Hacker News Reader

Comment by mgraupner | Hacker News Reader

This feels like a move away from offering the greatest opensource project hosting site to a walled garden. I was just browsing some repository and found a non linked reference to another project which probably is also on Github but there is no way of searching for it when I'm not logged in (and knowing the search URL somebody posted earlier). Pretty big UI fail and I wonder if this was intentional and if so if they took into account the annoyed users... I hope this will gain some more attion than the 6 comments right now, I really like Github for just browsing and exploring new projects, no need to be logged in for doing this and hopefully not just the first step to a more business driven Github.

View on HN

I feel like this is a part of a trend that reflects how github itself is changing - slowly making access to things harder, then finally removing it.

Github used to have an awesome and public way to explore projects (http://web.archive.org/web/20130730125837/https://github.com...) - I remember using it a lot to look for projects to learn to read code because it allowed me to easily find projects by language. They replaced it with a flashier, but in my experience, much less useful tool that you have no control over - https://github.com/explore .

I know I'm not the only one thinking of moving my repos to another provider or perhaps a self-hosted solution because of this direction.

> They replaced it with a flashier, but in my experience, much less useful tool that you have no control over - https://github.com/explore .

Not quite sure if I understand which specific thing you are mentioning, but does https://github.com/trending happen to be what you want?

OTOH, a trend towards self hosted solutions will only make finding projects to explore harder.

Or create the demand for an index/curation platform/search engine, which would be something quite interesting, I think.

Google had one but they shut it down.

"Back in the old days" we had Freshmeat...

gitlab.com is a fine compromise, albeit I'm not a fan of their "private repos for free" model, it means a lot of software that might have utility if it were default-open will be lost behind default-privte repositories.

But if gitlab jumps the shark like github is doing we can always have anyone in the ecosystem selfhost a clone, albeit we would need to reimplement all the enterprise features people want.

In my experience it was the other way around. I signed up with gitlab only because they offer free private repos. Now since I already have an account with them and I don't have to go through the hassle of setting up stuff again, I'm only a couple clicks away from putting some project in the open.

Self hosted solutions lend themselves towards being freely indexable via search engines, many of which are optimized towards source code repositories.

Like the move to self-hosted websites made finding websites harder? /s

As danmaz74 said, this will fragment the open source scene over multiple platforms which makes it harder to discover. Github always felt nice as a home for all these projects, I don't get the need for this move either. They must know that people contributing to open source rather not want their stuff to be hidden behind some wall. I just wish they would have continued their offering, in my books they were the good guys, helping open source to new hights but also do well on a business side. I guess I was wrong.

If anything, github's lock-in fragmented "the open source scene". The internet and the web are distributed systems, there is no reason why all code has to be hosted with one proprietary service in order to be discoverable, just as there is no reason for hosting all websites with one proprietary service in order to be discoverable. That's what standardized protocols and interfaces are for.

There's no lock-in with github. It's a service that many people prefer to use, but nothing is stopping anyone from moving their repos elsewhere.

Well, first, there is lock-in for non-owners of projects: You cannot submit pull requests to pull from git repositories hosted elsewhere and without signing in. Which also is an incentive to use it for other things, once you have an account that you need in order to contribute.

Secondly, they do have proprietary features, embrace, extend, extinguish style.

Unless they convert repos to a proprietary format that requires a Github client to use, don't allow git cloning or pushing, and are trying to add Github-only features to git itself, then I think "embrace, extend, extinguish" is a bit overblown.

That's not how it works. Microsoft didn't add Windows-only features to Netscape either. It added them to IE. And then lured people into using those in order to make them dependent on these proprietary features and in order to decrease interoperability of websites using those extensions with other browsers.

Was this possible with any previously popular solution?

The only thing I can think of is patches via email, but that's just using no repository at all.

I don't follow ... patches via HTTP is a repository, patches via email is not?!

But apart from sending changes via email (which is actually a very good way to go for small(ish) changes--actually, it is so good, the Linux kernel developers use exactly that: git can generate emails that are both human-readable, so you can easily review and comment on patches, but also can be imported automatically into a repository by the recipient), you can just send pull requests via email? You simply put into an email the URI of your git repository, wherever it is hosted, and the recipient can pull from it. That is the power of an open distributed system like the internet.

And to spin this a bit further: Actual "hosting" isn't even necessary technically. Especially once we get rid of IPv4 and NAT, it should be trivial to spin up a git server instance on your workstation (or maybe your smartphone, as that probably is online 24/7) so people can pull from there. Whether that is practical? It well might be--but my point is more to show what is technically possible.

And yes, all of that was possible with a "previously popular solution"--git existed before github, obviously, and its popularity is what caused github. Also, all of that applies just the same for other distributed SCMs, of course.

I really wonder what the rationale behind this move is. I wouldn't even have noticed as I'm practically always logged in, but was that search bar lowering the conversion rates to free users, or what?

Probably because Github is constantly under DDOS attacks, search is computationally expensive, and they can't rate limit unauthenticated sessions. http://m.theregister.co.uk/2015/08/26/github_wobbles_under_d...

Google rate limits unauthenticated sessions. Try using Google over tor. They are pretty heavy-handed about it too. Github isn't tiny enough to use ddos as an excuse.

TOR still uses cookies so a session ID can be set for the user agent and rate limited.

DDOS scripts create new sessions on every attack request. It's a very hard problem to solve without blocking legitimate traffic too.

Not that difficult!

Simply sign your session ids with an HMAC, to verify the id without any I/O! And require something expensive to create a session (such as a hash-based challenge request). Sessions are usually not needed for static sites, so by the time the person searches, their browser will have earned one session. A spammer on the other hand wouldn't have the computational power to create the various sessions. Also, if a spammer's IP is detected, the computational complexity can be increased for that IP.

Well, at some point you have to block legitimate traffic. My thought was it doesn't have to be black and white. Maybe require the user to solve a captcha after the nth search from the same IP address? How big are the biggest of botnets? A few hundred thousand computers? Or maybe even require captcha for every unauthenticated search.

You mean just for the first one, to get a session id.

Millions.

Rate limiting is IP based, not session based.

That cannot be the case, becuse you can still search, it is just missing from the UI: https://news.ycombinator.com/item?id=11322207

Yeah, probably one of the reasons.

I don't understand why one would DDOS Github. What is the reason for that?

Hosting NYTimes articles critical of China.

http://arstechnica.com/security/2015/03/github-battles-large...

Street cred.

Perhaps search is expensive, so they are trying to limit the number of searches. I know there is a stricter rate limit for searches in the API.

About following references to other repos, there's this Chrome Extension I built that is slightly related:

http://fiatjaf.alhur.es/gh-browser/

It adds links directly to GitHub source code (to other GitHub repos or external documentation) whenever it finds import/require statements.

Reply on news.ycombinator.com