20 comments

[ 3.1 ms ] story [ 110 ms ] thread
Can you fork that test repo via the API?
There is an API endpoint for file listing so even if it is not possible to fork it using Git, one could probably just list and fetch contents of all the files in the repo, effectively having cloned it.
You can go to a random user that you have not followed, and inspect the "Follow" button, change the action of the form to "/users/follow?target=-" and press it.
Very cool find! Just checked this on the GitHub mobile beta (https://github.com/mobile), and Dash shows up in searches and from a bit of light perusal seems fully functional (following/unfollowing/starring).

So the 500’s on github.com are likely somewhere in the rails layer.

I forked the repo here: https://github.com/tyingq/test and it bombs with http 500 if I browse from desktop, but not from a mobile browser.

The README.md bombs in either: https://github.com/tyingq/test/blob/master/README.md

Which is curious...

Edit: Unrelated, but the 500 pages pull in this js: https://github.com/_error.js Which has some interesting stuff at the bottom that watches for a keypress consisting of a backtick, that then does: window.location = '/site/toggle_site_admin_and_employee_status'

Poking around the ruby code, it looks like it's any place that GitHub attempts to generate a link back to itself. The formatter generates the URI and then validates it against the route matcher, notices that the username constraint isn't matched and bombs out at that point.

I'm not familiar enough with this code to know the potential side effects of changing that, so I'll file an issue for now, but that' the gist of it, for those curious!

Is it just me or is anyone else tired of these click-baity headlines? Is it to much to ask for a short sentence that actually describes what it is?
i'd wager the restrictions on leading dashes are to prevent command switch injection attacks on users
Perhaps, but the restrictions also line up with requirements to be a valid DNS hostname.
i believe those restrictions are for the same reason. I have a few leading dash hostnames and i only use them for attacking cli tools
Fun read. Their tool has a website where you can test it, but unfortunately it only works on my personal GH username, not my work one. Seems that it's maybe not fully-baked yet. It's an interesting idea though for a side project.
Since GH URLs are github.com/<name>, you also can't register usernames like @login, since that would cause a conflict. However, @case-studies and @customer-stories both are content pages (well /case-studies redirects to /customer-stories) and users. Those two users also cause weird things when interacting with the website and API.