I really wonder what the rationale behind this move is. I wouldn't even have noticed as I'm practically always logged in, but was that search bar lowering the conversion rates to free users, or what?
I don't understand why one would DDOS Github. What is the reason for that?
http://arstechnica.com/security/2015/03/github-battles-large...
DDOS scripts create new sessions on every attack request. It's a very hard problem to solve without blocking legitimate traffic too.
Simply sign your session ids with an HMAC, to verify the id without any I/O! And require something expensive to create a session (such as a hash-based challenge request). Sessions are usually not needed for static sites, so by the time the person searches, their browser will have earned one session. A spammer on the other hand wouldn't have the computational power to create the various sessions. Also, if a spammer's IP is detected, the computational complexity can be increased for that IP.