[flagged]
GitHub appears to be struggling with measly three nines availability
101–110 of 255 posts
Re: GitHub appears to be struggling with measly three nines availability
#102ITT lots of complaining, not much building. Microsoft does not give a fuck what you think - they only care if the revenue line goes up. And the revenue line keeps going up despite this instability. Want to build the next unicorn? Build a GitHub competitor.
Re: GitHub appears to be struggling with measly three nines availability
#103Re: GitHub appears to be struggling with measly three nines availability
#104Earlier quoted context omitted.
Public service announcement You can pin actions versions to their hash. Some might say this is a best practice for now. It looks like this, where the comment says where the hash is supposed to point. Old --> uses: actions/checkout@v4 New --> uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 There is a tool to sweep through your repo and automate this: https://github.com/mheap/pin-github-action
The problem is actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 probably doesn’t do this same pinning, and the actions ecosystem is such an intertwined mess that any single compromised action can propagate to the rest
Well, it is a git commit hash of the action repo that contains the transpiled/bundled javascript.
Like: https://github.com/actions/checkout/tree/11bd71901bbe5b1630c...
So I'm pretty sure that for the same commit hash, I'll be executing the same content.
Re: GitHub appears to be struggling with measly three nines availability
#105Earlier quoted context omitted.
Public service announcement You can pin actions versions to their hash. Some might say this is a best practice for now. It looks like this, where the comment says where the hash is supposed to point. Old --> uses: actions/checkout@v4 New --> uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 There is a tool to sweep through your repo and automate this: https://github.com/mheap/pin-github-action
The problem is actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 probably doesn’t do this same pinning, and the actions ecosystem is such an intertwined mess that any single compromised action can propagate to the rest
Yes, true, but at least the fire won't spread through this one point. Hopefully all of your upstreams can be persuaded to pin also.
Re: GitHub appears to be struggling with measly three nines availability
#106While GitHub obsess over shoving AI into everything, the rest of the platform is genuinely crumbling and its security flaws are being abused to cause massive damage. Last week Aqua Security was breached and a few repositories it owns were infected. The threat actors abused widespread use of mutable references in GitHub Actions, which the community has been screaming about for years, to infect potentially thousands of…
Public service announcement You can pin actions versions to their hash. Some might say this is a best practice for now. It looks like this, where the comment says where the hash is supposed to point. Old --> uses: actions/checkout@v4 New --> uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 There is a tool to sweep through your repo and automate this: https://github.com/mheap/pin-github-action
I've always been worried about their backend changing and somehow named tags with a previous commit hash working for an attacker to give something you didn't expect for the commit hash.
Re: GitHub appears to be struggling with measly three nines availability
#107While GitHub obsess over shoving AI into everything, the rest of the platform is genuinely crumbling and its security flaws are being abused to cause massive damage. Last week Aqua Security was breached and a few repositories it owns were infected. The threat actors abused widespread use of mutable references in GitHub Actions, which the community has been screaming about for years, to infect potentially thousands of…
Public service announcement You can pin actions versions to their hash. Some might say this is a best practice for now. It looks like this, where the comment says where the hash is supposed to point. Old --> uses: actions/checkout@v4 New --> uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 There is a tool to sweep through your repo and automate this: https://github.com/mheap/pin-github-action
See also pinact[1], gha-update[2], and zizmor's unpinned-uses[3].
The main desiderata with these kinds of action pinning tools is that they (1) leave a tag comment, (2) leave that comment in a format that Dependabot and/or Renovate understands for bumping purposes, and (3) actually put the full tag in the comment, rather than the cutesy short tag that GitHub encourages people to make mutable (v4.x.y instead of v4).
[1]: https://github.com/suzuki-shunsuke/pinact
Re: GitHub appears to be struggling with measly three nines availability
#108I’m surprised it’s even as high as three nines, at one point in 2025 it was below 90%; not even a single nine.[0] (which, to be fair includes co-pilot, which is the worst of availabilities). People on lobsters a month ago were congratulating Github on achieving a single nine of uptime.[1] I make jokes about putting all our eggs in one basket under the guise of “nobody got fired for buying x; but there are sure a lot…
> These two things can’t be true simultaneously
Sure they can. Perhaps a useful example of something like this would be to consider cryptography. Crypto is ridiculously complex and difficult to do correctly. Most individual developers have no hope of producing good cryptographic code on the same scale and dependability of the big crypto libraries and organizations. At the same time these central libraries and organizations have bugs, mistakes and weaknesses that can and do cause big problems for people. None of that changes the fact that for most developers “rolling your own crypto” is a bad idea.
Re: GitHub appears to be struggling with measly three nines availability
#109Have anyone checked out the status page? It's actually way worse than I thought, I believe this is the first time I am actually witnessing a status page with truly horrible results. https://mrshu.github.io/github-statuses
It looks this bad because that includes 'degraded performance,' not just outrage.
freudian slip
Re: GitHub appears to be struggling with measly three nines availability
#110IPv6 ignorance is the canary. There's plenty of architecture ignorance below the surface. The real question is why aren't they failing annual security audits?
https://docs.github.com/en/enterprise-cloud@latest/organizat...