Live data from Hacker News

Disabled at 22 million commits

programming.dev

101–110 of 145 posts

Re: Disabled at 22 million commits

#101

Earlier quoted context omitted.

A more apt analogy, if we didn’t already know the general range where a given single comment thread degrades that thread (analogue to a local repo) and HN overall (analogue to the GH service), writing a bot to answer that specific question. It’s kind of wild that this yielded any new/not-widely-known information at all because it’s such an obvious thing to test. But apparently it raised at least some eyebrows on both…

In load testing there's a difference between testing if something executes as specified versus testing where it breaks. I'm pretty sure that GitHub has tests to validate their performance specification. They may have tests even far in excess of that. They may not have tested where it breaks. They may have had a discussion like: what if someone tries such and such, and their answer may have been: we have good monitori…

Sure, that all makes sense. It’s still true that someone stressing git and GH’s services in this particular way produced information that wasn’t especially redundant. Monitoring was good at catching it, but probably based more on service quality than on the actual thing under stress. Now there’s some data about the thing under stress, and if nothing else that allows some knob turns to calibrate monitoring. And if nothing else, that would more readily catch someone doing the same with nefarious purposes.

Re: Disabled at 22 million commits

#102

Earlier quoted context omitted.

They seemed fairly surprised by the fact it happened, and let it go on for some time. Which strongly suggests they hadn’t considered such a load test on their own. If I had a budget/head count, I’d at minimum put out a feeler for a QA role.

Where are you reading that they're surprised?

They asked with more than passable benefit of the doubt what the user intended. And they asked quite a ways after the user noticed local degradation. “Surprised” might be the wrong term, but it definitely doesn’t seem like a specific guard was in place for the scenario.

Re: Disabled at 22 million commits

#103
post #85

The author used up so much of github's resources that it impacted other users. 22 million commits is probably enough that something started to hit a linear or n-log-n scaling function, setting off an alarm on some metric. Yeah, you get in trouble for that. I'm reminded of a time in high school where my friend almost got himself banned from the school computers. At home he had dial-up internet (it was 2003 and he live…

"somehow" I don't get this attitude. Shit happens, we talk about it, we don't do it again. Not everything needs to have dire consequences.

I think he means "somehow" in the meaning of "somehow, none of the copyright holders asked the school for his information."

Re: Disabled at 22 million commits

#104
post #27

Earlier quoted context omitted.

It is malicious as he knows he will harm the service to be able to draw whatever conclusion. This is not a case where the end justifies the means.

The first time I wrote and shared any kind of interactive code, it took approximately five minutes for someone to XSS it. At the time, I was pretty miffed too. After a polite explanation that the “abuse” was curiosity about defensive measures I’d taken, I understood pretty suddenly that there was a whole scope of programming I hadn’t even considered. More than 20 years later, I still remember the enormous benefit tha…

I’ll add one more anecdote while I’m at it.

At a previous job I was aware of a potential vulnerability, voiced it rather loudly, but had a hard time getting the attention it deserved until I recognized it happened to coincide with a really high profile business-critical bug. I only recognized it because some jerks had previously fucked with much less important stuff under my purview, and I wanted very much to understand how they did it, and learned quite a bit by wanting to know.

I used those developed instincts to unfuck what would have otherwise resulted in at least contract terminations, if not lawsuits. And the recognition allowed me to correct almost every compromised datum, which also guarded every contractee from challenges to their license status and ultimately whether they could be subject to wholly different jurisdictional context.

I’m not going to disclose the nature of the vulnerability but the way the bug presented was time deltas based on time zone configuration. Hardly a novel problem, but nearly put a whole industry into peril and or conflict. Definitely was worth the attention.

And when communicating the problem suffered, I did what any self respecting hacker would do: I exploited the damn thing myself and showed how it was done.

Re: Disabled at 22 million commits

#105
post #9

So the author was purposefully trying to do the most extreme thing they could to see how git/GitHub act/break. I don’t blame GH at all. Source: https://web.archive.org/web/20230702215522/https://sh.itjust...

> So the author was purposefully trying to do the most extreme thing they could to see how git/GitHub act/break. This is Hacker News. Hacking is about using, in particular, technology in surprising ways that were not intended by the creators.

[deleted]

Re: Disabled at 22 million commits

#106
post #68

Earlier quoted context omitted.

"Git stores a copy of the repo" is not an entirely unreasonable inference to draw from "git does not store deltas".

I guess that’s my question: is it? Does that inference pass any kind of smell test with basically any non-toy repo?

I think one can (and should) look at some real repos to conclude it's not that simple, but if you're simply told it doesn't store diffs, what else would you think it stores?

Re: Disabled at 22 million commits

#107
post #9

So the author was purposefully trying to do the most extreme thing they could to see how git/GitHub act/break. I don’t blame GH at all. Source: https://web.archive.org/web/20230702215522/https://sh.itjust...

> So the author was purposefully trying to do the most extreme thing they could to see how git/GitHub act/break. This is Hacker News. Hacking is about using, in particular, technology in surprising ways that were not intended by the creators.

[flagged]

Re: Disabled at 22 million commits

#109

Earlier quoted context omitted.

Hire them? Why? There’s nothing technically clever or novel here. Anyone can create a shell script to generate random commits and push them. I’d bet even GPT-3.5 could handle that. Why should GitHub hire them?

Right? Let me just write 22 million comments of random garbage on every HN thread, YC will surely hire me for that!

Alarmingly close to the secret criteria, Paul - he's the one.

Re: Disabled at 22 million commits

#110
post #41
post #36

Earlier quoted context omitted.

git runs outside of GitHub, which is what the comment you responded to was saying. Test the behavior of git locally, without testing GitHub.

I understood the comment, but that's not what OP was testing. They were doing the commits via merging pull requests. Git has no concept of a pull request and no HTTP API. From the post: > The GitHub API has periodic issues merging/creating PRs. (I use PRs since that is more reliable than keeping a local master up to date via pulling at this point).

> Git has no concept of a pull request.

You are confidently wrong. Git, including pull requests, was developed years before GitHub ever existed. GitHub borrowed the term from git. Pull requests originally (before GitHub) are requests sent via email that one developer pull changes from another.

https://www.git-scm.com/docs/git-request-pull

The request pull command has been part of git since 2005:

https://github.com/git/git/blob/master/git-request-pull.sh

GitHub launched in 2008.

> and no HTTP API

Also wrong:

https://git-scm.com/book/en/v2/Git-on-the-Server-Smart-HTTP

There is nothing GitHub does with respect to git that you cannot do locally.

Post reply on HN