13 ms·
Updated rate limits for unauthenticated requests
https://github.com/orgs/community/discussions/159123 https://github.com/orgs/community/discussions/159123
https://github.com/orgs/community/discussions/157887 https://github.com/orgs/community/discussions/157887
- deleted 1y ago[deleted]
- gnabgib 1y ago60 req/hour for unauthenticated users 5000 req/hour for authenticated - personal 15000 req/hour for authenticated - enterprise org According to https://docs.github.com/en/rest/using-the-rest-api/rate-limits-for-the-rest-api?apiVersion=2022-11-28 https://docs.github.com/en/rest/using-the-rest-api/rate-limi... I bump into this just browsing a repo's code (unauth).. seems like it's one of the side effects of the AI rush.
- usernamed7 1y ago1 request a minute?!? wow that's just absurd you get it for just looking through code.
- out-of-ideas 1y agoagreed. when i first read the title i thought "oh what did the they up the rates to" - then i realized its more of a "downgraded rate limits" thanks github for the worse experience
- rendaw 1y agoI opened a repo in a spare computer browser and clicked on a couple things and got a rate limit error. It feels effectively unusable unless you're logged in now (couldn't search from before, now you can't even browse).
- mijoharas 1y agoWhy would the changelog update not include this? it's the most salient piece of information. I thought I was just misreading it and failing to see where they stated what the new rate limits were, since that's what anyone would care about when reading it.
- 1oooqooq 1y agobecause it will go way lower soon. and because they don't have to. they already have all your code. they've won.
- naikrovek 1y agoyou are not ... you don't have any part of your body in reality, do you? you have left the room. If people training LLMs are excessively scraping GitHub, it is well within GitHub's purview to limit that activity. It's their site and it's up to them to make sure that it stays available. If that means that they curtail the activity of abusive users, then of course they're going to do that.
- 1oooqooq 1y agoit was never about avoid scrapers. that's just the excuse. they own the scrapers too, remember. why do you think before they blocked non logged in users from even searching? they need your data and they are getting it exactly in their terms. because as I've said, they have already won.
- sebmellen 1y agoEmbrace, extend, extinguish.
- naikrovek 1y ago… I… what has been embraced, extended and extinguished? I see no MS or GitHub specific extension, here. Copilot exists, and so do many other tools. Copilot can use lots of non-Microsoft models, too, including models from non-Microsoft companies. You can also get git repository hosting from other companies. You can even do it yourself. So, explain yourself. What has been embraced, extended, and extinguished? Be specific. No “vibes”. Cite your sources or admit you have none. I see no extending unique to MS and I see no extinguishing. So explain yourself.
- blinker21 1y agoI've hit this over the past week browsing the web UI. For some reason, github sessions are set really short and you don't realise you're not logged in until you get the error message. I really wish github would stop logging me out.
- Novosell 1y agoHmmmm, Github keeps me logged in for months I feel like. Unless I'm misunderstanding the github security logs, my current login is since march.
- 1oooqooq 1y agoGH is Microsoft's most successful social network. GH now uses the publisher business model, and as such, they lose money when you're logged out. same reason why google, fb, etc will not ask you for a password for decades.
- zarzavat 1y agoYes, it's not the rate limits that are the problem per se but GitHub's tendency to log you out and make you go through 2fa. If they would let me stay logged in for a year then I wouldn't care so much.
- tux3 1y agoYou might be afflicted with some SSO or enterprise thing, I haven't logged into Github on my personal account in years.
- zarzavat 1y agoNope, just normal GitHub account. Though GitHub did force me to use 2fa earlier because they said I have a "popular repo", so perhaps my account is considered high risk. Or maybe it's triggered by travelling and changing IP locations? I have no clue, but it's annoying to have to 2fa more than once in a blue moon.
- 1y ago
- ikiris 1y ago1/min? That’s insanely low.
- notatoad 1y ago60/hr is not the same as 1/min, unless you're trying to continually make as many requests as possible, like a crawler. and if that is for your use case, then your traffic is probably exactly what they're trying to block.
- zarzavat 1y ago60/h is obviously well within normal human usage of an app and not bot traffic... A normal rate limit to separate humans and bots would be something like 60 per minute. So it's about an order of magnitude too low.
- mjevans 1y agoUse case: crawling possibly related files based on string search hints in a repo you know nothing about... Something on the order of 6 seconds a page doesn't sound TOO out of human viewing range depending on how quickly things load and how fast rejects are identified. I could see ~10 pages / min which is 600 pages / hour. I could also see the argument that a human would get tired at that rate and something closer to 200-300 / hr is reasonable.
- hansvm 1y agoAll of that assuming they're limiting based on human-initiated requests, not the 100x requests actually generated when you click a link.
- jakebasile 1y agoI bump into these limits just using a few public install scripts for things like Atuin, Babashka, and Clojure on a single machine on my home IP. They're way too low to be reasonable.
- pogue 1y agoI assume they're trying to keep ai bots from strip mining the whole place. Or maybe your IP/browser is questionable.
- tostr 1y ago*other ai bots, ms will obviously mine anything on there. Personally, I like sourcehut (sr.ht)
- immibis 1y agoSame way Reddit sells all its content to Google, then stops everyone else from getting it. Same way Stack Overflow sells all its content to Google, then stops everyone else from getting it. (Joke's on Reddit, though, because Reddit content became pretty worthless since they did this, and everything before they did this was already publicly archived)
- voidnap 1y agoI encountered this on github last week. Very agressive rate limiting. My browser and IP is very ordinary. Since Microsoft is struggling to make ends meet, maybe they could throw a captcha or proof of work like Anubis by xe iaso. They already disabled code search for unauthenticated users. Its totally plausible they will disable code browsing as well.
- kstrauser 1y agoThat hit me, too. I thought it was an accidental bug and didn’t realize it was actually malice.
- miohtama 1y agoJust sign in if it's an issue for your usage.
- voidnap 1y agoMy usage isn't high. I was rate limited to like 5 requests per minute. It was a repo with several small files. And seriously if they keep this up, with limits on their web interface but leave unauthenticated cloning allowed, I'd rather clone the repo than log in. GitHub code browsing went south since microsoft bought them anyway. Having a simple proxy that clones a repo and serves it would solve problems with rate limits and their awful UX.
- jarofgreen 1y agoAlso https://github.com/orgs/community/discussions/157887 https://github.com/orgs/community/discussions/157887 "Persistent HTTP 429 Rate Limiting on *.githubusercontent.com Triggered by Accept-Language: zh-CN Header" but the comments show examples with no language headers. I encountered this too once, but thought it was a glitch. Worrying if they can't sort it.
- watermelon0 1y agoTime for Mozilla (and other open-source projects) to move repositories to sourcehut/Codeberg or self-hosted Gitlab/Forgejo?
- radicality 1y agoJust tried it on chrome incognito on iOS and do hit this 429 rate limit :S That sucks, it’s already bad enough when GitHub started enforcing login to even do a simple search.
- Euphorbium 1y agoI remember getting this error a few months ago, this does not seem like a temporary glitch. They dont want llm makers to slurp all the data.
- new_user_final 1y agoIsn't git clone faster than browsing web?
- PaulDavisThe1st 1y agoYep. But AI trawlers don't use it. Ask them why.
- jopsen 1y agoDo we know it's AI trawlers? And not just generally degenerate bots? Or just one evil bot network?
- PaulDavisThe1st 1y agoIs there any difference between those 3?
- jarofgreen 1y agohttps://github.com/orgs/community/discussions/157887 https://github.com/orgs/community/discussions/157887 This has been going on for weeks and is clearly not a simple mistake.
- Zdh4DYsGvdjJ 1y agoThis was announced https://github.blog/changelog/2025-05-08-updated-rate-limits-for-unauthenticated-requests/ https://github.blog/changelog/2025-05-08-updated-rate-limits...
- croes 1y agoDoesn‘t make it any better. Collateral damage of AI I guess
- formerly_proven 1y agoIt's even more hilarious because this time it's Microsoft/Github getting hit by it. (It's funny because MS themselves are such a bad actor when it comes to AIAIAI).
- fragmede 1y agoThis is the same Microsoft that owns LinkedIn which got sued by HiQ which is where the ruling came from that is making sites login required.
- dang 1y ago(This was originally posted as a reply to https://news.ycombinator.com/item?id=43981344 https://news.ycombinator.com/item?id=43981344 but we're merging the threads)
- micw 1y agoSee also: https://github.com/orgs/community/discussions/159123 https://github.com/orgs/community/discussions/159123
- deleted 1y ago[deleted]
- TheNewsIsHere 1y agoI don’t think the publication date (May 8, as I type this) on the GitHub blog article is the same date this change became effective. From a long-term, clean network I have been consistently seeing these “whoa there!” secondary rate limit errors for over a month when browsing more than 2-3 files in a repo. My experience has been that once they’ve throttled your IP under this policy, you cannot even reach a login page to authenticate. The docs direct you to file a ticket (if you’re a paying customer, which I am) if you consistently get that error. I was never able to file a ticket when this happened because their rate limiter also applies to one of the required backend services that the ticketing system calls from the browser. Clearly they don’t test that experience end to end.
- gs17 1y agoMaybe they expect you to file the ticket from a different IP.
- xnx 1y agoIt sucks that we've collectively surrendered the urls to our content to centralized services that can change their terms at any time without any control. Content can always be moved, but moving the entire audience associated with a url is much harder.
- turblety 1y agoGitea [1] is honestly awesome and lightweight. I've been running my own for years, and since they've put Actions in a while ago (with GitHub compatibility) it does everything I need it to. It doesn't have all the AI stuff in it (but for some that's a positive :P) 1. https://about.gitea.com/ https://about.gitea.com/
- kstrauser 1y agoGitea’s been great, but I think a lot of its development has moved to Forgejo: https://forgejo.org/ https://forgejo.org/ That’s what I run on my personal server now.
- TheNewsIsHere 1y agoI’ve almost completed the move of my business from GitHub’s corporate offering to self-hosted Forgejo. Almost went with Gitea, but the ownership structure is murky, feature development seems to have plateaued, and they haven’t even figured out how to host their own code. It’s still all on GitHub. I’ve been impressed by Forgejo. It’s so much faster than Github to perform operations, I can actually backup my entire corpus of data in a format that’s restorable/usable, and there aren’t useless (AI) upsells cluttering my UX.
- kstrauser 1y agoI agree with every word of that. For listeners at home wondering why you'd want that at all: I want a centralized Git repo where I can sync config files from my various machines. I have a VPS so I just create a .git directory and start using SSH to push/pull against it. Everything works! But then, my buddy wants to see some of my config files. Hmm. I can create an SSH user for him and then set the permissions on that .git to give him read-only access. Fine. That works. Until he improves some of them. Hey, can I give him a read-write repo he can push a branch to? Um, sure, give me a bit to think this through... And one of his coworkers thinks this is fascinating and wants to look, too. Do I create an SSH account for this person I don't know well at all? At this point, I've done more work than just installing something like Forgejo and letting my friend and his FOAF create accounts on it. There's a nice UI for configuring their permissions. They don't have SSH access directly into my server. It's all the convenience of something like GitHub, except entirely under my control and I don't have to pay for private repos.
- InfiniteLoup 1y agoHow would this affect Go dependencies?
- athorax 1y agoGo doesn't pull dependencies directly from GitHub, they are pulled from https://proxy.golang.org/ https://proxy.golang.org/ by default
- jorams 1y ago> These changes will apply to operations like cloning repositories over HTTPS, anonymously interacting with our REST APIs, and downloading files from raw.githubusercontent.com. Or randomly when clicking through a repository file tree. The first time I hit a rate limit was when I was skimming through a repository on my phone, and about the 5th file I clicked I was denied and locked out. Not for a few seconds either, it lasted long enough that I gave up on waiting then refreshing every ~10 seconds.
- zX41ZdbW 1y agoThis can affect hosting databases in GitHub repositories. Yes, it does not look like an intended service usage, but I used it for a demo: https://github.com/ClickHouse/web-tables-demo/ https://github.com/ClickHouse/web-tables-demo/ Anyway, will try to do the same with GitHub pages :)
- PaulDavisThe1st 1y agoSeveral people in the comments seem to be blaming Github for taking this step for no apparent reason. Those of us who self-host git repos know that this is not true. Over at ardour.org, we've passed the 1M-unique-IP's banned due to AI trawlers sucking our repository 1 commit at a time. It was killing our server before we put fail2ban to work. I'm not arguing that the specific steps Github have taken are the right ones. They might be, they might not, but they do help to address the problem. Our choice for now has been based on noticing that the trawlers are always fetching commits, so we tweaked things such that the overall http-facing git repo works, but you cannot access commit-based URLs. If you want that, you need to use our github mirror :)
- londons_explore 1y agoSurely most AI trawlers have special support for git and just clone the repo once?
- Macha 1y agoThe AI companies could do work or they could not do work. They've pretty widely chosen to not do work and just slam websites from proxy IPs instead. You would think their products would be used by them to do the work if they worked as well as advertised...
- NBJack 1y agoApparently, the vibe coding session didn't account for it. /s I would more readily assume a large social networking company filled with bright minds would have worked out some kind of agreement on, say, a large corpus of copyrighted training data before using it. It's the wild wild west right now. Data is king for AI training.
- ikiris 1y agoI think you vastly overestimate the average dev and their care for handling special cases that are mostly other people’s aggregate problem.
- 1y ago
- trallnag 1y agoGood that tools like Homebrew that heavily rely on GitHub usually support environment variables like GITHUB_TOKEN
- stevekemp 1y agoOnce again people post in the "community", but nobody official replies; these discussion-pages are just users shouting into the void.
- Zdh4DYsGvdjJ 1y agoGitHub answered https://github.com/orgs/community/discussions/159123#discussioncomment-13148279 https://github.com/orgs/community/discussions/159123#discuss...
- thih9 1y agoWhat does “secondary” stand for here in the error message? > You have exceeded a secondary rate limit. Edit and self-answer: > In addition to primary rate limits, GitHub enforces secondary rate limits (…) > These secondary rate limits are subject to change without notice. You may also encounter a secondary rate limit for undisclosed reasons. https://docs.github.com/en/rest/using-the-rest-api/rate-limits-for-the-rest-api?apiVersion=2022-11-28#about-secondary-rate-limits https://docs.github.com/en/rest/using-the-rest-api/rate-limi...
- jrochkind1 1y agoDid I miss where it says what the new rate limits are? Or are they secret?
- jrochkind1 1y agoWow, I'm realizing this applies to even browsing files in the web UI without being logged in, and the limits are quite low? This rather significantly changes the place of github hosted code in the ecosystem. I understand it is probably a response to the ill-behaved decentralized bot-nets doing mass scraping with cloaked user-agents (that everyone assumes is AI-related, but I think it's all just speculation and it's quite mysterious) -- which is affecting most of us. The mystery bot net(s) are kind of destroying the open web, by the counter-measures being chosen.
- spacephysics 1y agoProbably to throttle scraping from AI competitors, and have them pay for the privilege as many other services have been doing
- jhgg 1y agoThe truth is this won't actually stop AI crawlers and they'll just move to a large residential proxy pool to work around it. Not sure what the solution is honestly.
- dmitrygr 1y agoCriminal charges under CFAA to actual CEOs of actual companies doing this, with long jail terms.
- latentsea 1y agoI don't know if I ever recall seeing a CEO go to jail for practically anything, ever. I'm sure there are lots of examples, but at this point in my life I have kind of derived a rule of thumb of "if you want to commit a crime, just disguise it as a legitimate business" based off seeing so many times where CEOs get off scott free .
- simoncion 1y agoFWIW, Joseph Nacchio (the CEO of Qwest Communications) went to jail for like a decade for refusing to help the NSA violate FISA circa 2001.
- umbra07 1y agoHe went to jail because he refused to help the NSA violate FISA, and then he sold the stock knowing that his refusal would cause the stock to drop (i.e. insider trading). His conviction was entirely on the basis of insider trading. The SEC went after him, not the NSA or DOJ or whatever.
- dragonwriter 1y ago> His conviction was entirely on the basis of insider trading. The SEC went after him, not the NSA or DOJ or whatever. The SEC has no criminal prosecution powers; all they can do in that regard is write a note asking the DOJ to pretty-please look into something. The only way to get a federal (civilian) criminal conviction is to have the DOJ go after you.
- mmsc 1y agoEven with authenticated requests, viewing a pull request and adding `.diff` to the end of the URL is currently ratelimited at 1 request per minute. Incredibly low, IMO.
- soraminazuki 1y agoThis is going to make the job of package managers a PITA. Especially Nix.
- knowitnone 1y agoyou mean you want to better track users
- croemer 1y agoThe blog post is tagged with "improvement" - ironic for more restrictive rate limits. Also, neither the new nor the old rate limits are mentioned.
- hardwaresofton 1y agoDoes it seem to anyone like eventually the entire internet will be login only? At this point knowledge seems to be gathered and replicated to great effect and sites that either want to monetize their content OR prevent bot traffic wasting resources seem to have one easy option.
- mjevans 1y agoStatic, Near Static (not generated on demand at least; generated only on real content update), and Login seems likely. AI not caching things is a real issue. Sites being difficult TO cache / failing the 'wget mirror test' is the other side of the issue.
- grishka 1y agoWhat about AI not respecting robots.txt? I myself have never ran into this, but I've seen complaints of many people who did.
- tonyhart7 1y ago"What about AI not respecting robots.txt?" since when actor that want gather your entire data respect things like this??? how can you enforce such things with just "please don't crawl this directory thanks"
- arkh 1y ago> how can you enforce such things A van, some balaclavas and 4 people with big sticks.
- grishka 1y agoYou can't enforce them, but for the entire preceding history of the internet, most crawlers respected them. But then AI happened and those companies decided that their noble mission of forcing their slop into as many facets of human life as possible is above some stupid rules.
- londons_explore 1y agoMost of these unauthenticated requests are read-only. All of public github is only 21TB. Can't they just host that on a dumb cache and let the bots crawl to their heart's content?
- yorwba 1y agoI guess you're getting the size from the Arctic Code Vault? https://github.blog/news-insights/company-news/github-archive-program-the-journey-of-the-worlds-open-source-code-to-the-arctic/ https://github.blog/news-insights/company-news/github-archiv... That was 5 years ago and is presumably in git's compressed storage format. Caching the corresponding GitHub HTML would take significantly more.
- TheDong 1y agoYou're talking about the 21TB captured to the arctic code vault, but that 21TB isn't "all of public github" Quoting from https://archiveprogram.github.com/arctic-vault/ https://archiveprogram.github.com/arctic-vault/ > every *active* public GitHub repository. [active meaning any] repo with any commits between [2019-11-13 and 2020-02-02 ...] The snapshot consists of the HEAD of the default branch of each repository, minus any binaries larger than 100KB in size So no files larger than 100KB, no commit history, no issues or PR data, no other git metadata. If we look at this blog post from 2022, the number we get is 18.6 PB for just git data https://github.blog/engineering/architecture-optimization/scaling-gits-garbage-collection/ https://github.blog/engineering/architecture-optimization/sc... Admittedly, that includes private repositories too, and there's no public number for just public repositories, but I'm certain it's at least a noticeable fraction of that ~19PB.
- kvemkon 1y ago> At GitHub, we store a lot of Git data: more than 18.6 petabytes of it, to be precise. About $ 250 000 for 1000 HDDs and you get all the data. Meaning private persons such as top FAANG engineers could get a copy of the whole data after 2-3 years job. For companies dealing with AI such raw price is nothing at all.
- Animats 1y agoAre the scraper sites using a large number of IP addresses, like a distributed denial of service attack? If not, rather than explicit blocking, consider using fair queuing. Do all the requests from IP addresses that have zero requests pending. Then those from IP addresses with one request pending, and so forth. Each IP address contends with itself, so making massive numbers of requests from one address won't cause a problem. I put this on a web site once, and didn't notice for a month that someone was making queries at a frantic rate. It had zero impact on other traffic.
- fellerts 1y agoHuh, that sounds very reasonable, and it's the first time I've heard it mentioned. Why isn't this more wide-spread?
- hombre_fatal 1y agoComplex, stateful. I'm not even sure what that would look like for a huge service like GitHub. Where do you hold those many thousands of concurrent http connections and their pending request queues in a way that you can make decisions on them while making more operational sense than a simple rate limit? A lot of things would be easy if it were viable to have one big all-knowing giga load balancer. I remember Rap Genius wrote a blog post whining that Heroku did random routing to their dynos instead of routing to the dyno with the shortest request queue. As opposed to just making an all-knowing infiniscaling giga load balancer that knows everything about the system.
- 10000truths 1y agoA giga load balancer is no less viable than a giga Redis cache or a giga database. Rate limiting is inherently stateful - you can't rate limit a request without knowledge of prior requests, and that knowledge has to be stored somewhere. You can shift the state around, but you can't eliminate it. Sure, some solutions tend to be more efficient than others, but those typically boil down to implementation details rather than fundamental limitations in system design.
- whitehexagon 1y agoIf a company the size of MS isn't able handle the DOS caused by the LLM slurpers, then it really is game over for the open internet. We are going to need government approved ID based logins to even read the adverts at this rate. But this feels like a further attempt to create a walled garden around 'our' source code. I say our, but the first push to KYC, asking for phone numbers, was enough for me to delete all and close my account. Being on the outside, it feels like those walls get taller every month. I often see an interesting project mentioned on HN and clone the repo, but more and more times that is failing. Trying to browse online is now limited, and they recently disabled search without an account. For such a critical piece of worldwide technology infrastructure, maybe it would be better run by a not-for-profit independent foundation. I guess, since it is just git, anyone could start this, and migration would be easy.
- ghssds 1y agoyou mean https://savannah.gnu.org https://savannah.gnu.org?
- notpushkin 1y agoOr maybe https://codeberg.org/ https://codeberg.org/.
- pdimitar 1y agoCodeberg, Gitea, Forgejo.
- notpushkin 1y agoI’m pretty sure they can handle it, but given their continuous (if somewhat bittersweet) relationship with OpenAI, I’m pretty sure they are just trying to protect “their IP“ or something.
- graemep 1y agoThese exist, and you can self host. However, a lot of people think Github is the only option, and it benefits from network effects. Non-profit alternatives suffer from a lack of marketing and deal making. True of most things these days.
- gitroom 1y ago[dead]
- jrochkind1 1y agoThis means it's no longer safe to point to github-hosted repos in `git:` or `github:` dependencies in ruby bundler, yes? I forget because I don't use them, but weren't there some products meant as dependency package repositories that github had introduced at some point, for some platforms? Does this apply to them? (I would hope not unless they want to kill them?) This rather enormously changes github's potential place in ecosystems. What with the poor announcement/rollout -- also unusual for what we expect of github, if they had realized how much this effects -- I wonder if this was an "emergency" thing not fully thought out in response to the crazy decentralized bot deluge we've all been dealing with. I wonder if they will reconsider and come up with another solution -- this one and the way it was rolled out do not really match the ingenuity and competence we usually count on from github. I think it will hurt github's reputation more than they realize if they don't provide a lot more context, with suggested workarounds for various use cases, and/or a rollback. This is actually quite an impactful change, in a way that the subtle rollout seems to suggest they didn't realize?
- pdimitar 1y agoA take that I'm not seeing in all the "LLM scrapers are heading to our site, run for your lives!" threads is this: Why can't people harden their software with guards? Proper DDoS protection? Better caching? Rewrite the hot paths in C, Rust, Zig, Go, Haskell etc.? It strikes me as very odd, the atmosphere of these threads. So much doom and gloom. If my site was hit by an LLM scraper I'd be like "oh, it's on!", a big smile, and I'll get to work right away. And I'll have that work approved because I'll use the occasion to convince the executives of the need. And I'll have tons of fun. Can somebody offer a take on why are we, the forefront of the tech sector, just surrendering almost without a single shot?
- lionkor 1y agoBecause our sites are written in layers of abstraction and terrible design, which leads to requests taking serious server resources. If we hosted everything "well", you'd get a few 10-20k req/s per CPU core, but we aren't.
- pdimitar 1y agoTrue. I am simply wondering -- is the resistance from executives' so powerful that it can be never overpowered? Can't we ever just tell them "Look, this is like your car with plastic suspension -- it will work for a few days or even months but we can't rely on it forever; it's time to do it proper"? Especially when the car's plastic suspension is costing them extra money? I don't get it here, for real. I would think that selfish capitalistic interests would have them come around at one point! (Clarification: invest $5M for a year before the whole thing starts costing you extra $30M a year, for example.) And don't even get me started on the fact that GitHub is written in one of the most hardware-inefficient web frameworks (Rails). I mean OK, Rails is absolutely great for many things because most people's business will never scale as much and as such the initial increased developer velocity is an unquestionable one-sided win. I get that and I stopped hating Rails long time ago (even though I dislike it; but I do recognize where it's a solid and even preferred choice). But I've made a lot of money from trying to modernize and maintain Rails monoliths; it's just not suited for one scale and on -- without paying for extremely expensive consultants that is. It's like, everything can be made to work but it does start costing exponentially more from one scale and further up. And yet nobody at GitHub figures "Maybe it's time we rewrite some of the hot paths?" or just "Make more aggressive caching even if it means some users see data outdated by 30 seconds or so"? Nothing at all? Sorry, I am kind of ranting and not really saying anything to you per se. I am just very puzzled about how paralyzed GitHub seems under Microsoft.