The repo names all matched other GitHub apps, so my sense is this bot had added 1700 GitHub apps to 1700 repos, with that number rapidly increasing at the upper bound of whatever GitHub's rate limit is.
My systems caught it quickly and auto-booted the bot, but the whole situation is ridiculous.
kinda reminds me of it. not my most valuable contribution to forensics, admittedly.
Charge $1/month per repo. If your project isn't worth that, run your own git or use another free forge.
Free Users use GitHub => when a company needs source control => all their coders use GitHub => company buys expensive enterprise contract.
If there’s less of an advantage to using free GitHub then that funnel works less effectively.
Seems like github is too popular for itself.
Could do similar for GH actions usage.
Encouraging big commits seems antithetical to the idea of git in general.
Sure, but how is OpenAI, and Claude handling the increased usage? They are handling it a lot better than Github. Just because you have fast growth does not mean you can not handle it.
Instead you have to realize that you are entering into a high growth phase and design around that.
It has been clear that we are in a high growth phase for around a year now and Github still hasn't adapted to that properly.
At some point you have to admit that Github ready for the moment.
Edit: Found the thread: https://news.ycombinator.com/item?id=47616242
Don't they sign NDAs? Do they not care? Are they not enforceable?
Very curious to know.
Some fuck-ups have such long-lasting effects that they outlast the NDAs that would cover them
You think GitHub ought to match that?
So has Github's owner Microsoft. It's build out is on par with OpenAI and Anthropic.
> You think GitHub ought to match that?
Microsoft is.
The issue is that the software stack is not stable. That is clearly the issue here.
It isn't a hardware build out issue. It is related to the architecture of Github.
By spending tens of billions in investor cash. It is not clear what a sustainable business model looks like for these companies at the moment.
> They are handling it a lot better than Github.
Are they? Anthropic has fairly frequent issues.
There's high growth and then there's demand increasing 10x in a year. For a mature business like github that's a massive, and I can't think of many big businesses who would be able to scale smoothly to accommodate that kind of demand.
Also Github's feature offering has been incredibly stable for the last 6 years. There isn't an excuse for it to be unstable like this.
That's due to the need for ultra-fast memory and inference compute, it's not the same thing.
Like, I get there are other features they have, and things like history, but I don't think it's quite the same.
Isn't most (not all) of the LLM's resources stateless compute to a large degree?
(Not defending MS at all though, I currently can't create a PR on the required branch for my work (won't load the branch list) and their availability is really bad recently).
Google “RLHF”.
For LLMs, prompt handling is effectively stateless. They do try to route follow-up prompts to the same cluster to benefit from prompt caching, but those can be effectively sharded. They also need to write results to storage but that's on a per-customer basis, so also easy to shard.
GitHub is a shared space, where commits and issues and PRs need to become instantly available to all readers across all geographies. They have a very different shape of scaling challenge to the LLM vendors.
Github data is accessible by all (if open source), but they should be partition-able by individual repository (and their related forks.). Thus while there is more shared state across users, it isn't fully shared state.
And they have been working on this semi-shared state design for over 10 years now.
No, they are not.
Around the time when Windows 95 was released, Microsoft did predict that the internet will become popular also among private users. That is why
- they included Winsock (Windows' TCP/UDP/IP stack) as native part of Windows 95 (in opposite to Windows 3.x where you had to install a third-party implementation of the Winsock API such as Trumpet Winsock), though it was typically not installed by default,
- support to use MSN (the dial-up online service and internet servicen provider [1]) was pre-installed with Windows 95.
What was not clear at that time was that the world wide web would become the killer application for the internet for consumer users (at that time, the more likely killer application of the internet for consumers was seen in proprietary content providers such as AOL, Compuserve or MSN), so Microsoft provided no web browser with the original version of Windows 95.
But even at that time, it was conceivable, though not clear that the world wide web could become important. So, already at the release time of Windows 95, Microsoft provided Internet Explorer 1.0 as part of the Plus! add-on pack for Windows 95. With Windows 95 OEM Service Release 1, the Internet Explorer 2.0 got part of Windows 95, and Windows 98 introduced the (optional) Active Desktop [2], in was centered around the Internet Explorer.
So, in my opinion Microsoft did everything "correct" here: they provided Internet Explorer from beginning on as an optional separate component (Plus! add-on pack), and once it was obvious that the world wide web would become very important, they reacted fast and included the Internet Explorer in the next service release of Windows 95 (Windows 95 OEM Service Release 1).
--
[1] https://en.wikipedia.org/wiki/MSN_Dial-Up_Internet_Access
OK so then use the additional revenue to add more resources and employees? What the f*k are they doing over there?
What revenue? I'd assume the people pushing thousands of AI-generated commits are not the people paying for GitHub Enterprise.
I'd assume at least a portion of them are paying for GitHub Pro, and by now at least a small % would have converted to Enterprise.
If not, then they need to fix their operational model - I don't understand people acting like this is some insurmountable challenge given Microsoft reported over $331 billion in total revenue and an operating income exceeding $155 billion in 2026.
Clearly, something needs to change. But if they're not careful they might provoke a reaction from their existing userbase that's even more negative that the response to these outages.
Of course it can - everything is tough at that scale, but their parent company has billions in profit. They've had a year to come up with a plan/fix and have failed miserably.
If they're really that cash-strapped at GitHub, then are they planning to just continue allowing this to happen and drown, or fix the issues? This has been ongoing for over a year.
There are multiple kinds of limits you need. First you need the raw i/o limits on things like networking, load balancer requests per second, etc so you don't slow to a crawl on high load; you can throttle max i/o so demanding users don't steal performance for others, or even throttle network traffic to the client IP and internal services. Then you need additional limits at app layer, like number of requests you can process that make DB calls (as most DBs have a connection and request limit), or limit API requests to X/minute. Then you need more business logic limits, like max number of concurrent logged-in users, max number of repos a user can have, max number of requests for free users, priority for paid requests, etc.
When you hit a limit, you have a couple choices. You can shed load (dropping calls immediately, which results in 503 errors for users, or even network disconnects), but it makes a very poor user experience, and can cause larger issues/conflicts in a distributed system. You can instead keep a max number of active sessions, and adjust that number over time, to ensure that (on average) your users have a stable experience; this requires implementing a "waiting room" for new sessions when old ones expire or log out; still not great for users, but it prevents everyone from getting random errors, which means the majority of users have a good experience.
There are way more kinds of limits to implement. Each business has to analyze its entire system to identify performance bottlenecks and implement limits to ensure the majority of users continue to have good service. Without those limits, you get a shit experience for everyone, your brand is tarnished, and customers run for the hills.
Finally, the performance testing helps you plan how much infrastructure you need to serve a given number of users. If you plan properly, you know X infra allows for Y number of users. Once you exceed Y users, you need to start throttling or stopping new user signup (and requests per minute) until you can increase capacity. Continuing to allow signups and additional usage, without the capacity to support it, results in what we see today.
But competent engineers know all this. If they had competent engineers, and it gets this bad anyway, the problem is management. Microsoft likely already made back what they acquired GitHub for. They probably figured they could keep riding the gravy train until the train went off the rails, and either eventually sell GitHub or write it off. Such is business.
Ironically the core application is written in rails, which may be part of the issue
Fixing small errors and keeping going on maybe is a good business strategy.
The last result is probably what you said.
Might be worth considering a /GB/MO fee. Let's face it, VCS is a (glorified) storage service.
I just checked no 1 vibe coder https://github.com/steipete and he has like 279,440. Compared this to Taylor who works on huge project like Laravel and is only around 8k commits.
If load was an issue these things would have been solved already. Or they are purposely causing millions of dollars of productivity loss daily by not solving this.
Something more serious is at play. And I want to hear from the actual underlings.
100% agree.
> Remember these folks hire people with plenty of system design experience.
Not my overall experience 30 years in the industry.
> They likely also have the money for hardware resources.
You'll always be asked to do more with less, at least, that's my own experience.
So even if these cloud/SAAS solutions perform poorly it is not like customers have wherewithal to create alternate solutions.
it's not impossible. they don't, right up until they do
Amazing you can say this with a straight face in these DC building times.
Have you tried getting Azure east instances anytime lately?
Hey man, in case you hadn't heard, the hardware industry is having a lot of trouble keeping up. "Expand our capacity" isn't as easy as it was 2 years ago.
Additional load reveals limits and breaklines that were never known before - your temporary integer IDs are suddenly too small, you reach the maximum file descriptors in a Linux distro, your hash function suddenly has repeating conflicts, your DB index is suddenly oversaturated.
Having massive exponential growth of your traffic would probably require constant refactoring to meet the ever changing system limits.
It's hard to design something (large and complex) for much more than 10X scale with only HW capacity increases.
Now however, it's competing for resources directly with the corporations core strategic plans.
GitHub having issues is embarrassing, but the shareholders don't really care.
Something about these two factors seems to have conspired to wreak absolute havoc on their uptime in the ~7yr hence. The AI slopocalypse hasn't helped matters, but the foundations were laid far earlier.
Would love to hear from an insider, either for or against this conspiracy theory.
(talking about leadership, not my lovely msft engineers reading this)
That is how Microsoft markets Azure. :-)
Hardware probably isn't going to do a lot with demand rising 10x or more at peak times, if they had scaled and tested systems with a view to supporting an order of magnitude more requests than expected then all that contingency resource is already gone. Adding 10% more hardware is going to be very expensive and will likely not have that much effect anyway without design changes to make better use of that hardware, scaling by orders of magnitude often reveals bottlenecks that were not apparent at the previous scales, or were apparent but dismissed (I imagine somewhere in a comment or design doc someone having written “we will need to rethink this if the system is to be asked to process 10ˣ⁺¹ things/period rather than 10ˣ”).
And once you've hired those people, even if they get up to speed pretty much instantly, a system change isn't going to be designed/made/rolled-out in short order so patchwork fixes are still needed in the meantime, and any roll-out probably needs to be gradual which adds further complication.
Scaling isn't easy. Scaling fast is a royal PITA.
The AI boom caught them napping though, and they're slipping well into the too unreliable category
Microsoft, who invested eyewatering sums into AI, even near to betting the whole company on an AI boom, is surprised about the AI boom?
I bet it's mostly due to Azure being brittle and the AI boom is just a nice cover story (not saying it's not challenging to handle all that new load) to save face and sell more Azure services.
Microsoft management knows this. It's not like there haven't been attempts to solve these core problems. The issue is GitHub was built by exceptional engineers, and none of those people are still around.
I maintain all these problems began when they migrated off Erlang and egitd. :)
The cloud does scale that easily, the software doesn't. :-)
What speaks against the volume activity is that GitHub works perfectly after an outage. People don't just stop AI coding after an outage. If anything, the volume should be higher for people to catch up.
It is more like rebooting a vibe coded WIN-95 because of a vibe coded integer overflow (joke).
Had these DATA and message been tossed around more people wouldn't be so frustrated and would be more understanding.
Additionally, there is a strategic reason to be the repository for all code, free, or not which is likely at conflict with reliability goals.
(e.g. they could get rid of their free tier which would improve reliability at the cost of allowing a new competitor to be the repository for all new AI driven code)
The long term strategic benefit of being the home to all code (or most of it) is enormous. They are likely balancing that strategic goal with what is seen as short-term internally as reliability.
Further, it is clear that Microsoft and GitHub have been strongly encouraging, if not requiring, AI tool use in their own, internal development. I have seen several automated PRs within GitHub repos that were 100% done by AI. Big surprise where that's leading.
Platform activity is surging. There were 1 billion commits in 2025. As of three months ago, it was 275 million per week, on pace for 14 billion this year if growth remains linear (spoiler: it won't.)
20% of all GitHub accounts were created in the past 6 months https://x.com/kdaigle/status/2082604368399159542