Live data from Hacker News

GitHub doesn't show search field unless you sign in

web.archive.org

31–40 of 95 posts

Re: GitHub doesn't show search field unless you sign in

#31
post #27
post #12

Maybe it's to protect people who've accidentally included secrets in their repos from automated searching to hack their AWS accounts?

Wouldn't offer much protection.

None at all really because it's still possible to use search it's just hidden from view.

Re: GitHub doesn't show search field unless you sign in

#32

Facepalm . In this thread: A lot of overreaction from a lot of people who seem to expect the moon on a stick (for free) and who I could easily suspect have never had to run a resource-intensive system before. Doing search well is computationally hard. More than that, it's next to impossible to cache for because there can be so many variants. All-in-all, it's the ideal sort of system to attack if you want to DDoS some…

If you're right, then this is the sort of backlash that could have been trivially avoided by Github explaining their reasoning .

If it were a core element of the system that was actually removed from their users, I might agree.

Re: GitHub doesn't show search field unless you sign in

#33

Facepalm . In this thread: A lot of overreaction from a lot of people who seem to expect the moon on a stick (for free) and who I could easily suspect have never had to run a resource-intensive system before. Doing search well is computationally hard. More than that, it's next to impossible to cache for because there can be so many variants. All-in-all, it's the ideal sort of system to attack if you want to DDoS some…

Almost everything you mentioned does not make any sense.

1. Search is just not hidden in GUI for users, who are not logged in, but these users can still perform search as other people mentioned in comments

2. Github Search is definitely cached

3. It has nothing to do with DDOS. Do you expect Google requires you to sign in in order to prevent DDOS? Moreover, unless Github is totally wall-gardened, there are tons of ways to DDOS the service. I suggest you need to learn how DDOS actually works.

Re: GitHub doesn't show search field unless you sign in

#34

Facepalm . In this thread: A lot of overreaction from a lot of people who seem to expect the moon on a stick (for free) and who I could easily suspect have never had to run a resource-intensive system before. Doing search well is computationally hard. More than that, it's next to impossible to cache for because there can be so many variants. All-in-all, it's the ideal sort of system to attack if you want to DDoS some…

Almost everything you mentioned does not make any sense. 1. Search is just not hidden in GUI for users, who are not logged in, but these users can still perform search as other people mentioned in comments 2. Github Search is definitely cached 3. It has nothing to do with DDOS. Do you expect Google requires you to sign in in order to prevent DDOS? Moreover, unless Github is totally wall-gardened, there are tons of wa…

1. ?

2. No disagreement that searching for the same thing can be cached. But that's not the problem. Search for "banana" "banana 2" "banana 3", etc. It's very simple for a botnet to hit a search function like this with unlimited variance, making it impossible to cache against.

3. You think that Github and Google receive the same revenue benefits from providing a free search?

Re: GitHub doesn't show search field unless you sign in

#35
Not comparable but airpair have a similar trick, asking to signup if you want to see their whole samples http://i.imgur.com/pVuVjrY.png and not obfuscated code samples

I run a site (http://petihacks.com) with many of these little tricks if it's the interest of anyone

Re: GitHub doesn't show search field unless you sign in

#36

This feels like a move away from offering the greatest opensource project hosting site to a walled garden. I was just browsing some repository and found a non linked reference to another project which probably is also on Github but there is no way of searching for it when I'm not logged in (and knowing the search URL somebody posted earlier). Pretty big UI fail and I wonder if this was intentional and if so if they t…

I really wonder what the rationale behind this move is. I wouldn't even have noticed as I'm practically always logged in, but was that search bar lowering the conversion rates to free users, or what?

Perhaps search is expensive, so they are trying to limit the number of searches. I know there is a stricter rate limit for searches in the API.

Re: GitHub doesn't show search field unless you sign in

#37

Earlier quoted context omitted.

Almost everything you mentioned does not make any sense. 1. Search is just not hidden in GUI for users, who are not logged in, but these users can still perform search as other people mentioned in comments 2. Github Search is definitely cached 3. It has nothing to do with DDOS. Do you expect Google requires you to sign in in order to prevent DDOS? Moreover, unless Github is totally wall-gardened, there are tons of wa…

1. ? 2. No disagreement that searching for the same thing can be cached. But that's not the problem. Search for "banana" "banana 2" "banana 3", etc. It's very simple for a botnet to hit a search function like this with unlimited variance, making it impossible to cache against. 3. You think that Github and Google receive the same revenue benefits from providing a free search?

Do you understand how search works?

Re: GitHub doesn't show search field unless you sign in

#38

Earlier quoted context omitted.

Almost everything you mentioned does not make any sense. 1. Search is just not hidden in GUI for users, who are not logged in, but these users can still perform search as other people mentioned in comments 2. Github Search is definitely cached 3. It has nothing to do with DDOS. Do you expect Google requires you to sign in in order to prevent DDOS? Moreover, unless Github is totally wall-gardened, there are tons of wa…

1. ? 2. No disagreement that searching for the same thing can be cached. But that's not the problem. Search for "banana" "banana 2" "banana 3", etc. It's very simple for a botnet to hit a search function like this with unlimited variance, making it impossible to cache against. 3. You think that Github and Google receive the same revenue benefits from providing a free search?

Guy, you're wrong. You can keep arguing, but that won't change reality.

Re: GitHub doesn't show search field unless you sign in

#39

Facepalm . In this thread: A lot of overreaction from a lot of people who seem to expect the moon on a stick (for free) and who I could easily suspect have never had to run a resource-intensive system before. Doing search well is computationally hard. More than that, it's next to impossible to cache for because there can be so many variants. All-in-all, it's the ideal sort of system to attack if you want to DDoS some…

Search isn't removed for non-logged in users, it's just hidden, which makes your ddos point moot.

Re: GitHub doesn't show search field unless you sign in

#40

Facepalm . In this thread: A lot of overreaction from a lot of people who seem to expect the moon on a stick (for free) and who I could easily suspect have never had to run a resource-intensive system before. Doing search well is computationally hard. More than that, it's next to impossible to cache for because there can be so many variants. All-in-all, it's the ideal sort of system to attack if you want to DDoS some…

Then one should get a couple of elastic search clusters, one for the guest users to hammer and DDoS and one for the authenticated users.

Not only does this make the search cheaper and easier for the guests (just an index of public repos, so no permissions involved), it makes it easier to continue offering search to authenticated users whilst being able to mitigate L7 DDoS on the authenticated search (just block the users involved in the attack).

Besides, there is a huge SEO benefit to having a searchable and discoverable interface, and a huge attention retention benefit to keeping users on your site to search once they have arrived there. On top of that, Github understand their data structures better than a search engine so it's easier to tune complex searches just for a codebase, or blog, or issue.

There's really no benefit to hiding search, and having written many community generated content sites the only reason I would hide search is as a stepping-stone to making the content part of a walled garden.

It's fairly inevitable Github will want to do this, I imagine they're looking at the number of users who are not signed-in or on free accounts as yet to be monetised. They would want more activity data to make arguments for advertising, or recruitment monetisation, or plan up-sell, etc.

That's where this makes sense, as a way to gather more user habit data.

Post reply on HN