Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google has been DDoSing Sourcehut for over a year

drewdevault.com

Post reply on HN
Print view View original

51–60 of 225 posts

Re: Google has been DDoSing Sourcehut for over a year

#51

Post by willcipriano »

forty wrote: post #25
kevincox wrote: post #21

Earlier quoted context omitted.

I think they are right not to obey robots.txt in this case. If I tell Go to download a module it shouldn't follow robots.txt because I am a human and I requested it. This is similar to if you had private iCal URLs on your server the right think would be to deny them in robots.txt (in case a crawler found a leaked link) but a service that is monitoring a specific iCal calendar should still fetch it. Basically robots.t…

Precisely, here the service is fetching stuff regularly even if no one is asking anything, if I understand correctly.

It apparently pulled a repo only used by the author 500 times in a day.

Re: Google has been DDoSing Sourcehut for over a year

#52

Post by 8organicbits »

garaetjjte wrote: post #42

I don't get it. Without the proxy, wouldn't all the (potentially larger) traffic just hit the server directly anyway?

My read is that there's a refresh job that's doing hundreds of full git clones even for packages that don't have users.

Package with approx. zero users: https://github.com/golang/go/issues/44577#issuecomment-85107...

Full clones: https://github.com/golang/go/issues/44577#issuecomment-78924...

They disabled refreshes (for someone else) to fix the issue: https://github.com/golang/go/issues/44577#issuecomment-86271...

So maybe there is some caching happening between the user and the mirror, but the mirror is hammering the origin with much more load than should be needed.

Re: Google has been DDoSing Sourcehut for over a year

#53

Post by striking »

reidrac wrote: post #49
FiloSottile wrote: post #46

Earlier quoted context omitted.

> In the meantime, if you would prefer, we can turn off all refresh traffic for your domain while we continue to improve this on our end. That would mean that the only traffic you would receive from us would be the result of a request directly from a user. This may impact the freshness of your domain's data which users receive from our servers, since we need to have some caching on our end to prevent too frequent fet…

So what is your opinion on the proxy behaviour then? I know is not like knowing what Google thinks about this, but I'm curious about how something like what is described in the post is allowed to happen.

I would be surprised if their opinion differs from that of the first link they sent.

Re: Google has been DDoSing Sourcehut for over a year

#56

Post by cookiengineer »

FiloSottile wrote: post #46
threatofrain wrote: post #14

> I was banned from the Go issue tracker for mysterious reasons, so I cannot continue to nag them for a fix.¹ I can’t blackhole their IP addresses, because that would make all Go modules hosted on git.sr.ht stop working for default Go configurations (i.e. without GOPROXY=direct). I tried to advocate for Linux distros to patch out GOPROXY by default, citing privacy reasons, but I was unsuccessful. I have no further re…

> In the meantime, if you would prefer, we can turn off all refresh traffic for your domain while we continue to improve this on our end. That would mean that the only traffic you would receive from us would be the result of a request directly from a user. This may impact the freshness of your domain's data which users receive from our servers, since we need to have some caching on our end to prevent too frequent fet…

How are his arguments in bad faith if he is the one that gets DDoSed by your software for over a year, and still tries to be helpful?

Not sure if you realize the absurdity of this, but he has to pay traffic and server costs. Like everyone else, except probably Google as it seems!?

I mean, you didn't even consider implementing a simple fetch of an already cloned repository in your mirroring server code. So yeah, I'd argue that the bad faith part is actually justified.

Re: Google has been DDoSing Sourcehut for over a year

#57

Post by toast0 »

klodolph wrote: post #33
toast0 wrote: post #10

If it were me, and I wasn't willing to just block the traffic, I might just set a 128 kbps limit on it and call it a day[1]. Eventually, the other side will figure out that their fetchers are all backed up and work out how to do their job without burning so much bandwidth. [1] Yeah, that can be a bit of a pain to setup depending on the server settings, but some people have to pay for bandwidth and server resources, s…

The rate limit is unlikely to cause a problem. Google has been crawling the web since its very start, and the internal services which fetch resources from external web servers are extremely resilient. Some request fails? Some request is slow? It's not going to slow down other requests. Maybe these services aren't being used for Go, but the expertise is on tap. (These kinds services are also supposed to rate-limit the…

> The rate limit is unlikely to cause a problem.

If that's the case, then great. It solves the DDoS issue without impacting the Google side, and everyone can be happy.

Re: Google has been DDoSing Sourcehut for over a year

#58

Post by generalizations »

FiloSottile wrote: post #46
threatofrain wrote: post #14

> I was banned from the Go issue tracker for mysterious reasons, so I cannot continue to nag them for a fix.¹ I can’t blackhole their IP addresses, because that would make all Go modules hosted on git.sr.ht stop working for default Go configurations (i.e. without GOPROXY=direct). I tried to advocate for Linux distros to patch out GOPROXY by default, citing privacy reasons, but I was unsuccessful. I have no further re…

> In the meantime, if you would prefer, we can turn off all refresh traffic for your domain while we continue to improve this on our end. That would mean that the only traffic you would receive from us would be the result of a request directly from a user. This may impact the freshness of your domain's data which users receive from our servers, since we need to have some caching on our end to prevent too frequent fet…

I see the fairly civil communication you had with Drew in the first link, but your inclusion of the second (given it's an unrelated issue) just feels like you're throwing mud in order to minimize the technical concerns he raised.

It seems like the only solution suggested there is one that makes the "small fish" service less useful as a go repository. I'm not surprised he didn't like it.

Re: Google has been DDoSing Sourcehut for over a year

#59

Post by Ventito »

crooked-v wrote: post #35
Ventito wrote: post #31

Have you not tried to get in concat with anyone else before? "mysterious reasons" Did you try go get in contact with them directly and clarify it? Did you talk to a moderator? Besides that, you are hosting code right? How is 70gb of traffic a DDos? I have to say, traffic numbers like you posted, would not concern me at all. I'm very curious why your underlying git usage can't do better caching.

> Did you try go get in contact with them directly and clarify it? Did you talk to a moderator? As noted in the article, he did, and then Google banned him without warning.

I was not able to find anything in this regard. I only saw a quite pro active ticket thread

Re: Google has been DDoSing Sourcehut for over a year

#60

Post by trhway »

one can definitely see what people are promoted for at Google :)

> the Go Module Mirror runs some crawlers that periodically clone Git repositories with Go modules in them to check for updates.

>The service is distributed across many nodes which all crawl modules independently of one another, resulting in very redundant git traffic.

basically slapping together a very inefficient alpha, and obviously people aren't promoted for fixing such glaring inefficiencies to make it even into a half reasonable beta.

And that is just hilarious, like people in Google never heard of CDN, HEAD, git fetch, etc. - of course they know it, and it is really just an arrogance of an 800lb gorilla toward "small-fish" - "https://github.com/golang/go/issues/44577#issuecomment-85692... - with a passive-aggressive blackmail of a cherry on top :

>In the meantime, if you would prefer, we can turn off all refresh traffic for your domain while we continue to improve this on our end. That would mean that the only traffic you would receive from us would be the result of a request directly from a user. This may impact the freshness of your domain's data which users receive from our servers

Post reply on HN