Hacker News Reader

Looks like they didn't rate-limit per-user, but only per-IP.

Now that is dumb. I expected more from GitHub.

If they rate limited per user, you could trivially prevent someone from logging in by pummeling the server with login attempts for their username.

If there are limits per-user and per-IP, they would need a shit ton of IPs to do that to any reasonable number of users.