Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Disabled at 22 million commits

programming.dev

Post reply on HN
Print view View original

121–130 of 145 posts

Re: Disabled at 22 million commits

#121

Post by rat9988 »

layer8 wrote: post #113
rat9988 wrote: post #27

Earlier quoted context omitted.

It is malicious as he knows he will harm the service to be able to draw whatever conclusion. This is not a case where the end justifies the means.

I don’t think GitHub has been harmed. GitHub did the right thing by having mechanisms to disable repositories before they can cause real harm. The author merely tested out where that to-be-expected limit would be. Arguably, it would be better if GitHub documented an explicit number of supported commits, so that one can know beforehand which usage scenarios the service is suitable for.

And what if github didn't have such mechanism? They should swallow the loss as they should have known better? And more importantly, as they weren't documented, how could the author be certain there is a safeguard and he won't cause any harm?

Re: Disabled at 22 million commits

#122

Post by eyelidlessness »

rewmie wrote: post #117
eyelidlessness wrote: post #102

Earlier quoted context omitted.

They asked with more than passable benefit of the doubt what the user intended. And they asked quite a ways after the user noticed local degradation. “Surprised” might be the wrong term, but it definitely doesn’t seem like a specific guard was in place for the scenario.

Was there a guard needed? I don't think so. It seems GitHub didn't saw any degraded performance and barely noticed the issue, and odds are they presumed the author screwed up with their GitHub actions configuration. Once they determined it was plain old abuse, I'd guess some GitHub employee said "what a moron" and proceeded with his day.

What are you basing this on?

Re: Disabled at 22 million commits

#123

Post by eyelidlessness »

rewmie wrote: post #118
eyelidlessness wrote: post #91

Earlier quoted context omitted.

> There’s nothing technically clever or novel here. Nothing technically novel. But evidently it was at least a somewhat novel stress test execution for GitHub’s live systems, otherwise surely it would have been dealt with sooner and messaged with less benefit of the doubt to the user. Investigating the limitations of something doesn’t have to be novel to be interesting. It’s been a while (I think), but for example th…

> Nothing technically novel. But evidently it was at least a somewhat novel stress test execution for GitHub’s live systems, otherwise surely it would have been dealt with sooner and messaged with less benefit of the doubt to the user. Not really. This is boring stuff, and odds are they never bothered with it because a) it has no impact on operations, b) the blast radius of this doesn't go beyond the attacker's own r…

[flagged]

Re: Disabled at 22 million commits

#124

Post by eyelidlessness »

rat9988 wrote: post #121
layer8 wrote: post #113

Earlier quoted context omitted.

I don’t think GitHub has been harmed. GitHub did the right thing by having mechanisms to disable repositories before they can cause real harm. The author merely tested out where that to-be-expected limit would be. Arguably, it would be better if GitHub documented an explicit number of supported commits, so that one can know beforehand which usage scenarios the service is suitable for.

And what if github didn't have such mechanism? They should swallow the loss as they should have known better? And more importantly, as they weren't documented, how could the author be certain there is a safeguard and he won't cause any harm?

You are almost getting the value of this kind of curiosity!

Re: Disabled at 22 million commits

#125

Post by classified »

apetresc wrote: post #78
eyelidlessness wrote: post #20

Earlier quoted context omitted.

I don’t think the author is trying to insinuate that GitHub is in the wrong in any way. They explicitly say they understand the decision, and anticipated that it would happen. I don’t want to quibble with the term “abuse”, because I think in this scenario it depends on whether intent is a factor and whether we should trust their stated intent. But depending on how you look at it, GitHub would be just as likely to ben…

Hire them? Why? There’s nothing technically clever or novel here. Anyone can create a shell script to generate random commits and push them. I’d bet even GPT-3.5 could handle that. Why should GitHub hire them?

Everyone can make a website and use a database. Did everyone invent AirBnB?

Everyone can drive a car. Did everyone invent Uber?

You're underrating the non-technical factors.

Re: Disabled at 22 million commits

#126

Post by orf »

tedunangst wrote: post #106
orf wrote: post #68

Earlier quoted context omitted.

I guess that’s my question: is it? Does that inference pass any kind of smell test with basically any non-toy repo?

I think one can (and should) look at some real repos to conclude it's not that simple, but if you're simply told it doesn't store diffs, what else would you think it stores?

I would think that either it stores a volume of data that would make it impossible to use… or it it doesn’t.

And if it isn’t impossible to use then I wouldn’t post about how it is.

Re: Disabled at 22 million commits

#127

Post by jstummbillig »

aleph_minus_one wrote: post #72
MBCook wrote: post #9

So the author was purposefully trying to do the most extreme thing they could to see how git/GitHub act/break. I don’t blame GH at all. Source: https://web.archive.org/web/20230702215522/https://sh.itjust...

> So the author was purposefully trying to do the most extreme thing they could to see how git/GitHub act/break. This is Hacker News. Hacking is about using, in particular, technology in surprising ways that were not intended by the creators.

No harm, no foul, because, what, it says "Hacker" in the title? I don't know, are we 12?

The reason that hacking is even a thing: It's actually possible to break things in a responsible, non-destructive way (in contrast to most things in the physical world).

If we skip the responsible part, we are just... breaking things and incurring costs. Why should that be okay?

Re: Disabled at 22 million commits

#128

Post by stiwari »

I'm surprised that a lot of users here are telling OP that he was wrong. OP was well within his rights to do this, as his intention was to stop when any impact is observed, not continue with it. It is within their rights to test the system they want to use to make sure their requirements are met.

To be honest, this is why companies also should not discourage this. Imagine if a malicious group did it with multiple users at the same time. At least now they will have pro active alarms for it.

Re: Disabled at 22 million commits

#129

Post by rat9988 »

eyelidlessness wrote: post #124
rat9988 wrote: post #121

Earlier quoted context omitted.

And what if github didn't have such mechanism? They should swallow the loss as they should have known better? And more importantly, as they weren't documented, how could the author be certain there is a safeguard and he won't cause any harm?

You are almost getting the value of this kind of curiosity!

Now, imagine if you had harmless alternatives. Maybe it will help you expand your thinking.

Re: Disabled at 22 million commits

#130

Post by spiralx »

lucb1e wrote: post #51
tikhonj wrote: post #47

Earlier quoted context omitted.

There's a rough rule of thumb that you should expect to redesign your system to handle each order of magnitude increase in scale, and I figure it applies here too—gracefully handling that size of repo would require substantial engineering work, and they have plenty of time to handle it before human-oriented open source repos get even close to the current limit.

I'm not sure redesigns were necessary between going 1 to 10, from 10 to 100, from 100 to 1000, from 1000 to 10'000, from 10'000 to 100'000, or from 100'000 to 1000'000 which we're now at. It sounds like a sensible engineering rule, but I'm not sure it translates to software, or at least not in this case. I don't know of any design changes made to Git since it was first created, there's no v1 and v2 repositories for e…

It depends on how quickly you pass through each order of magnitude milestone. I remember reading about how MySpace grew something like five orders of magnitude in less than a year, and no matter how scalable your architecture is you're going to hit a point during that where you need to rearchitect your whole system.

Slower growth allows for forward planning and incremental architectural changes.

Post reply on HN