Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google has been DDoSing Sourcehut for over a year

drewdevault.com

Post reply on HN
Print view View original

41–50 of 225 posts

Re: Google has been DDoSing Sourcehut for over a year

#41

Post by Rantenki »

joshuamorton wrote: post #26

There is a very simple way to get them to stop sending the .5 qps that is described as a ddos. The linked bug show another user successfully saying "please opt me out", and Google building the feature to do that in a week. Drew has for some reason chosen not to ask for an opt out, even though it appears trivial and would probably be fixed by the weekend if he asked for it.

Calling it .5 QPS to downplay the severity is willfully ignoring the complaint in the article. It's not just a query, it's a full Git clone of the entire repo with it's history. That's a huge difference.

Re: Google has been DDoSing Sourcehut for over a year

#43

Post by captainmuon »

It sucks having to work around something like this, but maybe the following would work: only allow the first checkout from a given Go node, blackhole later accesses. If the repository is modified or a certain time elapsed, reset and allow a download again.

Also, if you want to escalate, I wonder if there is a way to create a fake git repository that expands to a huge amount of data when cloning, but uses minimal bandwidth on the server side. Set up a bunch of those on some other host, and use them from go, and wait until google notices. Something like this: https://github.com/ilikenwf/git-zlib-bomb

Re: Google has been DDoSing Sourcehut for over a year

#44

Post by 8organicbits »

From https://github.com/golang/go/issues/44577#issuecomment-85107...

> Yesterday, GoModuleMirror downloaded 4 gigabytes of data from my server requesting a single module over 500 times (log attached). As far as I know, I am the only person in the world using this Go module.

From https://github.com/golang/go/issues/44577#issuecomment-78924...

> yes we make a fresh clone every time

I like golang as a developer, but this is a terrible implementation. I'm somewhat tempted to say that blocking the Google IP addresses is the correct answer in that it will force some sort of wider action (linux repos setting `GOPROXY=direct`, Google fixing their code, or unfortunately, golang modules moving off sourcehut).

Re: Google has been DDoSing Sourcehut for over a year

#45

Post by joshuamorton »

mig39 wrote: post #36
joshuamorton wrote: post #26

There is a very simple way to get them to stop sending the .5 qps that is described as a ddos. The linked bug show another user successfully saying "please opt me out", and Google building the feature to do that in a week. Drew has for some reason chosen not to ask for an opt out, even though it appears trivial and would probably be fixed by the weekend if he asked for it.

I think he's been banned from the issue tracker.

Possibly, but he was actively participating in https://github.com/golang/go/issues/44577 up until the week it was fixed.

If that's the root of the issue though, most of the article ("no one will get promoted for prioritizing that at Google.", "the go team has not prioritized it", etc.) is wrong. They may not have addressed the issue in the precise way he wanted, but I also think it's rather unreasonable to expect someone to not only address your issue, but address it in the precise way you suggest.

That's rarely globally optimal and feels rather entitled.

Re: Google has been DDoSing Sourcehut for over a year

#46

Post by FiloSottile »

threatofrain wrote: post #14

> I was banned from the Go issue tracker for mysterious reasons, so I cannot continue to nag them for a fix.¹ I can’t blackhole their IP addresses, because that would make all Go modules hosted on git.sr.ht stop working for default Go configurations (i.e. without GOPROXY=direct). I tried to advocate for Linux distros to patch out GOPROXY by default, citing privacy reasons, but I was unsuccessful. I have no further re…

> In the meantime, if you would prefer, we can turn off all refresh traffic for your domain while we continue to improve this on our end. That would mean that the only traffic you would receive from us would be the result of a request directly from a user. This may impact the freshness of your domain's data which users receive from our servers, since we need to have some caching on our end to prevent too frequent fetches.

https://github.com/golang/go/issues/44577#issuecomment-85692...

> "EFAIL" is an alarmist puff piece written by morons to slander PGP and inflate their egos. [...]

https://github.com/golang/go/issues/30141#issuecomment-46427...

Disclosure: I was on the Go team at Google until earlier this month. Dealing with DeVault's bad faith arguments is one of the few things I won't miss of that job.

Re: Google has been DDoSing Sourcehut for over a year

#47

Post by uoaei »

tptacek wrote: post #38
crooked-v wrote: post #35

Earlier quoted context omitted.

> Did you try go get in contact with them directly and clarify it? Did you talk to a moderator? As noted in the article, he did, and then Google banned him without warning.

That's not what the article says. It says he doesn't know why he was banned; it doesn't establish causality.

The comment above does not claim causality, only a suggestive ordering of events.

Re: Google has been DDoSing Sourcehut for over a year

#48

Post by pretext-1 »

ocdtrekkie wrote: post #6
sascha_sl wrote: post #5

Earlier quoted context omitted.

Are you going to get upset at node for calling home to Microsoft (npm owned by github owned by microsoft) when using the supplied package management too?

I mean, I strongly just feel the npm ecosystem is a dumpster fire of sadness. Though there is a fundamental difference in that if you use NPM, you are choosing to download packages from NPM. But if you specify a bunch of repos you want to download Go packages from, and you get them from Google anyways, that's pretty uncomfortable. Especially if Google is in turn also DDoSing the repos in return.

No I did not "choose to download packages from NPM". Choosing means there is an alternative. And besides that the registry part is invisible in your package file (hardcoded default like GOPROXY).

If you look at it, it's pretty similar. The part before the first slash is invisible:

npmjs.com/org/package

proxy.golang.org/org.com/package

The difference with Go is that you can actually change the first part if you want, or even disable it.

Re: Google has been DDoSing Sourcehut for over a year

#49

Post by reidrac »

FiloSottile wrote: post #46
threatofrain wrote: post #14

> I was banned from the Go issue tracker for mysterious reasons, so I cannot continue to nag them for a fix.¹ I can’t blackhole their IP addresses, because that would make all Go modules hosted on git.sr.ht stop working for default Go configurations (i.e. without GOPROXY=direct). I tried to advocate for Linux distros to patch out GOPROXY by default, citing privacy reasons, but I was unsuccessful. I have no further re…

> In the meantime, if you would prefer, we can turn off all refresh traffic for your domain while we continue to improve this on our end. That would mean that the only traffic you would receive from us would be the result of a request directly from a user. This may impact the freshness of your domain's data which users receive from our servers, since we need to have some caching on our end to prevent too frequent fet…

So what is your opinion on the proxy behaviour then?

I know is not like knowing what Google thinks about this, but I'm curious about how something like what is described in the post is allowed to happen.

Re: Google has been DDoSing Sourcehut for over a year

#50

Post by tptacek »

Rantenki wrote: post #41
joshuamorton wrote: post #26

There is a very simple way to get them to stop sending the .5 qps that is described as a ddos. The linked bug show another user successfully saying "please opt me out", and Google building the feature to do that in a week. Drew has for some reason chosen not to ask for an opt out, even though it appears trivial and would probably be fixed by the weekend if he asked for it.

Calling it .5 QPS to downplay the severity is willfully ignoring the complaint in the article. It's not just a query, it's a full Git clone of the entire repo with it's history. That's a huge difference.

That's what a "Q" means in this context. It's a git hosting service.
Post reply on HN