Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google has been DDoSing Sourcehut for over a year

drewdevault.com

Post reply on HN
Print view View original

181–190 of 225 posts

Re: Google has been DDoSing Sourcehut for over a year

#181

Post by voxtech »

tptacek wrote: post #165
kcartlidge wrote: post #162

Regardless of whether or not Drew is abrasive (I've never dealt with him so have no opinion), this is on Google . If a single service (Go's module crawler) is doing this to multiple third parties (and it is, by design) then requiring Drew to implement a workaround is the same thing as relying on every (relevant to the issue) third party to do the same thing. Which is bad design. This should be fixed at source or swit…

Can you help me understand the problem with the workaround, which is precisely to have Google's proxy not excessively poll DeVault's service? It really seems like DeVault's real argument here isn't about the impact of this on his service, but that he doesn't like the design of the proxy. He has a lot of standing to complain about impacts on his service, but essentially no standing to complain about designs he finds s…

If the workaround didn't degrade service for Drew's go users, google would just implement it for all repositories.

Re: Google has been DDoSing Sourcehut for over a year

#182

Post by tptacek »

voxtech wrote: post #181
tptacek wrote: post #165

Earlier quoted context omitted.

Can you help me understand the problem with the workaround, which is precisely to have Google's proxy not excessively poll DeVault's service? It really seems like DeVault's real argument here isn't about the impact of this on his service, but that he doesn't like the design of the proxy. He has a lot of standing to complain about impacts on his service, but essentially no standing to complain about designs he finds s…

If the workaround didn't degrade service for Drew's go users, google would just implement it for all repositories.

How exactly does this workaround degrade service for DeVault's Go users? I'm not saying it doesn't; I'm saying nobody has given a simple explanation of what the impact would actually be, except for some people who have given clearly false explanations.

It's OK to just not know, but if you don't know, it's weird to have strong opinions about it.

Re: Google has been DDoSing Sourcehut for over a year

#183

Post by voxtech »

joshuamorton wrote: post #124
generalizations wrote: post #58

Earlier quoted context omitted.

I see the fairly civil communication you had with Drew in the first link, but your inclusion of the second (given it's an unrelated issue) just feels like you're throwing mud in order to minimize the technical concerns he raised. It seems like the only solution suggested there is one that makes the "small fish" service less useful as a go repository. I'm not surprised he didn't like it.

It speaks to why he might have been banned, which is the context of this thread.

We shouldn't have to speculate as to why he was banned, as the CoC requires communication to him about why. If they're breaking CoC to get rid of the guy (and likely because the CoC prevented them from doing so in the past), it's hard to justify no matter the reason.

And to be frank, filippo's contribution to this thread places a clear reason why- drew was incredibly rude in the second link, but his arguments were not bad faith. He clearly meant everything he said, and I would even argue that he was right, although his method of engagement was unacceptable.

More importantly, the exchange was 3 years ago, and the more recent exchange showed him engaging exactly how I would expect a professional to. If the 3 year old exchange is the best filippo could find, it indicates that drew has changed his tactics for the better. So why the ban?

Re: Google has been DDoSing Sourcehut for over a year

#184

Post by voxtech »

tptacek wrote: post #182
voxtech wrote: post #181

Earlier quoted context omitted.

If the workaround didn't degrade service for Drew's go users, google would just implement it for all repositories.

How exactly does this workaround degrade service for DeVault's Go users? I'm not saying it doesn't; I'm saying nobody has given a simple explanation of what the impact would actually be, except for some people who have given clearly false explanations. It's OK to just not know, but if you don't know, it's weird to have strong opinions about it.

I'm more weirded out by the fact that you believe google is performing this DDOS for no actual benefit and are choosing to defend it anyway.

Re: Google has been DDoSing Sourcehut for over a year

#185

Post by opmac »

quadrifoliate wrote: post #146
mrighele wrote: post #81

Earlier quoted context omitted.

Why not just return a 429 (Too Many Requests) if the specific repo has been requested by google not too long ago ? (e.g. 1 hour earlier or). It's a standard response code, and with a bit of luck google will scale the requests accordingly. If not, this will still allow the proxy to operate properly without burning too much server resources. (I understand that this may leave some customers unhappy since the proxy may b…

> It's a standard response code, and with a bit of luck google will scale the requests accordingly. Google already says in the comments [1] that it would be "a fair bit of work" for them to read the standard robots.txt for "boring technical reasons". I would not necessarily rely on them to respect HTTP 429 either. In fact, given the facts at hand with the current situation, I would guess that they probably wouldn't h…

Returning a 429 would not just to hope that the Go proxy would obey the response, but rather it would significantly reduce the workload the server has to do when it gets a request it doesn't want to serve.

Re: Google has been DDoSing Sourcehut for over a year

#186

Post by opmac »

lupire wrote: post #133
prepend wrote: post #130

Earlier quoted context omitted.

That doesn’t seem like a solution at all and is actually kind of punative as that would make srht bad for hosting go. I think this is just an example of Google being a jerk and not caring enough to do proper software engineering. Go seems really interesting but I have avoided using it because it’s so tied to Google. And I don’t trust Google to make good decisions for developers or users.

It looks like a solution to me: Google stops proactive refreshing, and so users get data that is fresh up to the cache timeout. Users who can't wait that long can disable the proxy, and SourceHut can recommend users do that.

Perfect succinct response. It is a 100% viable workaround.

Re: Google has been DDoSing Sourcehut for over a year

#187

Post by verdverm »

klodolph wrote: post #112
verdverm wrote: post #77

Earlier quoted context omitted.

This is completely different architecture and services, largely open sourced. This is limited to Go and the dev team. Most likely these errors would manifest down to the users of Go and those who've a dependency which lives on sourcehut

A big chunk of the Go core maintainers are Google employees, and they run Go services on top of Google infrastructure.

Being tied to Google has very little impact on the technical implementation of go modules fetching, proxy, & sumdb. It is intentionally isolated so that request data is not part of Google's data business. Go uses git under the hood for these requests, so there are more complications. How do you cache or respect robots.txt when you don't actually talk to the servers?

Re: Google has been DDoSing Sourcehut for over a year

#188

Post by tptacek »

voxtech wrote: post #184
tptacek wrote: post #182

Earlier quoted context omitted.

How exactly does this workaround degrade service for DeVault's Go users? I'm not saying it doesn't; I'm saying nobody has given a simple explanation of what the impact would actually be, except for some people who have given clearly false explanations. It's OK to just not know, but if you don't know, it's weird to have strong opinions about it.

I'm more weirded out by the fact that you believe google is performing this DDOS for no actual benefit and are choosing to defend it anyway.

Is that an answer to some other question I asked? It doesn't seem to be responsive to what I just wrote.

I feel like what I'm sticking up for here is the practice of software development. Building an automated system that generates unexpectedly unwelcome load on someone else's service is... not exactly front-page news? It happens basically all the time? The idea that because the Go team is sponsored by Google, nothing like this should ever happen seems deeply unrealistic. "We can push a button to make this stop happening; the tradeoff is that other hosting services that don't care about this load might currently have fresher cache entries [whatever that means]" seems like a perfectly cromulent response.

He should just tell them to push the button. If you think he shouldn't, you should be able to say why.

I do have a mild rooting interest here: I think the Go module proxy is pretty neat, and does something interesting for the security of the ecosystem. DeVault disagrees. That's fine, disagreement keeps things interesting.

Re: Google has been DDoSing Sourcehut for over a year

#189

Post by kcartlidge »

tptacek wrote: post #176
kcartlidge wrote: post #174

Earlier quoted context omitted.

I can't really speak for Drew's problem with the workaround, only my own from a design point of view - he may not even agree with my own issue at all for all I know, so I don't want to put words in his mouth. From my own perspective, however, the issue is about impact and responsibility. The excess traffic is their impact as it is caused by their design and is entirely of their choosing. Thus it becomes their respons…

It sounds like DeVault let them know their proxy was hitting his service too hard, and they immediately responded by saying they could dial it down. Seems like a pretty normal sequence of events? I feel like I have to be missing something here.

> It sounds like DeVault let them know their proxy was hitting his service too hard, and they immediately responded by saying they could dial it down

I'm not ignoring that Drew complained and they offered to dial it down. That's a reasonable response if it were an isolated case. The problem is that it isn't an isolated case. This is how the module cache works, which means it is doing that kind of load against other module sources too.

If you're going to impose these resource demands on others then they should be managed for everyone affected not just the one who complains about it.

- Repeatedly pulling an entire repo over and over again is an antisocial act that is unfairly imposing bandwidth/CPU costs on third parties

- They should not expect every impacted party to obtain an opt-out individually because of unasked-for extra resource demands

- The system that excessively polls is broken, not its victims

Re: Google has been DDoSing Sourcehut for over a year

#190

Post by kcartlidge »

philosopher1234 wrote: post #179
tptacek wrote: post #176

Earlier quoted context omitted.

It sounds like DeVault let them know their proxy was hitting his service too hard, and they immediately responded by saying they could dial it down. Seems like a pretty normal sequence of events? I feel like I have to be missing something here.

This is probably 80% peoples' existing animosity towards Google & Go, so they're ready to hate, regardless of how the facts land. I think its primarily about the Go team having a different working philosophy than the standard HN soft. dev philosophy, and an intolerance of difference.

> This is probably 80% peoples' existing animosity towards Google & Go, so they're ready to hate, regardless of how the facts land.

Go is my second fave after C# and I've used it almost daily for many years. No animosity here.

Post reply on HN