6 ms·

Recently, I was browsing an open source project I use a lot. "Sign in to search code on GitHub" was kinda discouraging to see. Sure, I can clone it and run gre

Recently, I was browsing an open source project I use a lot. "Sign in to search code on GitHub" was kinda discouraging to see. Sure, I can clone it and run grep/ripgrep - but sometimes I like the ability to search the code on the browser. Is it only GitHub where this is a restriction or GitLab is similar?

eblume 2y ago
It's worth mentioning here I think that github's code search is really quite good. I'm not trying to say that github can do no harm or that github "owning" OSS code hosting is a good thing, but the github search bar is a utility that IMO is worth the price of admission. I think that sourcegraph maintains a similar quality OSS code search that can be searched for free but I have not personally used it.
- nicce 2y ago
  Interesting blog about how it works: https://github.blog/engineering/the-technology-behind-githubs-new-code-search/ https://github.blog/engineering/the-technology-behind-github...
- AlotOfReading 2y ago
  The problem is that GH makes it the login process as painful as possible. Login tokens expire frequently, necessitating new logins. Logins require 2fa every time, which makes them extremely flow-breaking. Post-login you're not returned to the file you were on, so now you need to navigate back to search. Logins are per domain and per device, so I end up dealing with this 4x per day if I'm using GitHub heavily. It's unnecessary.
  - aseipp 2y ago
    To me, ordinary login is one of the things they've genuinely improved over time I feel? I absolutely never deal with logins more than once a day per machine? With stuff like Passkey support now, I basically click two buttons in 1Pass and I'm logged in instantly on ~everywhere. I also feel like I never have my tokens expire. I'm probably not doing the same stuff as you. It's sudo/elevated mode that really gets you I think, if you have no fast flow. Admittedly I don't add keys or anything like that very often.
    - AlotOfReading 2y ago
      GH Enterprise and public GH don't share tokens, so 1 login/day automatically becomes 2. Then, logins aren't shared across devices and 2 additional devices (phone and personal computer) makes 4 logins/day. Not sure why GitHub expires tokens so quickly, but I can replicate it across every device I own and multiple accounts. Maybe they just don't like me?
      - samcat116 2y ago
        I have never experienced this. I almost never have to log in after the initial login.
      - LtWorf 2y ago
        It's to be more secure! Of course then you can do everything with your never expiring ssh keys and application tokens… but that doesn't count :D
      - aseipp 2y ago
        Yeah. I think they just don't like you. I log in probably once every 3 months or something, on every device. Nowhere close to every day. Can I ask what country you're from? Maybe that has something to do with it?
  - _lvbh 2y ago
    What? My login tokens haven’t expired in years. I don’t think I’ve had to sign in twice on the same computer ever
  - plorkyeran 2y ago
    This is not at all my experience with Github? I go through the 2fa flow maybe once a year, if that. I have to go through the SSO flow for my employer's private repositories once a day (which is my employer's policy, not Github's), but that properly redirects to the page I was trying to access. Does your employer have a SSO flow that requires 2fa every time and doesn't redirect properly afterwards? That would be pretty annoying, but it's not Github's fault.
    - AlotOfReading 2y ago
      Happens even with my personal GitHub account across multiple browsers/operating systems.
      - Alupis 2y ago
        Counter-anecdote. I cannot even remember the last time I was asked to log into Github, at the office, at home, on my laptop, and even on my phone. Do you perhaps have a browser setting that nukes cookies/session data by any chance? Or perhaps use a VPN that might be tripping some sort of account protection mechanism?
        mh- 2y ago
        Counter-counter, I share his experience as well and don't have any of those things. Just bog standard Chrome with no extensions. What I do have, and I expect is relevant: frequent ~weeklong gaps where I don't access GitHub at all in this browser profile. I assume there's some medium-lived token that's refreshed when you access the site.
        jaktet 2y ago
        My experience is similar to yours, though I seem to have to login every other week or so it feels like (maybe it’s once a month I don’t know). This feeling could also be exasperated though since while I only use a personal GitHub account, I access it frequently from the browser and app on numerous devices. I can definitively say though that I need to login more than twice a year on any one device.
  - kelnos 2y ago
    That's strange; I've been logged in to GitHub without having to re-log-in for.... a year or two now? I cannot remember the last time I had to log in. Maybe I visit the site more often, though, and that has something to do with it? Or the network you visit from is for some reason flagged as high-risk?
aseipp 2y ago
There are some alternatives like https://grep.app https://grep.app or https://sourcegraph.com/search https://sourcegraph.com/search if you want fast live search, but at the end of the day these are services offered by companies, and rather expensive ones especially for free anonymous users, so you should probably at least accept that service providers can and do change things like this. You can also run something like your own copy of Zoekt and then ingest repositories on demand though it isn't quite as instant. But if it's code you're already using extensively, it seems like it might be worth it. Maybe you can write some boondoggle to automatically ingest repos based on dependency metadata, even.
- amiga386 2y ago
  Github managed to provided search to free anonymous users since its inception in 2007, to mid-2023 when they introduced this new code search. I would submit that this change is entirely business-related: it's a power-play to make people create accounts and stay logged in so they can track you better. It is not that they cannot afford it, it is that they are enshittifying the service to further their interests. If they were really worried about money, they could lock it down completely so only paying customers could use the service at all... and then they'd lose a huge chunk of customers and lose all the prestige they build in convincing a huge pile of the world's free/open source software to use them as their hosting. So they don't do that - they keep all the prestige and the network effects by seeming _quite_ open, but they'll lock down _parts_ of the experience to try and force specific behaviour. > you should probably at least accept that service providers can and do change things like this. Indeed, you should. It should serve as a wake-up call that other people's services/platforms aren't under your control, and you can't rely on them to meet your needs.
  - ZoomerCretin 2y ago
    > it's a power-play to make people create accounts and stay logged in so they can track you better Github doesn't even serve ads. What exactly are you worried about? Your throwaway email being primary key #78,000,000 and having your visited repositories stored in another table?
nicce 2y ago
> Is it only GitHub where this is a restriction or GitLab is similar? GitLab has had this long time.
PhilipRoman 2y ago
I believe it was added when they made their search more advanced and presumably more resource intensive.
- amiga386 2y ago
  And yet, nothing stops them from continuing to offer their existing search to anonymous users. The search they have offered since inception. They chose to take the existing search away from anonymous users to drive signups and logins. "Sign up and log in to get improved search" is not as compelling as "sign up and log in to get any search at all"
corytheboyd 2y ago
Do you have to be logged in to open a repo with the web version of vscode on GitHub? If not, that could make for a Good Enough search interface. Try pressing `.` on a repo page to see if it works
magnio 2y ago
You can change github.com to github1s.com to get VSCode in browser with fairly capable search without logging in. E.g. https://github1s.com/nginx/nginx https://github1s.com/nginx/nginx
- nullify88 2y ago
  Alternatively the official site is vscode.dev.
  - bityard 2y ago
    That requires you to sign into github to open a github repo, which is what the OP was trying to avoid.
  - KTibow 2y ago
    Or github.dev
- oefrha 2y ago
  I believe the search there uses Sourcegraph, so you can also search directly at https://sourcegraph.com/search https://sourcegraph.com/search. E.g. https://sourcegraph.com/search?q=repo:github.com/nginx/nginx+worker_connections&patternType=keyword&sm=0 https://sourcegraph.com/search?q=repo:github.com/nginx/nginx...
radicality 2y ago
This thread from 9 months ago has a bunch of discussion on this. https://news.ycombinator.com/item?id=38432261 https://news.ycombinator.com/item?id=38432261
zaik 2y ago
If you find searching locally cumbersome, you should know that you can do a "shallow" git clone which only downloads the most recent commit and is much faster than cloning the whole repo. git clone --depth 1 ...

eblume 2y ago

It's worth mentioning here I think that github's code search is really quite good. I'm not trying to say that github can do no harm or that github "owning" OSS code hosting is a good thing, but the github search bar is a utility that IMO is worth the price of admission. I think that sourcegraph maintains a similar quality OSS code search that can be searched for free but I have not personally used it.

nicce 2y ago
Interesting blog about how it works: https://github.blog/engineering/the-technology-behind-githubs-new-code-search/ https://github.blog/engineering/the-technology-behind-github...
AlotOfReading 2y ago
The problem is that GH makes it the login process as painful as possible. Login tokens expire frequently, necessitating new logins. Logins require 2fa every time, which makes them extremely flow-breaking. Post-login you're not returned to the file you were on, so now you need to navigate back to search. Logins are per domain and per device, so I end up dealing with this 4x per day if I'm using GitHub heavily. It's unnecessary.
- aseipp 2y ago
  To me, ordinary login is one of the things they've genuinely improved over time I feel? I absolutely never deal with logins more than once a day per machine? With stuff like Passkey support now, I basically click two buttons in 1Pass and I'm logged in instantly on ~everywhere. I also feel like I never have my tokens expire. I'm probably not doing the same stuff as you. It's sudo/elevated mode that really gets you I think, if you have no fast flow. Admittedly I don't add keys or anything like that very often.
  - AlotOfReading 2y ago
    GH Enterprise and public GH don't share tokens, so 1 login/day automatically becomes 2. Then, logins aren't shared across devices and 2 additional devices (phone and personal computer) makes 4 logins/day. Not sure why GitHub expires tokens so quickly, but I can replicate it across every device I own and multiple accounts. Maybe they just don't like me?
    - samcat116 2y ago
      I have never experienced this. I almost never have to log in after the initial login.
    - LtWorf 2y ago
      It's to be more secure! Of course then you can do everything with your never expiring ssh keys and application tokens… but that doesn't count :D
    - aseipp 2y ago
      Yeah. I think they just don't like you. I log in probably once every 3 months or something, on every device. Nowhere close to every day. Can I ask what country you're from? Maybe that has something to do with it?
- _lvbh 2y ago
  What? My login tokens haven’t expired in years. I don’t think I’ve had to sign in twice on the same computer ever
- plorkyeran 2y ago
  This is not at all my experience with Github? I go through the 2fa flow maybe once a year, if that. I have to go through the SSO flow for my employer's private repositories once a day (which is my employer's policy, not Github's), but that properly redirects to the page I was trying to access. Does your employer have a SSO flow that requires 2fa every time and doesn't redirect properly afterwards? That would be pretty annoying, but it's not Github's fault.
  - AlotOfReading 2y ago
    Happens even with my personal GitHub account across multiple browsers/operating systems.
    - Alupis 2y ago
      Counter-anecdote. I cannot even remember the last time I was asked to log into Github, at the office, at home, on my laptop, and even on my phone. Do you perhaps have a browser setting that nukes cookies/session data by any chance? Or perhaps use a VPN that might be tripping some sort of account protection mechanism?
      - mh- 2y ago
        Counter-counter, I share his experience as well and don't have any of those things. Just bog standard Chrome with no extensions. What I do have, and I expect is relevant: frequent ~weeklong gaps where I don't access GitHub at all in this browser profile. I assume there's some medium-lived token that's refreshed when you access the site.
        jaktet 2y ago
        My experience is similar to yours, though I seem to have to login every other week or so it feels like (maybe it’s once a month I don’t know). This feeling could also be exasperated though since while I only use a personal GitHub account, I access it frequently from the browser and app on numerous devices. I can definitively say though that I need to login more than twice a year on any one device.
- kelnos 2y ago
  That's strange; I've been logged in to GitHub without having to re-log-in for.... a year or two now? I cannot remember the last time I had to log in. Maybe I visit the site more often, though, and that has something to do with it? Or the network you visit from is for some reason flagged as high-risk?

aseipp 2y ago

There are some alternatives like https://grep.app https://grep.app or https://sourcegraph.com/search https://sourcegraph.com/search if you want fast live search, but at the end of the day these are services offered by companies, and rather expensive ones especially for free anonymous users, so you should probably at least accept that service providers can and do change things like this. You can also run something like your own copy of Zoekt and then ingest repositories on demand though it isn't quite as instant. But if it's code you're already using extensively, it seems like it might be worth it. Maybe you can write some boondoggle to automatically ingest repos based on dependency metadata, even.

amiga386 2y ago
Github managed to provided search to free anonymous users since its inception in 2007, to mid-2023 when they introduced this new code search. I would submit that this change is entirely business-related: it's a power-play to make people create accounts and stay logged in so they can track you better. It is not that they cannot afford it, it is that they are enshittifying the service to further their interests. If they were really worried about money, they could lock it down completely so only paying customers could use the service at all... and then they'd lose a huge chunk of customers and lose all the prestige they build in convincing a huge pile of the world's free/open source software to use them as their hosting. So they don't do that - they keep all the prestige and the network effects by seeming _quite_ open, but they'll lock down _parts_ of the experience to try and force specific behaviour. > you should probably at least accept that service providers can and do change things like this. Indeed, you should. It should serve as a wake-up call that other people's services/platforms aren't under your control, and you can't rely on them to meet your needs.
- ZoomerCretin 2y ago
  > it's a power-play to make people create accounts and stay logged in so they can track you better Github doesn't even serve ads. What exactly are you worried about? Your throwaway email being primary key #78,000,000 and having your visited repositories stored in another table?

nicce 2y ago

> Is it only GitHub where this is a restriction or GitLab is similar? GitLab has had this long time.

PhilipRoman 2y ago

I believe it was added when they made their search more advanced and presumably more resource intensive.

amiga386 2y ago
And yet, nothing stops them from continuing to offer their existing search to anonymous users. The search they have offered since inception. They chose to take the existing search away from anonymous users to drive signups and logins. "Sign up and log in to get improved search" is not as compelling as "sign up and log in to get any search at all"

corytheboyd 2y ago

Do you have to be logged in to open a repo with the web version of vscode on GitHub? If not, that could make for a Good Enough search interface. Try pressing `.` on a repo page to see if it works

magnio 2y ago

You can change github.com to github1s.com to get VSCode in browser with fairly capable search without logging in. E.g. https://github1s.com/nginx/nginx https://github1s.com/nginx/nginx

nullify88 2y ago
Alternatively the official site is vscode.dev.
- bityard 2y ago
  That requires you to sign into github to open a github repo, which is what the OP was trying to avoid.
- KTibow 2y ago
  Or github.dev
oefrha 2y ago
I believe the search there uses Sourcegraph, so you can also search directly at https://sourcegraph.com/search https://sourcegraph.com/search. E.g. https://sourcegraph.com/search?q=repo:github.com/nginx/nginx+worker_connections&patternType=keyword&sm=0 https://sourcegraph.com/search?q=repo:github.com/nginx/nginx...

radicality 2y ago

This thread from 9 months ago has a bunch of discussion on this. https://news.ycombinator.com/item?id=38432261 https://news.ycombinator.com/item?id=38432261

zaik 2y ago

If you find searching locally cumbersome, you should know that you can do a "shallow" git clone which only downloads the most recent commit and is much faster than cloning the whole repo. git clone --depth 1 ...