Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Disabled at 22 million commits

programming.dev

Post reply on HN
Print view View original

111–120 of 145 posts

Re: Disabled at 22 million commits

#111

Post by justinclift »

mabbo wrote: post #85

The author used up so much of github's resources that it impacted other users. 22 million commits is probably enough that something started to hit a linear or n-log-n scaling function, setting off an alarm on some metric. Yeah, you get in trouble for that. I'm reminded of a time in high school where my friend almost got himself banned from the school computers. At home he had dial-up internet (it was 2003 and he live…

Sounds like the network admin and surrounding people had their heads screwed on properly. :)

Re: Disabled at 22 million commits

#112

Post by [deleted] »

rat9988 wrote: post #27
eyelidlessness wrote: post #20

Earlier quoted context omitted.

I don’t think the author is trying to insinuate that GitHub is in the wrong in any way. They explicitly say they understand the decision, and anticipated that it would happen. I don’t want to quibble with the term “abuse”, because I think in this scenario it depends on whether intent is a factor and whether we should trust their stated intent. But depending on how you look at it, GitHub would be just as likely to ben…

It is malicious as he knows he will harm the service to be able to draw whatever conclusion. This is not a case where the end justifies the means.

[deleted]

Re: Disabled at 22 million commits

#113

Post by layer8 »

rat9988 wrote: post #27
eyelidlessness wrote: post #20

Earlier quoted context omitted.

I don’t think the author is trying to insinuate that GitHub is in the wrong in any way. They explicitly say they understand the decision, and anticipated that it would happen. I don’t want to quibble with the term “abuse”, because I think in this scenario it depends on whether intent is a factor and whether we should trust their stated intent. But depending on how you look at it, GitHub would be just as likely to ben…

It is malicious as he knows he will harm the service to be able to draw whatever conclusion. This is not a case where the end justifies the means.

I don’t think GitHub has been harmed. GitHub did the right thing by having mechanisms to disable repositories before they can cause real harm. The author merely tested out where that to-be-expected limit would be.

Arguably, it would be better if GitHub documented an explicit number of supported commits, so that one can know beforehand which usage scenarios the service is suitable for.

Re: Disabled at 22 million commits

#114

Post by layer8 »

mabbo wrote: post #85

The author used up so much of github's resources that it impacted other users. 22 million commits is probably enough that something started to hit a linear or n-log-n scaling function, setting off an alarm on some metric. Yeah, you get in trouble for that. I'm reminded of a time in high school where my friend almost got himself banned from the school computers. At home he had dial-up internet (it was 2003 and he live…

> The author used up so much of github's resources that it impacted other users.

Note that the message only said “the potential to affect other users”. I would expect a professional service to catch such things before it actually affects other users.

Re: Disabled at 22 million commits

#115

Post by layer8 »

iBotPeaches wrote: post #7

> I decided to see how many commits GitHub (and git) could take before acting kind of wonky. At ~19 million commits (and counting) to master: it’s wonky. This just doesn't seem right to me. Why? Its obvious at some point you'll harm the service. If the goal was to test it, why not try locally with git.

> Its obvious at some point you'll harm the service.

That’s not obvious at all. One would expect a professional service to have limits in place to prevent any negative impacts.

Re: Disabled at 22 million commits

#116

Post by rewmie »

eyelidlessness wrote: post #57
adamckay wrote: post #53

Earlier quoted context omitted.

> GitHub would be just as likely to benefit from hiring the author as they would from banning For what purpose? Creating an infinite loop that updates a file and commits it is hardly worthy of a job offer.

They seemed fairly surprised by the fact it happened, and let it go on for some time. Which strongly suggests they hadn’t considered such a load test on their own. If I had a budget/head count, I’d at minimum put out a feeler for a QA role.

> Which strongly suggests they hadn’t considered such a load test on their own.

Not really. GitHub has been around for over a decade. People bother with problems that have a realistic chance of happening. If GitHub didn't bothered to rate limit commits it means it was a potential issue that didn't manifested itself for over a decade.

People tend to bother about problems that happen. Otherwise everyone would be freaking out because of killer asteroids.

Re: Disabled at 22 million commits

#117

Post by rewmie »

eyelidlessness wrote: post #102
sverhagen wrote: post #99

Earlier quoted context omitted.

Where are you reading that they're surprised?

They asked with more than passable benefit of the doubt what the user intended. And they asked quite a ways after the user noticed local degradation. “Surprised” might be the wrong term, but it definitely doesn’t seem like a specific guard was in place for the scenario.

Was there a guard needed? I don't think so. It seems GitHub didn't saw any degraded performance and barely noticed the issue, and odds are they presumed the author screwed up with their GitHub actions configuration. Once they determined it was plain old abuse, I'd guess some GitHub employee said "what a moron" and proceeded with his day.

Re: Disabled at 22 million commits

#118

Post by rewmie »

eyelidlessness wrote: post #91
apetresc wrote: post #78

Earlier quoted context omitted.

Hire them? Why? There’s nothing technically clever or novel here. Anyone can create a shell script to generate random commits and push them. I’d bet even GPT-3.5 could handle that. Why should GitHub hire them?

> There’s nothing technically clever or novel here. Nothing technically novel. But evidently it was at least a somewhat novel stress test execution for GitHub’s live systems, otherwise surely it would have been dealt with sooner and messaged with less benefit of the doubt to the user. Investigating the limitations of something doesn’t have to be novel to be interesting. It’s been a while (I think), but for example th…

> Nothing technically novel. But evidently it was at least a somewhat novel stress test execution for GitHub’s live systems, otherwise surely it would have been dealt with sooner and messaged with less benefit of the doubt to the user.

Not really. This is boring stuff, and odds are they never bothered with it because a) it has no impact on operations, b) the blast radius of this doesn't go beyond the attacker's own repo, c) no moron with time to kill bothered attempting this stunt until now.

Probably now some low-level employee at GitHub needs to add a metric and an alarm to react to rate limits to prevent moron copycats from pulling this stunt for attention-seeking.

Not smart, not clever. Just boring vandalism.

Re: Disabled at 22 million commits

#119

Post by pragmatick »

housemusicfan wrote: post #17
MBCook wrote: post #9

So the author was purposefully trying to do the most extreme thing they could to see how git/GitHub act/break. I don’t blame GH at all. Source: https://web.archive.org/web/20230702215522/https://sh.itjust...

So basically this: https://www.youtube.com/watch?v=1kzb6uf0U0k

This is the most blatant case of false advertising since my suit against the movie The Neverending Story.

Re: Disabled at 22 million commits

#120

Post by jwilk »

aloer wrote: post #81
BeefySwain wrote: post #42

Sidestepping all of the ethical questions of embarking on this "research", I'm surprised the number was that low. Linux[0] itself has about 1.2 million commits, so apparently Linux is within an order of magnitude of bringing GitHub to it's knees? [0] https://github.com/torvalds/linux

iirc remember some years ago the homebrew repo caused too much load due to their architecture where every client would pull on install or update. Or something like that. Part of the GitHub response afaik included the info that they went as far as they could with dedicated and beefier servers but asked for a software fix. I would think that if GitHub anticipates a normal repo growing this large they can give it the sp…

https://github.com/orgs/Homebrew/discussions/226
Post reply on HN