121–130 of 225 posts
From https://github.com/golang/go/issues/44577#issuecomment-85107... > Yesterday, GoModuleMirror downloaded 4 gigabytes of data from my server requesting a single module over 500 times (log attached). As far as I know, I am the only person in the world using this Go module. From https://github.com/golang/go/issues/44577#issuecomment-78924... > yes we make a fresh clone every time I like golang as a developer, but thi…
So this has been going on for a year, Drew DeVault has actively tried and explored several sane options and channels. That's a quite a bit of patience and goodwill before making a public blog post. There are basic mechanisms in place both on the git side and on the protocol side that can prevent this kind of wasteful, digital harassment.
So this has been going on for a year, Drew DeVault has actively tried and explored several sane options and channels. That's a quite a bit of patience and goodwill before making a public blog post. There are basic mechanisms in place both on the git side and on the protocol side that can prevent this kind of wasteful, digital harassment.
The lesson here, is that if you make everyone dislike dealing with you then you'll find it very hard to get them to work with you when you need them to.
Earlier quoted context omitted.
> In the meantime, if you would prefer, we can turn off all refresh traffic for your domain while we continue to improve this on our end. That would mean that the only traffic you would receive from us would be the result of a request directly from a user. This may impact the freshness of your domain's data which users receive from our servers, since we need to have some caching on our end to prevent too frequent fet…
I see the fairly civil communication you had with Drew in the first link, but your inclusion of the second (given it's an unrelated issue) just feels like you're throwing mud in order to minimize the technical concerns he raised. It seems like the only solution suggested there is one that makes the "small fish" service less useful as a go repository. I'm not surprised he didn't like it.
Earlier quoted context omitted.
That was a different user. The fact that a user not running a git hosting service is potentially eating $200 a month should queue you into the fact that the cost to Drew is likely drastically higher than that. Google should be sending reimbursement checks for the damage done here on this issue.
Drew is running a code hosting business and this is a cost of providing a feature to the users. He can pass the costs on if it is a problem. He has lots of options and his competitors are not making a big deal out of this. I suspect he's drawn his line in the sand and wants to keep it going rather than finding a solution that works without requiring upstream changes.
I’m surprised. Most DDOS’s come from Microsoft these days. Azure Cloud is the #1 go to place for botnets to attack the Internet. I suspect it’s allowed on an official level, it’s too flagrant to be done without their knowledge or consent.
Earlier quoted context omitted.
It brings a lot of security to the Golang dependency system. It is more than just a dumb proxy or cache
Smarter than your average proxy, but apparently dumb enough it doesn't actually cache at all, according to the reports.
Earlier quoted context omitted.
> I mean, you didn't even consider implementing a simple fetch of an already cloned repository in your mirroring server code. So yeah, I'd argue that the bad faith part is actually justified. https://github.com/golang/go/issues/44577#issuecomment-11378... > We did consider caching clones, but it has security implications and adds complexity, so we decided not to. It is certainly not trivial to do and not something we…
In this case, it's really hard to see thrashing other people's servers relentlessly to collect data you already have as anything but incredibly, incredibly poor engineering. Y'all should write him a check for that much resource waste.
>At Google we were told to stop thinking about all this stuff, that the storage hardware and software people were responsible for hiding things like wearout from application developers.
Something tells me this team was told to "stop thinking about all this stuff, that the network people were responsible for hiding things like speed, latency and cost from application developers." aka network is infinite, keep pounding that repo and we will scale accordingly (our side of the equation, sucks to be other people)
Earlier quoted context omitted.
Drew can often be very abrasive, but does it really matter in this case? His site is basically being DDoS'd. Yes, there are decent arguments why the golang infra doesn't cache or respect typical norms like robots.txt, but they don't change the unreasonableness of the underlying situation. Surely some mitigation could have been worked out in the year since the ticket was filed?
They offered to turn off refreshing of his domain it appears on Jun 8, 2021: https://github.com/golang/go/issues/44577#issuecomment-85692...
I think this is just an example of Google being a jerk and not caring enough to do proper software engineering.
Go seems really interesting but I have avoided using it because it’s so tied to Google. And I don’t trust Google to make good decisions for developers or users.