues. They're your design history and they live in a database you don't administer.
- Have a way to reach your users that isn't the platform.
- Stop reading your star count as a health metric. Read installs, or returning users, or issues filed by strangers — the numbers that can't be bought for three cents.
None of that is a migration. It's making sure the highest-degree node in your graph is one you can still log into on the day the flag fires.