9 ms·
New GitHub Pages domain: github.io
- balac 14y agoThis is certainly good news for HN, more than a few times I have been misled into thinking a pages.github.com submission was an official github announcement.
- CoreDumpling 14y agoProbably needs some adjustment or moderator intervention in the near term. I just tried a moment ago; you can still submit a pages.github.com URL and HN will mark the domain as github.com, but it will redirect to github.io when you follow the link.
- psychometry 14y agoI really fail to see why HN doesn't display the subdomain in the submission. Is there a reason for this?
- GHFigs 14y agoThe problem wasn't anticipated, and the fix has been to enable showing subdomains on only on certain domains, mainly blog hosts like wordpress, blogspot, tumblr.
- jedberg 14y agoBecause oftentimes the subdomain is irrelevant and would just make the display cluttered. More often than not the domain would be www. We did the same thing on reddit for the same reason. A few domains get their subdomain when they are popular enough for people to complain.
- vlad 14y agoMisleading subdomains is one of the reasons I created my own Chrome extension for Hacker News, Autobahn. You can download it at: http://vlad.github.com/autobahn http://vlad.github.com/autobahn Oh wait, I mean http://vlad.github.io/autobahn http://vlad.github.io/autobahn :)
- hamstah 14y agoLooks useful, will give it a try. (I would remove the autoplay=1 on your video with music as it's pretty annoying when you open in a background tab)
- goldfeld 14y agoThis is in turn nice for people using .io domains, the weight of Github's many blogs and official project pages will lend trust to the TLD.
- ethomson 14y agoI'm not sure that I understand this statement, could you elaborate? I would expect that the people who need to trust a TLD (consumers, I would presume) are not the same people who even know what GitHub is (developers, mostly, I would presume.)
- roryokane 14y agoMaybe he means search engine trust; PageRank. It’s plausible that Google factors in, when calculating the PageRank of a site, the TLD of the site and the proportion of bad/spammy sites that use that TLD.
- k3n 14y agoNot sure yet how I feel about the .io bandwagon that seems to be going around; I think I mainly don't like taking a TLD that is specifically designated for a country and attempting to attach a different meaning to it. I just don't know if my pedantry is justified... Yes, I know it's been happening forever, but that doesn't make it right. I do like the delineation between official Github content and user-content, but there definitely other ways to go about the problem without buying into the latest TLD fad.
- jeremymcanally 14y agoWe own a lot of TLD's for GitHub, but we just settled on this one for no real reason other than it sounded nice (i.e., not because it's hip). We also considered http://github.me http://github.me and a few others, but thought this one worked well and was short without sounding like we were trying to make a mid-90's Personal Home Page Product™.
- ibrahima 14y agoGreat all around, I hate all the links that show up here as from github.com when they're actually from username.github.com, or even gist.github.com. Though I guess this doesn't say anything about gists, maybe they should move those to their own domain too. Although I really think HN should show the first level subdomain of a domain if one exists.
- balac 14y agoThe same security issues shouldn't occur on gist.github.com as you can't actually run any code there.
- r4vik 14y agothis was a long time coming; excellent move
- lingben 14y agois the css not loading for anyone else? http://i7.minus.com/jIB4Ck8nD7cOH.png http://i7.minus.com/jIB4Ck8nD7cOH.png
- jlogsdon 14y agoGitHub has been having DNS issues today. Maybe they screwed something up when enabling github.io?
- molecule 14y agoEgor Homakov's write up of the session fixation and CSRF vulnerabilities that this addresses: http://homakov.blogspot.com/2013/03/hacking-github-with-webkit.html http://homakov.blogspot.com/2013/03/hacking-github-with-webk...
- alcuadrado 14y agoI think he deserves being mentioned in the github's post.
- danso 14y agoHeh, at least he didn't get his account banned prematurely. It's already been said, but as much headaches as Egor's proof-of-concepts gave headaches to Github's staff, they've really helped educate the general dev public (well, me at least) about security-mindedness. Github's security explanatory notes in the OP are helpful, but Egor's demo really made the issues memorable.
- benatkin 14y agoEgor's posts have also helped GitHub improve their security, to the extent that they're willing to listen. I told a couple of people at GitHub that they should add a way to select which email addresses can be used for password reset. Both agreed it was a good idea, but there hasn't been any action. If you want commits to be linked to your GitHub account, you have to add the email to your account settings page. If you add the email to your account settings page, it can be used to reset the password and gain access to the account. Also people keep begging for Two-Factor auth, and I'll echo that. https://twitter.com/kaepora/status/307938914667220992 https://twitter.com/kaepora/status/307938914667220992
- deleted 14y ago[deleted]
- wereHamster 14y agoWill github pages finally support SSL?
- camus 14y agoor , do like heroku : something like github-pages.com or github-space.com , mygithub.com , etc ... github.io / github.com still a bit confusing...
- FuzzyDunlop 14y agoI presume they valued the terseness of the domain over the brand potential of 'Pages'. I do agree that there is confusion though. You can't possibly know the difference between github.io and github.com until you're actually told.
- ZoFreX 14y agoSecurity vulnerability 3: Websites could sniff passwords of users with password-saving browser extensions. If the extension autofills the username and password (and some do out of the box), then a bit of javascript on a GitHub Pages site could have stolen those users' Github passwords. Excellent move on GitHub's part here.
- homakov 14y agoi won't work in popular browsers. subdomain is another origin and passwords cannot be stolen
- blake8086 14y agoFrom what I understand, this is the same reason Google uses googleusercontent.com
- evmar 14y agoThe docs for user pages appear to have been auto-rewritten to name the repository with a .io suffix, but the cited URL doesn't seem to work. See https://help.github.com/articles/user-organization-and-project-pages https://help.github.com/articles/user-organization-and-proje... , click the defunkt demo link.
- gjtorikian 14y agoFixed. Thanks for pointing it out, I thought I got them all.
- woli 14y agoHad a misbehaving page because of this. An email notification would have been nice Github.
- pkamb 14y agoWhen I go to http://pages.github.com/ http://pages.github.com/, I see absolutely no way to make a Github Page. How do you set one up? EDIT: I know I could probably find the info in an FAQ, if I needed to. My point is that the images on that page seem to show a nice wysiwyg online editor for creating and publishing pages. I'm looking for a big call to action button that takes me there, similar to how easy it is to publish to https://gist.github.com/ https://gist.github.com/.
- deleted 14y ago[deleted]
- lobster_johnson 14y agoYou create a repo named username.github.io (eg., pkamb.github.io). Put static files in it, and they will become available automatically. More information here: https://help.github.com/categories/20/articles https://help.github.com/categories/20/articles
- Lockyy 14y agohttps://help.github.com/categories/20/articles https://help.github.com/categories/20/articles
- pkamb 14y agoDoesn't it seem kind of crazy that you have to sort through an FAQ to get started? Why isn't there a big call to action button that says "Create a Page"?
- Lockyy 14y agoI agree. However this is pretty much it for how to do it. It is quite easy to get started, jekyll is very simple.
- CamperBob2 14y agoBecause that just results in the creation, and subsequent abandonment, of a lot of junk pages?
- hcarvalhoalves 14y agoNo one thought about pages.github.com?
- steveklabnik 14y agoThat does not solve the security issues that they're looking to mitigate.
- hcarvalhoalves 14y agoI see. I thought they could limit the cookies to the github.com root, but they already have stuff like gist.github.com.
- Groxx 14y agoWhich doesn't run arbitrary JS code, unlike the username.github.com pages, which means gist.github.com is incapable of setting such cookies. Unless there's a way to 'run' gist files? I'm not aware of any, but I haven't tried particularly hard.
- LukeShu 14y agoHe means that if they set cookies to only apply to the root, then you will have to log in to gist.github.com and github.com separately. Taking access away from the un-trusted code also means taking it away from some trusted code.
- Groxx 14y agoAaah, d'oh. Makes sense in retrospect :) thanks!
- thomseddon 14y agoIt's a real pain that "project pages", i.e. serving the gh-pages branch from username.github.com/project aren't being redirected, for example: http://nightworld.github.com/odlnorth http://nightworld.github.com/odlnorth just 404's Is this an oversight or am I missing something?
- holman 14y agoThat's a bug; we're looking into it. Thanks!
- logn 14y ago"If your Pages site was previously served from a username.github.com domain, all traffic will be redirected to the new username.github.io location indefinitely" i.e., Phishers, no need to change your email templates!
- thomaslutz 14y agoIs that why http://litecoin.org/ http://litecoin.org/ is down?
- Groxx 14y ago<frameset rows="100%,*" border="0"> <frame src="http://coblee.github.com/litecoin/" frameborder="0" /> <frame frameborder="0" noresize /> </frameset> Looks like it, yeah. You can just go to http://coblee.github.io/litecoin http://coblee.github.io/litecoin in the meantime though.
- thomaslutz 14y agoThanks, they same to have fixed it in the meantime.
- timedoctor 14y agoI think .io is a much better choice than .co, because .co is easily confused with .com. .io is so completely different that it is less easily confused with .com. Note that overstock totally rebranded their domain to o.co and found that a very large percentage of visitors were typing in o.com instead of o.co and they were losing a very significant amount of traffic.
- nikcub 14y agoPoor form not crediting Homakov, GitHub. Credit means a lot to security researchers (that is all a lot of us are working for). If you aren't even giving simple credit, you are asking to be compromised the next time an issue is found. GitHub is large enough and prominent enough where it should have an entire bounty program, let alone giving a blogger a link.
- homakov 14y agogithub is business after all — i think they just forgot about me/my post. also they told me previously moving to a new domain is an old idea.
- niggler 14y ago" i think they just forgot about me/my post" If you found an exploit and sold it to someone, you would be richer and they wouldn't forget you :)
- briandoll 14y agoWe've got a list of security researchers who have disclosed vulnerabilities to us responsibly (including Homakov) on our help site: https://help.github.com/articles/responsible-disclosure-of-security-vulnerabilities https://help.github.com/articles/responsible-disclosure-of-s...
- derefr 14y agoThat's sort of the opposite scale to what the (greyhat) security community would expect, though. Try tacking an HTML5 scroller (with an original SID composition) onto the end of the announcement, crediting the researcher. ;)
- downrightmike 14y agoI like saas companies so much more than traditional ones largely because they offer support effectively. Test case: Try to find the number to call to replace your bluetooth headset.
- jbox 14y ago"As a general rule, it's not possible to securely allow arbitrary user-provided content on a subdomain." This rule is also good to keep in mind when choosing a domain for non-production environments!
- wyuenho 14y agoThis change just reset all the Tweets and G+ count for my project to 0. Is there a way to claim those back?
- modarts 14y agoWhat's next aside from trendy hipster TLD's located in the Indian ocean? I mean I/O amirite?!?!?!
- deleted 14y ago[deleted]
- enrmarc 14y agoRemember to migrate the threads if you are using Disqus (Admin -> Tools -> Migrate Threads -> Start Crawler).