If an attack was launched only that whitelist would be allowed until the attack was mitigated.
So while certain legitimate traffic would be blocked for sure, people who connect through fixed ip addresses that were whitelisted would get through and be able to do what they needed to do.
Thoughts?
For a website of GitHub's scale, I don't think it would be very effective, though maybe it could be helpful in combination with other measures.
"Just have your botnet do a few regular old requests to the network a few days before launching."
Not talking about "whitelist sites that have made access in the last x days".
For example on HN it would be easy to create a white list. They do it now recognizing new people who signed up and keeping track of activity as well (by points).
You could either have people identify the ip address that they accessed from and further limit the whitelist to a certain period of time and activity additionally.
The idea is not to be 100% perfect but enough so that if you are a regular user of github from an IP address at your office (as opposed to wifi cafe) you will be able to get through.
This is, by the way, how registries limit access to their system. It's all whitelist you have to pre identify the ip addresses that you will access the system from.
The whitelist only comes into play when under attack. And for sure yes if you are connecting from a new place you will be blocked. But others will not be blocked and there will be some access for some people.
It will let a small percentage of non-whitelisted IPs in, but would filter the majority of them out.