Cheers! That era of the internet was such a fun chunk of time. All the little design tricks and bite-sized approaches people shared… it was a lot of fun.
That's been my biggest annoyance lately. Everyone's trying to AI these sorts of things, but for people who get a lot of these frequently, it's pretty easy to spot. Talk like a human and you can go pretty far, though.
Really amusing to read this one. I did something similar for Qatar 2022 and got access to roster submission (https://zachholman.com/posts/hacking-fifa). To their credit they patched it pretty quickly, but their promised "token of appreciation" never came. (Although on the other hand, they didn't sue me, so I guess that's a win.)
Out of curiosity, was the guy known for being fast and loose with the rules? Put more simply, was he a good cop? Or did he have a history of being a rogue.
404s were designed for performance, as OP says here, but also to be as simple as possible.
Part of the difficulty was info leakage; early on there was a lot of concern that a 403 would imply the existence of a repo that the org might otherwise not want known publicly. This was a little trickier in practice, really: early versions of the page took slightly different pathways as it went through auth, so based on the duration of the page to render you could make some assumptions about whether the underlying repo existed or not. It was annoying to sort out, so it wasn't touched very often.
Certainly a lot could have been done with 404s over the years; they've only gotten worse. I put ultrathin font weights on the error pages move than a decade ago, when they were en vogue, and it kills me every time to see them still there. And, of course, the parallax effect has been removed, so now it's just sort of a dorky Star Wars or Looney Tunes reference without a lot behind it. Weird.
Hah, no, that wasn't a thing at the company back then. 220k is large; not sure what snapshot of the page they were looking at at the time, but in any case "performance" in this context means server-side perf.
Amusing to read this and think back on GitHub's seed round ($100M). At the time we just had a small business account from Bank of America... going from relatively thin cushion in the account over the previous few years to suddenly dropping in $100M was pretty amusing. I believe we moved to a more sophisticated setup quickly thereafter.
