Live data from Hacker News

Google has been DDoSing Sourcehut for over a year

drewdevault.com

11–20 of 225 posts

Re: Google has been DDoSing Sourcehut for over a year

#11
post #9

Wait... Why not black hole them? Make it their problem and they'll eventually do the correct thing.

" I can’t blackhole their IP addresses, because that would make all Go modules hosted on git.sr.ht stop working for default Go configurations (i.e. without GOPROXY=direct)"

Re: Google has been DDoSing Sourcehut for over a year

#12

This is still occurring? I remember the original incident and just assumed that Google had sorted it out with Drew/Sourcehut. This is absolutely shocking behaviour, and I’m mortified at the precedent that it sets.

They didn't sort it out, they just banned him from commenting. So kind of problem solved for Google?

Re: Google has been DDoSing Sourcehut for over a year

#13
post #10

If it were me, and I wasn't willing to just block the traffic, I might just set a 128 kbps limit on it and call it a day[1]. Eventually, the other side will figure out that their fetchers are all backed up and work out how to do their job without burning so much bandwidth. [1] Yeah, that can be a bit of a pain to setup depending on the server settings, but some people have to pay for bandwidth and server resources, s…

I guess this is the professional response ;) I would just blacklist the IP addressess, just to see what would happen.

Re: Google has been DDoSing Sourcehut for over a year

#14
> I was banned from the Go issue tracker for mysterious reasons, so I cannot continue to nag them for a fix.¹ I can’t blackhole their IP addresses, because that would make all Go modules hosted on git.sr.ht stop working for default Go configurations (i.e. without GOPROXY=direct). I tried to advocate for Linux distros to patch out GOPROXY by default, citing privacy reasons, but I was unsuccessful. I have no further recourse but to tolerate having our little-fish service DoS’d by a 1.38 trillion dollar company. But I will say that if I was in their position, and my service was mistakenly sending an excessive amount of traffic to someone else, I would make it my first priority to fix it. But I suppose no one will get promoted for prioritizing that at Google.

> [1]: In violation of Go’s own Code of Conduct, by the way, which requires that participants are notified moderator actions against them and given the opportunity to appeal. I happen to be well versed in Go’s CoC given that I was banned once before without notice — a ban which was later overturned on the grounds that the moderator was wrong in the first place. Great community, guys.

Re: Google has been DDoSing Sourcehut for over a year

#15
post #10

If it were me, and I wasn't willing to just block the traffic, I might just set a 128 kbps limit on it and call it a day[1]. Eventually, the other side will figure out that their fetchers are all backed up and work out how to do their job without burning so much bandwidth. [1] Yeah, that can be a bit of a pain to setup depending on the server settings, but some people have to pay for bandwidth and server resources, s…

Or you could mess with a random percentage of the requests: tarpit them, drop random packets, reply with malformed answers etc. If you keep the percentage low they might have a fun time debugging :)

Re: Google has been DDoSing Sourcehut for over a year

#16
post #4

> The Go team holds that this service is not a crawler, and thus they do not obey robots.txt This seems wrong. I guess I always assumed that robots.txt applied to non-humans.

I'm sure the reasoning would be something along the lines of these requests being made in response to user activity of some sort.

Re: Google has been DDoSing Sourcehut for over a year

#17
post #12

This is still occurring? I remember the original incident and just assumed that Google had sorted it out with Drew/Sourcehut. This is absolutely shocking behaviour, and I’m mortified at the precedent that it sets.

They didn't sort it out, they just banned him from commenting. So kind of problem solved for Google?

[deleted]

Re: Google has been DDoSing Sourcehut for over a year

#18
post #13
post #10

If it were me, and I wasn't willing to just block the traffic, I might just set a 128 kbps limit on it and call it a day[1]. Eventually, the other side will figure out that their fetchers are all backed up and work out how to do their job without burning so much bandwidth. [1] Yeah, that can be a bit of a pain to setup depending on the server settings, but some people have to pay for bandwidth and server resources, s…

I guess this is the professional response ;) I would just blacklist the IP addressess, just to see what would happen.

Yeah, but that's not an option according to the article.

> I can’t blackhole their IP addresses, because that would make all Go modules hosted on git.sr.ht stop working for default Go configurations (i.e. without GOPROXY=direct)

Re: Google has been DDoSing Sourcehut for over a year

#19
Probably the most egregious part is the footnote:

```

I was banned from the Go issue tracker for mysterious reasons[1], so I cannot continue to nag them for a fix.

[1]In violation of Go’s own Code of Conduct, by the way, which requires that participants are notified moderator actions against them and given the opportunity to appeal. I happen to be well versed in Go’s CoC given that I was banned once before without notice — a ban which was later overturned on the grounds that the moderator was wrong in the first place. Great community, guys. ↩

```

What happened to "don't be evil" I wonder? (And I know, it's that Google has now become a big grown up corporation)

Re: Google has been DDoSing Sourcehut for over a year

#20

The fact that a programming language calls home to by Google by default should make it a non-starter for most sane developers. The fact that it calls home so it can DDoS other sites is low-key hilarious. And you'd think Google would know how to like... operate an efficient CDN, perhaps? Like, if this was managed by a competent company, you'd think this service would be akin to putting Cloudflare in front of your serv…

Are you going to get upset at node for calling home to Microsoft (npm owned by github owned by microsoft) when using the supplied package management too?

If you're pulling down a packge with npm that isn't part of the npm registry, the request isn't going through a Microsoft proxy.
Post reply on HN