71–80 of 95 posts
Earlier quoted context omitted.
Google rate limits unauthenticated sessions. Try using Google over tor. They are pretty heavy-handed about it too. Github isn't tiny enough to use ddos as an excuse.
TOR still uses cookies so a session ID can be set for the user agent and rate limited. DDOS scripts create new sessions on every attack request. It's a very hard problem to solve without blocking legitimate traffic too.
Earlier quoted context omitted.
Google rate limits unauthenticated sessions. Try using Google over tor. They are pretty heavy-handed about it too. Github isn't tiny enough to use ddos as an excuse.
TOR still uses cookies so a session ID can be set for the user agent and rate limited. DDOS scripts create new sessions on every attack request. It's a very hard problem to solve without blocking legitimate traffic too.
Simply sign your session ids with an HMAC, to verify the id without any I/O! And require something expensive to create a session (such as a hash-based challenge request). Sessions are usually not needed for static sites, so by the time the person searches, their browser will have earned one session. A spammer on the other hand wouldn't have the computational power to create the various sessions. Also, if a spammer's IP is detected, the computational complexity can be increased for that IP.
Earlier quoted context omitted.
TOR still uses cookies so a session ID can be set for the user agent and rate limited. DDOS scripts create new sessions on every attack request. It's a very hard problem to solve without blocking legitimate traffic too.
Well, at some point you have to block legitimate traffic. My thought was it doesn't have to be black and white. Maybe require the user to solve a captcha after the nth search from the same IP address? How big are the biggest of botnets? A few hundred thousand computers? Or maybe even require captcha for every unauthenticated search.
> Treat nonlogged in users as second class citizens. By always giving logged out always cached content Akamai bears the brunt for reddit’s traffic. Huge performance improvement.
I have ended up using this philosophy in a website I've been working on lately, where people can post puzzles from The Witness. This includes simplifying decisions such as not tracking solved puzzles unless you have a user id, and not allowing navigating to a random puzzle either, as this routine depends on stored solves and upvotes. Supporting not-logged-in users just means extra code for me.
In general, I don't think this is a bad attitude for a website to have.
It is perhaps different in the case of GitHub, a highly depended-on and well established website which is actually removing functionality here. I would still assume good faith about the reason. And mobile login rates are a problem for everyone, I'm pretty sure, not just GitHub.
Earlier quoted context omitted.
I feel like this is a part of a trend that reflects how github itself is changing - slowly making access to things harder, then finally removing it. Github used to have an awesome and public way to explore projects ( http://web.archive.org/web/20130730125837/https://github.com... ) - I remember using it a lot to look for projects to learn to read code because it allowed me to easily find projects by language. They re…
OTOH, a trend towards self hosted solutions will only make finding projects to explore harder.
Earlier quoted context omitted.
I feel like this is a part of a trend that reflects how github itself is changing - slowly making access to things harder, then finally removing it. Github used to have an awesome and public way to explore projects ( http://web.archive.org/web/20130730125837/https://github.com... ) - I remember using it a lot to look for projects to learn to read code because it allowed me to easily find projects by language. They re…
As danmaz74 said, this will fragment the open source scene over multiple platforms which makes it harder to discover. Github always felt nice as a home for all these projects, I don't get the need for this move either. They must know that people contributing to open source rather not want their stuff to be hidden behind some wall. I just wish they would have continued their offering, in my books they were the good gu…
Earlier quoted context omitted.
As danmaz74 said, this will fragment the open source scene over multiple platforms which makes it harder to discover. Github always felt nice as a home for all these projects, I don't get the need for this move either. They must know that people contributing to open source rather not want their stuff to be hidden behind some wall. I just wish they would have continued their offering, in my books they were the good gu…
If anything, github's lock-in fragmented "the open source scene". The internet and the web are distributed systems, there is no reason why all code has to be hosted with one proprietary service in order to be discoverable, just as there is no reason for hosting all websites with one proprietary service in order to be discoverable. That's what standardized protocols and interfaces are for.
Earlier quoted context omitted.
I really wonder what the rationale behind this move is. I wouldn't even have noticed as I'm practically always logged in, but was that search bar lowering the conversion rates to free users, or what?
Probably because Github is constantly under DDOS attacks, search is computationally expensive, and they can't rate limit unauthenticated sessions. http://m.theregister.co.uk/2015/08/26/github_wobbles_under_d...