Comment by oliwarner | Hacker News Reader

Comment by oliwarner | Hacker News Reader

Facepalm. In this thread: A lot of overreaction from a lot of people who seem to expect the moon on a stick (for free) and who I could easily suspect have never had to run a resource-intensive system before.

Doing search well is computationally hard. More than that, it's next to impossible to cache for because there can be so many variants. All-in-all, it's the ideal sort of system to attack if you want to DDoS somebody.

Making people sign in is a tiny barrier to entry that stops anons hammering their system with uncacheable search requests.

Yes, there's probably also a business-marketing argument that goes into this but if that's the sort of trade-off we need to keep Github free for open source, indefinitely, I'm all for it.

And again, this is still free so stop being babies. If you don't like it you're very free to clone the repos out and search them yourselves. Want your anons to be able to search your stuff? Host it yourself and manage your own DDoSes.

Then one should get a couple of elastic search clusters, one for the guest users to hammer and DDoS and one for the authenticated users.

Not only does this make the search cheaper and easier for the guests (just an index of public repos, so no permissions involved), it makes it easier to continue offering search to authenticated users whilst being able to mitigate L7 DDoS on the authenticated search (just block the users involved in the attack).

Besides, there is a huge SEO benefit to having a searchable and discoverable interface, and a huge attention retention benefit to keeping users on your site to search once they have arrived there. On top of that, Github understand their data structures better than a search engine so it's easier to tune complex searches just for a codebase, or blog, or issue.

There's really no benefit to hiding search, and having written many community generated content sites the only reason I would hide search is as a stepping-stone to making the content part of a walled garden.

It's fairly inevitable Github will want to do this, I imagine they're looking at the number of users who are not signed-in or on free accounts as yet to be monetised. They would want more activity data to make arguments for advertising, or recruitment monetisation, or plan up-sell, etc.

That's where this makes sense, as a way to gather more user habit data.

I feel like in our present age SEO is vastly overstated.

Google at one point gave you a lot indicators to which pages people were landing on and why. Now all that information isn't shared with site operators, so it's impossible to qualify statements like "internal searchable interface lead to more Google search traffic".

Maybe it was true previously, maybe it was true even last month, but is it still true with the latest Google update---no one can measure.

Almost everything you mentioned does not make any sense.

1. Search is just not hidden in GUI for users, who are not logged in, but these users can still perform search as other people mentioned in comments

2. Github Search is definitely cached

3. It has nothing to do with DDOS. Do you expect Google requires you to sign in in order to prevent DDOS? Moreover, unless Github is totally wall-gardened, there are tons of ways to DDOS the service. I suggest you need to learn how DDOS actually works.

1. ?

2. No disagreement that searching for the same thing can be cached. But that's not the problem. Search for "banana" "banana 2" "banana 3", etc. It's very simple for a botnet to hit a search function like this with unlimited variance, making it impossible to cache against.

3. You think that Github and Google receive the same revenue benefits from providing a free search?

Do you understand how search works?

Guy, you're wrong. You can keep arguing, but that won't change reality.

If you're right, then this is the sort of backlash that could have been trivially avoided by Github explaining their reasoning.

If it were a core element of the system that was actually removed from their users, I might agree.

I am a user of GitHub. In part to protect against potential credential leakage through XSS and similar, and in part because I rarely actually need to log in to GitHub for the things that I do with it, I'm rarely logged in to my GitHub account. This change has a significant impact on my "workflow".

Search isn't removed for non-logged in users, it's just hidden, which makes your ddos point moot.

Reply on news.ycombinator.com