Tell HN: Gitlab.com doesn't allow issue search without signing in | Hacker News Reader

Tell HN: Gitlab.com doesn't allow issue search without signing in

48 pointsoefrha20 comments

I was searching for an issue on gitlab.com just now, and noticed I couldn't search any project's issue tracker without signing in: a banner says "You must sign in to search for specific terms." To reproduce, simply open https://gitlab.com/gitlab-org/gitlab/-/issues/ in a private browsing session and try to search for any term.

I'm shocked by the user hostility. There's zero chance I'm going to move my open source projects to gitlab.com if users can't even search the issue tracker without creating a GitLab account and signing in. Truly baffling decision.

I was so shocked I dug deeper and tracked down the offending code and MRs that introduced them (appreciate the ability to do this, I'll give them that). This is controlled by a feature flag :disable_anonymous_search and manifests as <div class="js-issues-list" data-is-anonymous-search-disabled="true" ...> in rendered HTML. Relevant MRs from 10 months ago:

- https://gitlab.com/gitlab-org/gitlab/-/merge_requests/70223

- https://gitlab.com/gitlab-org/gitlab/-/merge_requests/70249

I don't see any justification given, but the former MR says "Related to #340716" which doesn't link to anywhere, and https://gitlab.com/gitlab-org/gitlab/-/issues/340716 is 404, so maybe something internal?

The feature flag also doesn't appear to be default-on for self-hosted instances.

Edit: Removed a potentially controversial aside since I don’t want to steer the conversation that way.

I think that is due to bots causing performance impact and the easiest way out is mandatory login + banning/rate-limiting searches for authenticated users. I can't remember where I read about this though, overall GitLab had lots of bot/scraping performance issues in the past and the GitLab project has so many issues that it's particularity expensive to maintain.

This may be a case where a CAPTCHA test may be a good alternative to logging in. That could have less tracking potential.

I am pretty sure it is performance optimization, as keyword search can be potentially very expensive for database. And restricting this to logged-in users (1) decreases searches made by bots and spiders and (2) allows efficient ratelimit of requests if needed.

Note that github has something similar: the code search does not work if not logged in. They don't restrict issue search however.

GitHub only limits global code search when not logged in, you can search in any specific repo just fine. That’s not even remotely comparable. How often do you need to search an issue tracker (and think of users who may not be developers), how often do you need to search through all code on GitHub?

Gitlab has been having growing pains over time, I imagine this is related to bot traffic. Many of their APIs have had similar limits put on them, and request limits added in the last year.

I imagine keeping Gitlab.com performant has been really difficult with their growth, and keeping expensive operations open is counter productive to that objective.

GitHub is only slightly better (in this regard). You can't perform an "advanced search" without logging in.

Still, I'd rather use GitLab ober GitHub.

What advanced search? https://github.com/search/advanced certainly works without signing in.

For repos, sure (which is way better than GitLab's status), but you can't search for line-by-line code.

You can’t search for code across the entire GitHub without signing in. You can search in a single repo just fine. That’s a three orders of magnitude smaller concern. I do research on GitHub in incognito windows daily.

I wanted to do a repository search on gitlab, as I often do on github to look for existing software projects to build off of. This because a project I found was hosted on gitlab, and I thought there might be others as well if I looked for them. After creating an account I was able to search some of the keywords from the description of the one project I found, but very few results turned up; notably missing was the very project I found initially. I've noticed that github will sometimes rate limit me after performing a few too many searches, but I there approach is still better than gitlab's in this regard. I see this, among other things, as a serious deficiency of gitlab as a replacement for github in the space of hosting open software projects, as many have positioned it to be.

I saw this recently too, i actually just thought the search was broken and I gave up on trying to search until i tried to search another gitlab project a few days later and saw the popup notice.

I dont use it for anything myself currently and will stick with codeberg, sourcehut and during working hours, github.

Yes, the banner isn’t even consistently shown, in certain cases nothing happens at all.

Just hit that myself a few minutes ago.

Was testing a new program, and wanted to search the issues to see if someone had the same sort of UI problems I had (and hopefully a fix). No luck there.

I then googled to see if someone had a workaround for the GitLab search issue, and found your post :p

Decided to not switch to the new app.

I honestly don’t get why this is such a big deal when accounts are free.

It's still annoying if you happen to be on a device you're not logged in with (e.g. I very rarely need gitlab at work, so my work machine isn't logged in, same with my phone - for a while Github had the same restriction and I ran into it regularly)

Completely understandable that it’s annoying. What’s not obvious is whether this annoyance is a big deal and outweighs other tradeoffs.

There has been a strong push for sites to start making people have accounts so that they can collect first party data for marketing purposes. This is a workaround to allow data slurping to continue in the face of all the various ways people have been working to limit it.

As a result, I don't make accounts on sites anymore unless it's unavoidable. Whether or not its free doesn't enter into it.

They aren't. Maybe free in upfront cash, but definitely not free in mental load and time spent to babysit them.

Every account is one thing more that you're responsible for, that you have to remember, can be hacked, will send you spam, etc.

Is it possible to comment on that PRs? If yes - have you tried asking there for content of linked hidden issues?

Clickable links:

https://gitlab.com/gitlab-org/gitlab/-/issues/

https://gitlab.com/gitlab-org/gitlab/-/merge_requests/70223

https://gitlab.com/gitlab-org/gitlab/-/merge_requests/70249

Reply on news.ycombinator.com