4 ms·

Looks like they didn't rate-limit per-user, but only per-IP. Now that is dumb. I expected more from GitHub.

• gfxmonk 13y ago
  If they rate limited per user, you could trivially prevent someone from logging in by pummeling the server with login attempts for their username.
  • ye 13y ago
    If there are limits per-user and per-IP, they would need a shit ton of IPs to do that to any reasonable number of users.