Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google has been DDoSing Sourcehut for over a year

drewdevault.com

Post reply on HN
Print view View original

91–100 of 225 posts

Re: Google has been DDoSing Sourcehut for over a year

#91

Post by verdverm »

ocdtrekkie wrote: post #74
johnduhart wrote: post #69

Earlier quoted context omitted.

> I mean, you didn't even consider implementing a simple fetch of an already cloned repository in your mirroring server code. So yeah, I'd argue that the bad faith part is actually justified. https://github.com/golang/go/issues/44577#issuecomment-11378... > We did consider caching clones, but it has security implications and adds complexity, so we decided not to. It is certainly not trivial to do and not something we…

In this case, it's really hard to see thrashing other people's servers relentlessly to collect data you already have as anything but incredibly, incredibly poor engineering. Y'all should write him a check for that much resource waste.

It's less than $200 per month to send out 4G daily. If his business can't afford that, there is something else going on.

What is the total daily bandwidth that sourcehut uses anyway? What percentage is go module fetching?

Re: Google has been DDoSing Sourcehut for over a year

#92

Post by cycomanic »

joshuamorton wrote: post #45
mig39 wrote: post #36

Earlier quoted context omitted.

I think he's been banned from the issue tracker.

Possibly, but he was actively participating in https://github.com/golang/go/issues/44577 up until the week it was fixed. If that's the root of the issue though, most of the article ("no one will get promoted for prioritizing that at Google.", "the go team has not prioritized it", etc.) is wrong. They may not have addressed the issue in the precise way he wanted, but I also think it's rather unreasonable to expect som…

So the solution is that everyone who does not want that behavior should request that they turn of refresh traffic for their domain? How long would it take until they would complain about people spamming their issue tracker if everyone who self-hosts a go module would start requesting this?

Maybe they should request 500 times a day because that's what the proxy is doing.

Re: Google has been DDoSing Sourcehut for over a year

#93

Post by AlotOfReading »

johnduhart wrote: post #69
cookiengineer wrote: post #56

Earlier quoted context omitted.

How are his arguments in bad faith if he is the one that gets DDoSed by your software for over a year, and still tries to be helpful? Not sure if you realize the absurdity of this, but he has to pay traffic and server costs. Like everyone else, except probably Google as it seems!? I mean, you didn't even consider implementing a simple fetch of an already cloned repository in your mirroring server code . So yeah, I'd…

> I mean, you didn't even consider implementing a simple fetch of an already cloned repository in your mirroring server code. So yeah, I'd argue that the bad faith part is actually justified. https://github.com/golang/go/issues/44577#issuecomment-11378... > We did consider caching clones, but it has security implications and adds complexity, so we decided not to. It is certainly not trivial to do and not something we…

Drew can often be very abrasive, but does it really matter in this case? His site is basically being DDoS'd.

Yes, there are decent arguments why the golang infra doesn't cache or respect typical norms like robots.txt, but they don't change the unreasonableness of the underlying situation. Surely some mitigation could have been worked out in the year since the ticket was filed?

Re: Google has been DDoSing Sourcehut for over a year

#94

Post by cookiengineer »

arccy wrote: post #63
cookiengineer wrote: post #56

Earlier quoted context omitted.

How are his arguments in bad faith if he is the one that gets DDoSed by your software for over a year, and still tries to be helpful? Not sure if you realize the absurdity of this, but he has to pay traffic and server costs. Like everyone else, except probably Google as it seems!? I mean, you didn't even consider implementing a simple fetch of an already cloned repository in your mirroring server code . So yeah, I'd…

bad faith refers to his behavior on other issue threads. also he (used to) spam the issue tracker with ads for his services

> also he (used to) spam the issue tracker with ads for his services

Do you have links to those ad spams? I couldn't find obvious ones when I was using GitHub's issue search field.

Edit: It seems ddevault opened and/or replied to only 10 issues, which I would hardly call "spam".

Re: Google has been DDoSing Sourcehut for over a year

#95

Post by ocdtrekkie »

verdverm wrote: post #91
ocdtrekkie wrote: post #74

Earlier quoted context omitted.

In this case, it's really hard to see thrashing other people's servers relentlessly to collect data you already have as anything but incredibly, incredibly poor engineering. Y'all should write him a check for that much resource waste.

It's less than $200 per month to send out 4G daily. If his business can't afford that, there is something else going on. What is the total daily bandwidth that sourcehut uses anyway? What percentage is go module fetching?

That was a different user. The fact that a user not running a git hosting service is potentially eating $200 a month should queue you into the fact that the cost to Drew is likely drastically higher than that.

Google should be sending reimbursement checks for the damage done here on this issue.

Re: Google has been DDoSing Sourcehut for over a year

#96

Post by ziml77 »

johnduhart wrote: post #69
cookiengineer wrote: post #56

Earlier quoted context omitted.

How are his arguments in bad faith if he is the one that gets DDoSed by your software for over a year, and still tries to be helpful? Not sure if you realize the absurdity of this, but he has to pay traffic and server costs. Like everyone else, except probably Google as it seems!? I mean, you didn't even consider implementing a simple fetch of an already cloned repository in your mirroring server code . So yeah, I'd…

> I mean, you didn't even consider implementing a simple fetch of an already cloned repository in your mirroring server code. So yeah, I'd argue that the bad faith part is actually justified. https://github.com/golang/go/issues/44577#issuecomment-11378... > We did consider caching clones, but it has security implications and adds complexity, so we decided not to. It is certainly not trivial to do and not something we…

I don't particularly care for Drew, but the issue he's reported here seems totally valid. And if he requested that he be excluded from getting hit by the crawler, wouldn't that mean it would be impossible for people to use packages from sr.ht unless they change their config?

Plus, it does seem reasonable to think that only one of the crawlers needs to hit the site. The global replication can happen at the FS level or, heck, the crawlers can just perform pulls from each other.

Re: Google has been DDoSing Sourcehut for over a year

#97

Post by cycomanic »

verdverm wrote: post #91
ocdtrekkie wrote: post #74

Earlier quoted context omitted.

In this case, it's really hard to see thrashing other people's servers relentlessly to collect data you already have as anything but incredibly, incredibly poor engineering. Y'all should write him a check for that much resource waste.

It's less than $200 per month to send out 4G daily. If his business can't afford that, there is something else going on. What is the total daily bandwidth that sourcehut uses anyway? What percentage is go module fetching?

The 4G daily was a different user who hosted a go module where he was the single user on his own server, this was not DeVault.

I'd be pretty pissed if I hosted a go module essentially for myself and suddenly I have a $200 dollar bill, because google decided to clone my repository 500 times a day. If it doesn't bother you, how about you donate $200 a month to a charity of my choosing, because it doesn't matter to you.

Re: Google has been DDoSing Sourcehut for over a year

#98

Post by joshuamorton »

cycomanic wrote: post #92
joshuamorton wrote: post #45

Earlier quoted context omitted.

Possibly, but he was actively participating in https://github.com/golang/go/issues/44577 up until the week it was fixed. If that's the root of the issue though, most of the article ("no one will get promoted for prioritizing that at Google.", "the go team has not prioritized it", etc.) is wrong. They may not have addressed the issue in the precise way he wanted, but I also think it's rather unreasonable to expect som…

So the solution is that everyone who does not want that behavior should request that they turn of refresh traffic for their domain? How long would it take until they would complain about people spamming their issue tracker if everyone who self-hosts a go module would start requesting this? Maybe they should request 500 times a day because that's what the proxy is doing.

> How long would it take until they would complain about people spamming their issue tracker if everyone who self-hosts a go module would start requesting this?

This same question comes up for ~any CI service or any number of other services that regularly build from source. There's a reason that github maintains a cache and that repo clones are served from that instead of by invoking the git command on the server.

A git hosting service that can't handle a trivial clone qps isn't actually a git hosting service.

Re: Google has been DDoSing Sourcehut for over a year

#99

Post by verdverm »

cycomanic wrote: post #97
verdverm wrote: post #91

Earlier quoted context omitted.

It's less than $200 per month to send out 4G daily. If his business can't afford that, there is something else going on. What is the total daily bandwidth that sourcehut uses anyway? What percentage is go module fetching?

The 4G daily was a different user who hosted a go module where he was the single user on his own server, this was not DeVault. I'd be pretty pissed if I hosted a go module essentially for myself and suddenly I have a $200 dollar bill, because google decided to clone my repository 500 times a day. If it doesn't bother you, how about you donate $200 a month to a charity of my choosing, because it doesn't matter to you.

Self hosting costs money, for this one user it would seem the options of blocking or other options are more tenable

If money was a problem, I'd expect this individual to ha e rectified it on their end

Re: Google has been DDoSing Sourcehut for over a year

#100

Post by joshuamorton »

8organicbits wrote: post #64
joshuamorton wrote: post #45

Earlier quoted context omitted.

Possibly, but he was actively participating in https://github.com/golang/go/issues/44577 up until the week it was fixed. If that's the root of the issue though, most of the article ("no one will get promoted for prioritizing that at Google.", "the go team has not prioritized it", etc.) is wrong. They may not have addressed the issue in the precise way he wanted, but I also think it's rather unreasonable to expect som…

I think the problem with the proposed solution ( https://github.com/golang/go/issues/44577#issuecomment-85720... ) is that the refresh is used to keep the cache from getting too stale. Would it be reasonable for golang modules on sourcehub to be served from a stale cache? The problem is that the refresh does a full clone which is too heavyweight. The other user who accepted that proposed fix had a single module that…

If I'm reading correctly, it would not be stale, but be directly proxied, which would mean that a popular module could result in a higher overall qps (but this is also true if people clone directly from sourcehut). On the other hand, Drew's suggestion would actually result in stale caches.

There comes a point (and it isn't a particularly far-off point) where disabling this would result in significantly increased traffic to sourcehut. That's a problem, but it's a problem with sourcehut's scalability.

Post reply on HN