Ask HN: GitHub employees what's going on? Why?
Pretty self explanatory. Could you folks shed some light on why these issues keep happening?
I’ve noticed most posts and replies are just people coming to their own conclusions based on whatever published data.
I think it would be helpful to get some actual, non-corporate/marketing information on the goings-on by those that actually see what’s happening on the inside.
Thanks
Can
198 comments
[ 0.25 ms ] story [ 43.3 ms ] threadThe downtime also starts happening in 2020, which is a while after the acquisition. 2020 was the year many people started learning to code while being stuck at home.
After Microsoft acquired them, they started rolling out new features at an incredible pace. And if you look at the breakdown of the downtime, most of the downtime is in features that didn't exist before the acquisition.
Though not all of the downtime is in new features. The core is also less stable than ever.
My (not-so-actuarial 1990's-experience-colored) feeling is that this is Microsoft doing what Microsoft does best, namely including a lot of seemingly compelling features in a product to get people hooked and to keep competitors in a position of trying to keep up.
--------
[1] Possibly none, are you paying for a pro or enterprise account?
[2] There will be a little indirect income perhaps, via deriving value from tracking users and being able to use the combined content for various analytics (including lately AI training).
[3] Potentially reducing the cost/complexity of integrating disparate systems⁴, themselves.
[4] Sometimes in-house developed systems that might distract key devs from the company's products/services that they can sell.
Having been through a couple of acquisitions (as a cog in the machine being acquired, not a founder or purchaser or such), the last one at the end of 2025, and seen others as an unofficial close observer via friends/family, I think this is quite normal. No matter how thorough the due diligence and other investigations are pre-purchase, there will usually be an information gathering time before any significant changes are made. Even without that there are a couple of months being very careful not to rock the boat too much, so as to not put the willies up shareholders and key human resources. The first significant changes often won't happen for 3-to-6 months, unless part of the reason for the acquisition is that the company was on the verge of failing or was growing too fast to cope. During that time, unless key people jump ship early forcing change to an extent, things below certain management levels are much more business-as-usual than you might expect.
(Github did probably want a native CI implementation but I'm not really sure Actions was the way to do it. It seems so needlessly complex to me, not to mention the massive security issues. The rest of those features are just far from something I'd ever use so I don't even really know how to comment on them)
Platform activity is surging. There were 1 billion commits in 2025. As of three months ago, it was 275 million per week, on pace for 14 billion this year if growth remains linear (spoiler: it won't.)
20% of all GitHub accounts were created in the past 6 months https://x.com/kdaigle/status/2082604368399159542
Encouraging big commits seems antithetical to the idea of git in general.
OK so then use the additional revenue to add more resources and employees? What the f*k are they doing over there?
There are multiple kinds of limits you need. First you need the raw i/o limits on things like networking, load balancer requests per second, etc so you don't slow to a crawl on high load; you can throttle max i/o so demanding users don't steal performance for others, or even throttle network traffic to the client IP and internal services. Then you need additional limits at app layer, like number of requests you can process that make DB calls (as most DBs have a connection and request limit), or limit API requests to X/minute. Then you need more business logic limits, like max number of concurrent logged-in users, max number of repos a user can have, max number of requests for free users, priority for paid requests, etc.
When you hit a limit, you have a couple choices. You can shed load (dropping calls immediately, which results in 503 errors for users, or even network disconnects), but it makes a very poor user experience, and can cause larger issues/conflicts in a distributed system. You can instead keep a max number of active sessions, and adjust that number over time, to ensure that (on average) your users have a stable experience; this requires implementing a "waiting room" for new sessions when old ones expire or log out; still not great for users, but it prevents everyone from getting random errors, which means the majority of users have a good experience.
There are way more kinds of limits to implement. Each business has to analyze its entire system to identify performance bottlenecks and implement limits to ensure the majority of users continue to have good service. Without those limits, you get a shit experience for everyone, your brand is tarnished, and customers run for the hills.
Finally, the performance testing helps you plan how much infrastructure you need to serve a given number of users. If you plan properly, you know X infra allows for Y number of users. Once you exceed Y users, you need to start throttling or stopping new user signup (and requests per minute) until you can increase capacity. Continuing to allow signups and additional usage, without the capacity to support it, results in what we see today, which is the whole site being down for everyone.
Ironically the core application is written in rails, which may be part of the issue
Fixing small errors and keeping going on maybe is a good business strategy.
The last result is probably what you said.
The repo names all matched other GitHub apps, so my sense is this bot had added 1700 GitHub apps to 1700 repos, with that number rapidly increasing at the upper bound of whatever GitHub's rate limit is.
My systems caught it quickly and auto-booted the bot, but the whole situation is ridiculous.
If load was an issue these things would have been solved already. Or they are purposely causing millions of dollars of productivity loss daily by not solving this.
Something more serious is at play. And I want to hear from the actual underlings.
100% agree.
> Remember these folks hire people with plenty of system design experience.
Not my overall experience 30 years in the industry.
> They likely also have the money for hardware resources.
You'll always be asked to do more with less, at least, that's my own experience.
So even if these cloud/SAAS solutions perform poorly it is not like customers have wherewithal to create alternate solutions.
it's not impossible. they don't, right up until they do
Amazing you can say this with a straight face in these DC building times.
Have you tried getting Azure east instances anytime lately?
Hey man, in case you hadn't heard, the hardware industry is having a lot of trouble keeping up. "Expand our capacity" isn't as easy as it was 2 years ago.
Additional load reveals limits and breaklines that were never known before - your temporary integer IDs are suddenly too small, you reach the maximum file descriptors in a Linux distro, your hash function suddenly has repeating conflicts, your DB index is suddenly oversaturated.
Having massive exponential growth of your traffic would probably require constant refactoring to meet the ever changing system limits.
It's hard to design something (large and complex) for much more than 10X scale with only HW capacity increases.
Now however, it's competing for resources directly with the corporations core strategic plans.
GitHub having issues is embarrassing, but the shareholders don't really care.
Something about these two factors seems to have conspired to wreak absolute havoc on their uptime in the ~7yr hence. The AI slopocalypse hasn't helped matters, but the foundations were laid far earlier.
Would love to hear from an insider, either for or against this conspiracy theory.
Hardware probably isn't going to do a lot with demand rising 10x or more at peak times, if they had scaled and tested systems with a view to supporting an order of magnitude more requests than expected then all that contingency resource is already gone. Adding 10% more hardware is going to be very expensive and will likely not have that much effect anyway without design changes to make better use of that hardware, scaling by orders of magnitude often reveals bottlenecks that were not apparent at the previous scales, or were apparent but dismissed (I imagine somewhere in a comment or design doc someone having written “we will need to rethink this if the system is to be asked to process 10ˣ⁺¹ things/period rather than 10ˣ”).
And once you've hired those people, even if they get up to speed pretty much instantly, a system change isn't going to be designed/made/rolled-out in short order so patchwork fixes are still needed in the meantime, and any roll-out probably needs to be gradual which adds further complication.
Scaling isn't easy. Scaling fast is a royal PITA.
The AI boom caught them napping though, and they're slipping well into the too unreliable category
Microsoft, who invested horrendous sums into AI, even near to betting the whole company on an AI boom, is surprised about the AI boom?
I bet it's mostly due to Azure being brittle and the AI boom is just a nice cover story (not saying it's not challenging to handle all that new load) to save face and sell more Azure services.
Microsoft management knows this. It's not like there haven't been attempts to solve these core problems. The issue is GitHub was built by exceptional engineers, and none of those people are still around.
I maintain all these problems began when they migrated off Erlang and egitd. :)
[0] https://damrnelson.github.io/github-historical-uptime/
The cloud does scale that easily, the software doesn't. :-)
What speaks against the volume activity is that GitHub works perfectly after an outage. People don't just stop AI coding after an outage. If anything, the volume should be higher for people to catch up.
It is more like rebooting a vibe coded WIN-95 because of a vibe coded integer overflow (joke).
Had these DATA and message been tossed around more people wouldn't be so frustrated and would be more understanding.
Additionally, there is a strategic reason to be the repository for all code, free, or not which is likely at conflict with reliability goals.
(e.g. they could get rid of their free tier which would improve reliability at the cost of allowing a new competitor to be the repository for all new AI driven code)
The long term strategic benefit of being the home to all code (or most of it) is enormous. They are likely balancing that strategic goal with what is seen as short-term internally as reliability.
Further, it is clear that Microsoft and GitHub have been strongly encouraging, if not requiring, AI tool use in their own, internal development. I have seen several automated PRs within GitHub repos that were 100% done by AI. Big surprise where that's leading.
Pick one!
How many non Ruby apps and all the databases and systems behind could climb their traffic 14x when they probably only perf-tested for a sustained 2-3x and, and paid for a profitable amount of rack space rather than a “lol, VC money, we’ll 10x later” amount of infra.
You load test and see how much it takes until the system falls over - basically you DDoS yourself and see what the numbers were when things broke, and what broke first second so on. Maybe in a sandbox maybe against prod.
It's very telling that issues began almost to the day of the Microsoft acquisition.
Don't act shocked.
Also, gritty insider information is never the same as the official word.
Are you also shocked that you can stand in the middle of the highway and get hit by a car and die? You can do it if someone asks you but you’re not forced to.
See: https://news.ycombinator.com/item?id=49353915
Disclaimer: not a lawyer
- GitHub attempting (and seemingly failing) to move to Azure infrastucture for its website backend
- AI generated code wrecking the site due to the volume of activities.
https://x.com/mariorod1/status/2085800861469495465
I really think something deeper is going wrong there, and they're not being honest with their paying customers (and enterprises) about it.
This behavior is what led them to the current situation and will only get worse.
A technical foundation is not infinitely strong. Put a big enough castle on a swamp, and it will sink into the swamp.
Does the AI ever look back at the shit trail it left behind?
Diffs are no longer diffs, they look like largescale delete and rewrite
https://s-1.vercel.app/posts/why-dropbox-is-a-obvious-pe-tar...
Eventually, though, they decided to migrate the whole thing to Azure. And they were far enough through that to be basically committed... when AI coding started hitting them with much higher workloads.
I personally think the reliability problems are more to do with the reliability of the Azure migration. But both factors are likely relevant.
Ruby is single-threaded, slow with poor GC and memory leaks. As Twitter's Alex Payne said publicly in 2008: "there shouldn't be doubt in anybody's mind that Ruby itself is slow" and that scaling Rails meant "just throw more instances at it"
It's just pointless hacks on hacks. GitHub didn't need React on the frontend and any potential resource savings of client side rendering were lost when they realized they need to do SSR on that stuff too.
I've encountered so much frontend jank as they expanded that portion of the stack whereas it was always excellent when it was just Ruby SSR and minimal JS on the frontend.
Aug 17, 21:15 UTC Resolved - On August 17, 2026, from 13:28–21:15 UTC (7h 47m),
GitHub.com experienced elevated errors and latency across Issues, Pull Requests, APIs, Actions, and Copilot. At peak, web/API error rates were approximately 20%, while archive and raw-content downloads reached approximately 50%. SAML/OIDC authentication, SCIM, and Team Sync were also affected, as well as Actions workflows in GHEC with Data Residency that depend on public workflow step definitions hosted on GitHub.com. Most services recovered by 16:36 UTC as our Central US datacenter recovered; Actions was degraded until approximately 18:03 UTC; and Copilot Token Service fully recovered by 21:02.
Some of the failing traffic was moved from Central US to Northern Virginia where it was served successfully until the network failure in Central US was debugged and resolved. Delayed replies to a single internal endpoint triggered a latent retry bug in VS Code that amplified traffic by approximately 10x and caused delayed recovery for the Copilot Token Service.
The immediate cause of the failure was network saturation on load balancers in Central US due to a new peak in traffic. Originally this was caused by an Istio sidecar pod reaching its concurrency limits and failing to auto scale correctly because of a misconfigured policy that watched host service but not sidecar limits. One failure cascaded to more and eventually four HAProxy nodes exhausted their flow limits, degrading the gateway auth path and causing widespread authentication latency and failures. The problem was worsened by optimistic retry logic which overloaded internal load balancers. Pausing HAProxy on those nodes simultaneously produced immediate broad recovery. The retry storm in Northern VA was fixed by 1) temporarily reducing gateway retry logic with a PR and 2) blocking inbound Copilot Token Service token requests at the load balancers with a 403, and then gradually ramping back up traffic per-site to allow callers to succeed. Residual Copilot authentication failures continued because client retry behavior amplified load: a failed token operation could generate many extra requests and enter a retry loop. Copilot Token Service traffic increased from a normal 7–9K RPS to 70–100K RPS. Reducing gateway authentication retries and blocking retry-triggering responses stabilized Copilot Token Service and completed recovery.
Complicating factors that impeded recovery included a number of scraping attacks on codeload endpoints.
To prevent recurrence, our follow-up actions include:
- Correcting autoscaling policies to account for service-mesh sidecar concurrency and capacity.
- Auditing Istio request, concurrency, and scaling limits across affected services.
- Reviewing retry limits and backoff behavior across gateways and clients.
- Addressing the VS Code retry behavior that amplified Copilot token traffic.
So basically bad code pushes that caused request amplification and then huge gaps in operational scaling and reliability standards. Oof.
That was about 2 years ago. Im not kidding.
I dont know what the moral of the story is, but I found it weird at the time ( for added context - i was using AI back then about 10 hours a day, BUT I think sentiment on HN was "still" around the vibe of "you use AI to code without checking every line? I doubt your projects work" - but I had nothing better to do then wrestle with it and was surprised how I hadnt checked my code in weeks but stuff "worked". Its much better now and agents are accepted ofcourse but it sort of "snuck up" on people even in the tech community as recently as that.
I guess what Im saying is time is going quickly.