Earlier quoted context omitted.
A more apt analogy, if we didn’t already know the general range where a given single comment thread degrades that thread (analogue to a local repo) and HN overall (analogue to the GH service), writing a bot to answer that specific question. It’s kind of wild that this yielded any new/not-widely-known information at all because it’s such an obvious thing to test. But apparently it raised at least some eyebrows on both…
In load testing there's a difference between testing if something executes as specified versus testing where it breaks. I'm pretty sure that GitHub has tests to validate their performance specification. They may have tests even far in excess of that. They may not have tested where it breaks. They may have had a discussion like: what if someone tries such and such, and their answer may have been: we have good monitori…
Disabled at 22 million commits
101–110 of 145 posts
Re: Disabled at 22 million commits
#102Earlier quoted context omitted.
They seemed fairly surprised by the fact it happened, and let it go on for some time. Which strongly suggests they hadn’t considered such a load test on their own. If I had a budget/head count, I’d at minimum put out a feeler for a QA role.
Where are you reading that they're surprised?
Re: Disabled at 22 million commits
#103The author used up so much of github's resources that it impacted other users. 22 million commits is probably enough that something started to hit a linear or n-log-n scaling function, setting off an alarm on some metric. Yeah, you get in trouble for that. I'm reminded of a time in high school where my friend almost got himself banned from the school computers. At home he had dial-up internet (it was 2003 and he live…
"somehow" I don't get this attitude. Shit happens, we talk about it, we don't do it again. Not everything needs to have dire consequences.
Re: Disabled at 22 million commits
#104Earlier quoted context omitted.
It is malicious as he knows he will harm the service to be able to draw whatever conclusion. This is not a case where the end justifies the means.
The first time I wrote and shared any kind of interactive code, it took approximately five minutes for someone to XSS it. At the time, I was pretty miffed too. After a polite explanation that the “abuse” was curiosity about defensive measures I’d taken, I understood pretty suddenly that there was a whole scope of programming I hadn’t even considered. More than 20 years later, I still remember the enormous benefit tha…
At a previous job I was aware of a potential vulnerability, voiced it rather loudly, but had a hard time getting the attention it deserved until I recognized it happened to coincide with a really high profile business-critical bug. I only recognized it because some jerks had previously fucked with much less important stuff under my purview, and I wanted very much to understand how they did it, and learned quite a bit by wanting to know.
I used those developed instincts to unfuck what would have otherwise resulted in at least contract terminations, if not lawsuits. And the recognition allowed me to correct almost every compromised datum, which also guarded every contractee from challenges to their license status and ultimately whether they could be subject to wholly different jurisdictional context.
I’m not going to disclose the nature of the vulnerability but the way the bug presented was time deltas based on time zone configuration. Hardly a novel problem, but nearly put a whole industry into peril and or conflict. Definitely was worth the attention.
And when communicating the problem suffered, I did what any self respecting hacker would do: I exploited the damn thing myself and showed how it was done.
Re: Disabled at 22 million commits
#105So the author was purposefully trying to do the most extreme thing they could to see how git/GitHub act/break. I don’t blame GH at all. Source: https://web.archive.org/web/20230702215522/https://sh.itjust...
> So the author was purposefully trying to do the most extreme thing they could to see how git/GitHub act/break. This is Hacker News. Hacking is about using, in particular, technology in surprising ways that were not intended by the creators.
Re: Disabled at 22 million commits
#106Earlier quoted context omitted.
"Git stores a copy of the repo" is not an entirely unreasonable inference to draw from "git does not store deltas".
I guess that’s my question: is it? Does that inference pass any kind of smell test with basically any non-toy repo?
Re: Disabled at 22 million commits
#107So the author was purposefully trying to do the most extreme thing they could to see how git/GitHub act/break. I don’t blame GH at all. Source: https://web.archive.org/web/20230702215522/https://sh.itjust...
> So the author was purposefully trying to do the most extreme thing they could to see how git/GitHub act/break. This is Hacker News. Hacking is about using, in particular, technology in surprising ways that were not intended by the creators.
Re: Disabled at 22 million commits
#108Re: Disabled at 22 million commits
#109Earlier quoted context omitted.
Hire them? Why? There’s nothing technically clever or novel here. Anyone can create a shell script to generate random commits and push them. I’d bet even GPT-3.5 could handle that. Why should GitHub hire them?
Right? Let me just write 22 million comments of random garbage on every HN thread, YC will surely hire me for that!
Re: Disabled at 22 million commits
#110Earlier quoted context omitted.
git runs outside of GitHub, which is what the comment you responded to was saying. Test the behavior of git locally, without testing GitHub.
I understood the comment, but that's not what OP was testing. They were doing the commits via merging pull requests. Git has no concept of a pull request and no HTTP API. From the post: > The GitHub API has periodic issues merging/creating PRs. (I use PRs since that is more reliable than keeping a local master up to date via pulling at this point).
You are confidently wrong. Git, including pull requests, was developed years before GitHub ever existed. GitHub borrowed the term from git. Pull requests originally (before GitHub) are requests sent via email that one developer pull changes from another.
https://www.git-scm.com/docs/git-request-pull
The request pull command has been part of git since 2005:
https://github.com/git/git/blob/master/git-request-pull.sh
GitHub launched in 2008.
> and no HTTP API
Also wrong:
https://git-scm.com/book/en/v2/Git-on-the-Server-Smart-HTTP
There is nothing GitHub does with respect to git that you cannot do locally.