News for hackers. Stuff that matters.

A comment on GitHub doesn't show search field unless you sign in. Parent comment

Re:GitHub doesn't show search field unless you sign in by danmaz74 on Sunday March 20, 2016 @04:43AM (#11322271)
I really wonder what the rationale behind this move is. I wouldn't even have noticed as I'm practically always logged in, but was that search bar lowering the conversion rates to free users, or what?
[ Parent | on HN ]
Re:GitHub doesn't show search field unless you sign in by caleblloyd on Sunday March 20, 2016 @09:07AM (#11322761)
Probably because Github is constantly under DDOS attacks, search is computationally expensive, and they can't rate limit unauthenticated sessions. http://m.theregister.co.uk/2015/08/26/github_wobbles_under_d...
[ Parent | on HN ]
Re:GitHub doesn't show search field unless you sign in by newjersey on Sunday March 20, 2016 @09:48AM (#11322875)
Google rate limits unauthenticated sessions. Try using Google over tor. They are pretty heavy-handed about it too. Github isn't tiny enough to use ddos as an excuse.
[ Parent | on HN ]
Re:GitHub doesn't show search field unless you sign in by caleblloyd on Sunday March 20, 2016 @09:56AM (#11322909)
TOR still uses cookies so a session ID can be set for the user agent and rate limited.

DDOS scripts create new sessions on every attack request. It's a very hard problem to solve without blocking legitimate traffic too.

[ Parent | on HN ]
Re:GitHub doesn't show search field unless you sign in by EGreg on Sunday March 20, 2016 @12:05PM (#11323394)
Not that difficult!

Simply sign your session ids with an HMAC, to verify the id without any I/O! And require something expensive to create a session (such as a hash-based challenge request). Sessions are usually not needed for static sites, so by the time the person searches, their browser will have earned one session. A spammer on the other hand wouldn't have the computational power to create the various sessions. Also, if a spammer's IP is detected, the computational complexity can be increased for that IP.

[ Parent | on HN ]
Re:GitHub doesn't show search field unless you sign in by newjersey on Sunday March 20, 2016 @10:09AM (#11322950)
Well, at some point you have to block legitimate traffic. My thought was it doesn't have to be black and white. Maybe require the user to solve a captcha after the nth search from the same IP address? How big are the biggest of botnets? A few hundred thousand computers? Or maybe even require captcha for every unauthenticated search.
[ Parent | on HN ]
Re:GitHub doesn't show search field unless you sign in by EGreg on Sunday March 20, 2016 @12:06PM (#11323399)
You mean just for the first one, to get a session id.
[ Parent | on HN ]
Re:GitHub doesn't show search field unless you sign in by nso on Sunday March 20, 2016 @11:32AM (#11323291)
Millions.
[ Parent | on HN ]
Re:GitHub doesn't show search field unless you sign in by driverdan on Sunday March 20, 2016 @12:01PM (#11323385)
Rate limiting is IP based, not session based.
[ Parent | on HN ]
Re:GitHub doesn't show search field unless you sign in by vc98mvco on Sunday March 20, 2016 @01:01PM (#11323618)
That cannot be the case, becuse you can still search, it is just missing from the UI: https://news.ycombinator.com/item?id=11322207
[ Parent | on HN ]
Re:GitHub doesn't show search field unless you sign in by jsilence on Sunday March 20, 2016 @09:34AM (#11322833)
Yeah, probably one of the reasons.

I don't understand why one would DDOS Github. What is the reason for that?

[ Parent | on HN ]
Re:GitHub doesn't show search field unless you sign in by ikeboy on Sunday March 20, 2016 @10:04AM (#11322931)
Hosting NYTimes articles critical of China.

http://arstechnica.com/security/2015/03/github-battles-large...

[ Parent | on HN ]
Re:GitHub doesn't show search field unless you sign in by ionforce on Sunday March 20, 2016 @09:44AM (#11322864)
Street cred.
[ Parent | on HN ]
Re:GitHub doesn't show search field unless you sign in by Houshalter on Sunday March 20, 2016 @07:33AM (#11322560)
Perhaps search is expensive, so they are trying to limit the number of searches. I know there is a stricter rate limit for searches in the API.
[ Parent | on HN ]