RawGit

» see rawgit.com as it lived, on the wayback machine

~ the obit ~

RawGit did one small thing. GitHub serves raw repository files from raw.githubusercontent.com as text/plain, which is correct and safe and also means a browser will refuse to run them. Swap the hostname for rawgit.com and the same bytes came back with the content type the file deserved, so a JavaScript file behaved like JavaScript and a stylesheet like a stylesheet. That was the whole product. Ryan Grove pushed the first commit on 30 January 2013 and later described it as a small hobby project he had never been able to spend more than a handful of minutes a week on.

It escaped anyway. Every tutorial that needed a working demo and every forum answer that needed a live script tag reached for a rawgit.com URL, because it was one hostname edit away from a repository the author already had open. Nobody had to sign up or provision anything. By September 2018 the service was answering 4.2 billion requests a month and moving more than 176 terabytes of other people's files. Grove called those numbers unfathomable in his own farewell, and said they were almost too huge to be real.

In August 2018 somebody else noticed the same property. A file in a public GitHub repo, cached and handed back with a real content type, was a clean delivery path, and attackers began pushing cryptomining scripts into WordPress and Drupal installs through it. On 8 October 2018 the homepage became a notice: "RawGit is now in a sunset phase and will soon shut down. It's been a fun five years, but all things must end." He named the reason directly. "RawGit was meant to improve people's lives, but jerks are increasingly using it to hurt people," Grove wrote, adding that fighting it would be no fun even if he had the time.

Anyone who wrote for the web between 2014 and 2018 probably shipped a rawgit.com URL without ever choosing to. That is how infrastructure of this kind spreads. Somebody pastes a snippet, the snippet works, and five years later the snippet is in your repository with your name on the commit. My own relationship with RawGit was exactly that shape: no account, no FAQ, no notion that a single person was carrying it. A hostname in somebody else's code that happened to resolve.

~ the rap sheet ~

~ the sushi ~

The logo was a piece of nigiri. Raw git, raw fish, a salmon slice over rice drawn in flat orange, sitting at the top of a page that otherwise looked like documentation. It sits on the farewell notice too, still there in the 2026 captures, above a paragraph about malware.

~ 176 terabytes in a month ~

The sunset notice has a detail most shutdown letters leave out, which is the traffic bill in plain numbers. RawGit was not a company and had no revenue line to protect, so Grove simply printed what it was costing in requests and bandwidth. A free service answering 4.2 billion requests a month has no mechanism for saying no to the four billion and first, and no way to tell a tutorial from a payload.

The notice was also precise about who kept working. Repositories that had served content through RawGit in the previous month would keep being served until at least October of 2019. Everything else was already cut off on the day the notice went up, which means the service closed to new use immediately and spent its final year as a grandfathering scheme for code that was already deployed.

~ what still points at it ~

The Archive can date the end almost to the day. The last capture of cdn.rawgit.com that comes back with actual file contents is from 28 October 2019, a minified JavaScript library pulled at 23:22 UTC. Captures after that return HTTP 200 with an empty body. That is a CDN answering politely with nothing. Grove had promised October 2019 and delivered October 2019.

Today cdn.rawgit.com returns a bare 400. The apex redirects to github.com/rgrove/rawgit, an archived repository with 2,410 stars and a description written in the past tense. The sunset page itself is still out there in the Archive, and it is byte-for-byte the same document in 2026 that it was in 2018, which makes it one of the easier death certificates to read. Somewhere a tutorial from 2016 still carries the script tag, pointing at a hostname that has not handed back a file in seven years.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »