4 ms·

I think the core issue is that anyone can easily create a URL for a file that looks like it was published by the Microsoft team. Instead, if Github uploads use

• kelnos 2y ago
  > looks like it was published by the Microsoft team Right, a simple way to make these URLs seem less associated with the project in question would be to host them at www.githubusercontent.com (a domain they use for other user-generated content, IIRC). I guess current setup includes an easy way to auth access to the files: if you have access to the repo that's right there in the URL, you can download the file; if it's a private repo that you don't have access to, you get a 404/403. That might save them from a separate metadata lookup. This is one of those things that seems obvious now, but I could easily see how this could happen, and that kind of URL structure is something I could see myself devising, thinking it's an elegant way to tie the file to other repo access rules. But really, it's surprising to me that GH keeps around files even if you cancel or delete the comment. Perhaps nowadays they don't need to care that much about storage costs, but back when they added that feature I imagine they might have been more cost-conscious.
  • aprilnya 2y ago
    Those links don’t have auth. If you have one from a private repo you can access it.