7 ms·

Rawgithub.com

95 points by johns 13y ago

ozh 13y ago
Related: http://www.5minfork.com/ http://www.5minfork.com/
simonw 13y ago
I love it - I've been wanting this for ages. Super convenient.
waawal 13y ago
"We added the X-Content-Type-Options: nosniff header to our raw URL responses way back in 2011 as a first step in combating hotlinking. This has the effect of forcing the browser to treat content in accordance with the Content-Type header. That means that when we set Content-Type: text/plain for raw views of files, the browser will refuse to treat that file as JavaScript or CSS." https://github.com/blog/1482-heads-up-nosniff-header-support-coming-to-chrome-and-firefox https://github.com/blog/1482-heads-up-nosniff-header-support...
louischatriot 13y ago
I needed yesterday :) Well done.
shared4you 13y ago
"What will happen if im an asshole" -- that's the first time I've seen a URL anchor like that! https://rawgithub.com/#what-will-happen-if-im-an-asshole https://rawgithub.com/#what-will-happen-if-im-an-asshole
- derleth 13y ago
  I think the author should warn people "If you're a big enough asshole, I will make your website look amusingly awful and submit it to Reddit and Hacker News." Making someone look like a complete idiot in public can be a powerful disincentive.
  - juandopazo 13y ago
    It has happened, but the result was a more polite alert() box in a hompeage and it wasn't posted anywere.
    - rgrove 13y ago
      Actually, it was an alert() box plus evil.js, which overwrites lots of native JS functionality to intentionally cause weird bugs. The idea is to make it impossible to ignore so abusers will stop their hotlinking. I'm not really interested in shaming anyone, though. I think it's usually just a simple mistake where someone was lazy and didn't bother reading all the caveats.
the_mitsuhiko 13y ago
Sounds like a horrible idea security wise.
- judofyr 13y ago
  Care to explain why?
  - PommeDeTerre 13y ago
    Is it really not obvious? The site's FAQ admits that it'll engage in what is basically a man-in-the-middle attack against content that receives heavy traffic, for instance. See the "rawgithub.com will start serving evil.js and evil.css instead of requested JS and CSS files" part of one of the answers. If the content being served will be modified in some cases, is there really anything preventing it from being modified in a different (perhaps more malicious) way in some other cases? Like anything else, a service like this is itself susceptible to breach, of course. There's always the potential that it gets compromised, and starts acting in a malicious manner, initially undetected by its creators/operators/users. Some may argue that this is acceptable risk for content served up for demonstration purposes. I'm not certain that's necessarily true. A demo being unexpectedly modified in a harmful way (racial slurs inserted into a web site's text, malicious JavaScript being injected, and so on) could seriously affect the demo giver's reputation, for example. It's not difficult, nor expensive, to set up your own publically-facing web server. If already using GitHub, git makes it quite simple to fetch and update any content being served up. While there is still risk associated with such a setup, you are cutting out at least one other party by doing things yourself, avoiding the harm they could potentially cause. So services of this type seem quite unnecessary, and perhaps more of a risk than they're worth.
    - judofyr 13y ago
      > Is it really not obvious? I first thought he meant it was a horrible idea for the owner of RawGithub.com: serving arbitrary JavaScript. But that shouldn't be a problem as long as long you use a completely separate domain and never care about cookies. As for the users of the service: it's not any less secure than running JavaScript from any other web server. You can of course never trust that it's serving the correct data, but I don't see how that's horrible security wise. If you're going to demo it yourself you can easily clone the repo yourself (or setup gh-pages). This is for users who want to quickly check out someone else's repo without cloning it.
gkoberger 13y ago
Very awesome. I'm sure there's a legitimate reason, but I've always wondered why you can't just set master as your GitHub Pages branch if it made sense (rather than gh_pages).
- Aqua_Geek 13y ago
  master is the GitHub pages branch for User and Organization pages. You could also set the default branch in the project settings to gh_pages for other repos.
- shurcooL 13y ago
  I've tried that here [1], gh-pages has replaced master as the only branch. It seems to work well [2] for the static site. [1] https://github.com/shurcooL/latest-tweets https://github.com/shurcooL/latest-tweets [2] http://shurcool.github.io/latest-tweets/ http://shurcool.github.io/latest-tweets/
balac 13y ago
I like the service, but is it OK to use the github name like this?
- asperous 13y ago
  Looks like no, it's trademarked: http://tess2.uspto.gov/bin/showfield?f=doc&state=4802:zp1qua.2.2 http://tess2.uspto.gov/bin/showfield?f=doc&state=4802:zp... Since Mr. Grove (and by extension, his website) is based on USA, it is eligible to be sued (in fact they have to protect their copyright or risk rendering it de-facto invalid).
  - rcfox 13y ago
    They have to defend their trademark, not their copyright.
    - asperous 13y ago
      That's what I meant
  - bjterry 13y ago
    Yes, but protecting their trademark in this case is allowed to be, "Hello, we need you to license our trademark if you are going to use it. We won't charge you. Please e-sign this short and not overly lawyered document."
    - kbutler 13y ago
      That is a "naked license" and would likely result in github losing their trademark, as they would be abandoning it by not controlling the nature and quality of services provided by the licensee. (SFW: http://www.ivanhoffman.com/naked.html http://www.ivanhoffman.com/naked.html)
- rgrove 13y ago
  I launched rawgithub.com before GitHub announced their official policy discouraging projects from using "github" in their name. I really, really liked the simplicity of just deleting the dot in "raw.github.com" to get a rawgithub.com URL. I've tried to make it very clear that rawgithub.com is in no way endorsed by or associated with GitHub in the hopes that there won't be any confusion, but naturally I'd change the name if GitHub asked me to. I definitely don't want to tromp on their trademark.
sergeykish 13y ago
Same idea with source https://github.com/sergeykish/gisted https://github.com/sergeykish/gisted
- quarterto 13y ago
  Read the FAQ, rawgithub's source is here: https://github.com/rgrove/rawgithub https://github.com/rgrove/rawgithub
niutech 13y ago
I've done a similar project GitHub HTML Preview, which allows you to run any HTML & JS & CSS without using GitHub Pages or downloading a repo: http://htmlpreview.github.io http://htmlpreview.github.io
brokencube 13y ago
evil.js is just beautiful...
zenocon 13y ago
Why doesn't github just fix it to send the correct content-type back?
- matthavener 13y ago
  If someone can host arbitrary html and js on the *.github.com domain, they can set cookies for github.com. See http://homakov.blogspot.com/2013/03/hacking-github-with-webkit.html http://homakov.blogspot.com/2013/03/hacking-github-with-webk...
ryeguy 13y ago
Does this font render horribly for anyone else? On windows with chrome here.
- rfnslyr 13y ago
  It renders horribly for me as well. On that note, how does one properly implement custom fonts into a webpage? Is there a standard, recognized, fool proof way? I've rarely seen it done correctly. On that note again, where do I learn about fonts in the browser in general?
  - bpatrianakos 13y ago
    There's sort of a standard way. But really no. It's one of those situations where if you're going to use custom webfonts and aren't using a service you'll need to go through some trial and error, do some research, and basically decide which platform/browser combo is most important to you. The second most popular post on my website discusses this. Not trying to self-promote and there are problems with my implementation too but maybe this can get you started http://billpatrianakos.me/blog/2012/12/26/fix-webfont-rendering-issues-in-chrome-for-windows/ http://billpatrianakos.me/blog/2012/12/26/fix-webfont-render...
- cypher543 13y ago
  It's a well-known issue in Chrome for Windows. The latest version of Chrome's rendering library (Skia) now supports DirectWrite and they intend to include it in their Blink engine. https://code.google.com/p/chromium/issues/detail?id=137692 https://code.google.com/p/chromium/issues/detail?id=137692
- rgrove 13y ago
  Sorry about that. I haven't even looked at the site on Windows. Soon as I have time I'll see if I can find a font that Chrome won't mangle on Windows.
kwestro 13y ago
Couldn't come up with any other name? The site is just begging to be taken down by Github.
huntedsnark 13y ago
This is great, I have some JSfiddle examples that I share occasionally that reference some raw files an Github, this fixes them in Chrome. Seems like the perfect use case for this.

Rawgithub.com

95 points by johns 13y ago

ozh 13y ago

Related: http://www.5minfork.com/ http://www.5minfork.com/

simonw 13y ago

I love it - I've been wanting this for ages. Super convenient.

waawal 13y ago

"We added the X-Content-Type-Options: nosniff header to our raw URL responses way back in 2011 as a first step in combating hotlinking. This has the effect of forcing the browser to treat content in accordance with the Content-Type header. That means that when we set Content-Type: text/plain for raw views of files, the browser will refuse to treat that file as JavaScript or CSS." https://github.com/blog/1482-heads-up-nosniff-header-support-coming-to-chrome-and-firefox https://github.com/blog/1482-heads-up-nosniff-header-support...

louischatriot 13y ago

I needed yesterday :) Well done.

shared4you 13y ago

"What will happen if im an asshole" -- that's the first time I've seen a URL anchor like that! https://rawgithub.com/#what-will-happen-if-im-an-asshole https://rawgithub.com/#what-will-happen-if-im-an-asshole

derleth 13y ago
I think the author should warn people "If you're a big enough asshole, I will make your website look amusingly awful and submit it to Reddit and Hacker News." Making someone look like a complete idiot in public can be a powerful disincentive.
- juandopazo 13y ago
  It has happened, but the result was a more polite alert() box in a hompeage and it wasn't posted anywere.
  - rgrove 13y ago
    Actually, it was an alert() box plus evil.js, which overwrites lots of native JS functionality to intentionally cause weird bugs. The idea is to make it impossible to ignore so abusers will stop their hotlinking. I'm not really interested in shaming anyone, though. I think it's usually just a simple mistake where someone was lazy and didn't bother reading all the caveats.

the_mitsuhiko 13y ago

Sounds like a horrible idea security wise.

judofyr 13y ago
Care to explain why?
- PommeDeTerre 13y ago
  Is it really not obvious? The site's FAQ admits that it'll engage in what is basically a man-in-the-middle attack against content that receives heavy traffic, for instance. See the "rawgithub.com will start serving evil.js and evil.css instead of requested JS and CSS files" part of one of the answers. If the content being served will be modified in some cases, is there really anything preventing it from being modified in a different (perhaps more malicious) way in some other cases? Like anything else, a service like this is itself susceptible to breach, of course. There's always the potential that it gets compromised, and starts acting in a malicious manner, initially undetected by its creators/operators/users. Some may argue that this is acceptable risk for content served up for demonstration purposes. I'm not certain that's necessarily true. A demo being unexpectedly modified in a harmful way (racial slurs inserted into a web site's text, malicious JavaScript being injected, and so on) could seriously affect the demo giver's reputation, for example. It's not difficult, nor expensive, to set up your own publically-facing web server. If already using GitHub, git makes it quite simple to fetch and update any content being served up. While there is still risk associated with such a setup, you are cutting out at least one other party by doing things yourself, avoiding the harm they could potentially cause. So services of this type seem quite unnecessary, and perhaps more of a risk than they're worth.
  - judofyr 13y ago
    > Is it really not obvious? I first thought he meant it was a horrible idea for the owner of RawGithub.com: serving arbitrary JavaScript. But that shouldn't be a problem as long as long you use a completely separate domain and never care about cookies. As for the users of the service: it's not any less secure than running JavaScript from any other web server. You can of course never trust that it's serving the correct data, but I don't see how that's horrible security wise. If you're going to demo it yourself you can easily clone the repo yourself (or setup gh-pages). This is for users who want to quickly check out someone else's repo without cloning it.

gkoberger 13y ago

Very awesome. I'm sure there's a legitimate reason, but I've always wondered why you can't just set master as your GitHub Pages branch if it made sense (rather than gh_pages).

Aqua_Geek 13y ago
master is the GitHub pages branch for User and Organization pages. You could also set the default branch in the project settings to gh_pages for other repos.
shurcooL 13y ago
I've tried that here [1], gh-pages has replaced master as the only branch. It seems to work well [2] for the static site. [1] https://github.com/shurcooL/latest-tweets https://github.com/shurcooL/latest-tweets [2] http://shurcool.github.io/latest-tweets/ http://shurcool.github.io/latest-tweets/

balac 13y ago

I like the service, but is it OK to use the github name like this?

asperous 13y ago
Looks like no, it's trademarked: http://tess2.uspto.gov/bin/showfield?f=doc&state=4802:zp1qua.2.2 http://tess2.uspto.gov/bin/showfield?f=doc&state=4802:zp... Since Mr. Grove (and by extension, his website) is based on USA, it is eligible to be sued (in fact they have to protect their copyright or risk rendering it de-facto invalid).
- rcfox 13y ago
  They have to defend their trademark, not their copyright.
  - asperous 13y ago
    That's what I meant
- bjterry 13y ago
  Yes, but protecting their trademark in this case is allowed to be, "Hello, we need you to license our trademark if you are going to use it. We won't charge you. Please e-sign this short and not overly lawyered document."
  - kbutler 13y ago
    That is a "naked license" and would likely result in github losing their trademark, as they would be abandoning it by not controlling the nature and quality of services provided by the licensee. (SFW: http://www.ivanhoffman.com/naked.html http://www.ivanhoffman.com/naked.html)
rgrove 13y ago
I launched rawgithub.com before GitHub announced their official policy discouraging projects from using "github" in their name. I really, really liked the simplicity of just deleting the dot in "raw.github.com" to get a rawgithub.com URL. I've tried to make it very clear that rawgithub.com is in no way endorsed by or associated with GitHub in the hopes that there won't be any confusion, but naturally I'd change the name if GitHub asked me to. I definitely don't want to tromp on their trademark.

sergeykish 13y ago

Same idea with source https://github.com/sergeykish/gisted https://github.com/sergeykish/gisted

quarterto 13y ago
Read the FAQ, rawgithub's source is here: https://github.com/rgrove/rawgithub https://github.com/rgrove/rawgithub

niutech 13y ago

I've done a similar project GitHub HTML Preview, which allows you to run any HTML & JS & CSS without using GitHub Pages or downloading a repo: http://htmlpreview.github.io http://htmlpreview.github.io

brokencube 13y ago

evil.js is just beautiful...

zenocon 13y ago

Why doesn't github just fix it to send the correct content-type back?

matthavener 13y ago
If someone can host arbitrary html and js on the *.github.com domain, they can set cookies for github.com. See http://homakov.blogspot.com/2013/03/hacking-github-with-webkit.html http://homakov.blogspot.com/2013/03/hacking-github-with-webk...

ryeguy 13y ago

Does this font render horribly for anyone else? On windows with chrome here.

rfnslyr 13y ago
It renders horribly for me as well. On that note, how does one properly implement custom fonts into a webpage? Is there a standard, recognized, fool proof way? I've rarely seen it done correctly. On that note again, where do I learn about fonts in the browser in general?
- bpatrianakos 13y ago
  There's sort of a standard way. But really no. It's one of those situations where if you're going to use custom webfonts and aren't using a service you'll need to go through some trial and error, do some research, and basically decide which platform/browser combo is most important to you. The second most popular post on my website discusses this. Not trying to self-promote and there are problems with my implementation too but maybe this can get you started http://billpatrianakos.me/blog/2012/12/26/fix-webfont-rendering-issues-in-chrome-for-windows/ http://billpatrianakos.me/blog/2012/12/26/fix-webfont-render...
cypher543 13y ago
It's a well-known issue in Chrome for Windows. The latest version of Chrome's rendering library (Skia) now supports DirectWrite and they intend to include it in their Blink engine. https://code.google.com/p/chromium/issues/detail?id=137692 https://code.google.com/p/chromium/issues/detail?id=137692
rgrove 13y ago
Sorry about that. I haven't even looked at the site on Windows. Soon as I have time I'll see if I can find a font that Chrome won't mangle on Windows.

kwestro 13y ago

Couldn't come up with any other name? The site is just begging to be taken down by Github.

huntedsnark 13y ago

This is great, I have some JSfiddle examples that I share occasionally that reference some raw files an Github, this fixes them in Chrome. Seems like the perfect use case for this.