4 ms·

Probably because Github is constantly under DDOS attacks, search is computationally expensive, and they can't rate limit unauthenticated sessions. http://m.ther

Probably because Github is constantly under DDOS attacks, search is computationally expensive, and they can't rate limit unauthenticated sessions. http://m.theregister.co.uk/2015/08/26/github_wobbles_under_ddos_attack/ http://m.theregister.co.uk/2015/08/26/github_wobbles_under_d...

jsilence 11y ago
Yeah, probably one of the reasons. I don't understand why one would DDOS Github. What is the reason for that?
- ionforce 11y ago
  Street cred.
- ikeboy 11y ago
  Hosting NYTimes articles critical of China. http://arstechnica.com/security/2015/03/github-battles-largest-ddos-in-sites-history-targeted-at-anti-censorship-tools/ http://arstechnica.com/security/2015/03/github-battles-large...
newjersey 11y ago
Google rate limits unauthenticated sessions. Try using Google over tor. They are pretty heavy-handed about it too. Github isn't tiny enough to use ddos as an excuse.
- caleblloyd 11y ago
  TOR still uses cookies so a session ID can be set for the user agent and rate limited. DDOS scripts create new sessions on every attack request. It's a very hard problem to solve without blocking legitimate traffic too.
  - newjersey 11y ago
    Well, at some point you have to block legitimate traffic. My thought was it doesn't have to be black and white. Maybe require the user to solve a captcha after the nth search from the same IP address? How big are the biggest of botnets? A few hundred thousand computers? Or maybe even require captcha for every unauthenticated search.
    - nso 11y ago
      Millions.
    - EGreg 11y ago
      You mean just for the first one, to get a session id.
  - driverdan 11y ago
    Rate limiting is IP based, not session based.
  - EGreg 11y ago
    Not that difficult! Simply sign your session ids with an HMAC, to verify the id without any I/O! And require something expensive to create a session (such as a hash-based challenge request). Sessions are usually not needed for static sites, so by the time the person searches, their browser will have earned one session. A spammer on the other hand wouldn't have the computational power to create the various sessions. Also, if a spammer's IP is detected, the computational complexity can be increased for that IP.
deleted 11y ago
[deleted]
vc98mvco 11y ago
That cannot be the case, becuse you can still search, it is just missing from the UI: https://news.ycombinator.com/item?id=11322207 https://news.ycombinator.com/item?id=11322207

jsilence 11y ago

Yeah, probably one of the reasons. I don't understand why one would DDOS Github. What is the reason for that?

ionforce 11y ago
Street cred.
ikeboy 11y ago
Hosting NYTimes articles critical of China. http://arstechnica.com/security/2015/03/github-battles-largest-ddos-in-sites-history-targeted-at-anti-censorship-tools/ http://arstechnica.com/security/2015/03/github-battles-large...

newjersey 11y ago

Google rate limits unauthenticated sessions. Try using Google over tor. They are pretty heavy-handed about it too. Github isn't tiny enough to use ddos as an excuse.

caleblloyd 11y ago
TOR still uses cookies so a session ID can be set for the user agent and rate limited. DDOS scripts create new sessions on every attack request. It's a very hard problem to solve without blocking legitimate traffic too.
- newjersey 11y ago
  Well, at some point you have to block legitimate traffic. My thought was it doesn't have to be black and white. Maybe require the user to solve a captcha after the nth search from the same IP address? How big are the biggest of botnets? A few hundred thousand computers? Or maybe even require captcha for every unauthenticated search.
  - nso 11y ago
    Millions.
  - EGreg 11y ago
    You mean just for the first one, to get a session id.
- driverdan 11y ago
  Rate limiting is IP based, not session based.
- EGreg 11y ago
  Not that difficult! Simply sign your session ids with an HMAC, to verify the id without any I/O! And require something expensive to create a session (such as a hash-based challenge request). Sessions are usually not needed for static sites, so by the time the person searches, their browser will have earned one session. A spammer on the other hand wouldn't have the computational power to create the various sessions. Also, if a spammer's IP is detected, the computational complexity can be increased for that IP.

deleted 11y ago

[deleted]

vc98mvco 11y ago

That cannot be the case, becuse you can still search, it is just missing from the UI: https://news.ycombinator.com/item?id=11322207 https://news.ycombinator.com/item?id=11322207