Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google has been DDoSing Sourcehut for over a year

drewdevault.com

Post reply on HN
Print view View original

191–200 of 225 posts

Re: Google has been DDoSing Sourcehut for over a year

#191

Post by kcartlidge »

tptacek wrote: post #188
voxtech wrote: post #184

Earlier quoted context omitted.

I'm more weirded out by the fact that you believe google is performing this DDOS for no actual benefit and are choosing to defend it anyway.

Is that an answer to some other question I asked? It doesn't seem to be responsive to what I just wrote. I feel like what I'm sticking up for here is the practice of software development. Building an automated system that generates unexpectedly unwelcome load on someone else's service is... not exactly front-page news? It happens basically all the time? The idea that because the Go team is sponsored by Google, nothin…

> He should just tell them to push the button. If you think he shouldn't, you should be able to say why.

Accepting that Drew should get them to just push the button is accepting that it is the responsibility of each victim individually to cope with the abusive load being sent their way by engaging directly with their abuser. Rather than the sender, who is truly the one responsible, fixing it for every target by reducing their polling at source.

Re: Google has been DDoSing Sourcehut for over a year

#192

Post by voxtech »

kcartlidge wrote: post #191
tptacek wrote: post #188

Earlier quoted context omitted.

Is that an answer to some other question I asked? It doesn't seem to be responsive to what I just wrote. I feel like what I'm sticking up for here is the practice of software development. Building an automated system that generates unexpectedly unwelcome load on someone else's service is... not exactly front-page news? It happens basically all the time? The idea that because the Go team is sponsored by Google, nothin…

> He should just tell them to push the button. If you think he shouldn't, you should be able to say why. Accepting that Drew should get them to just push the button is accepting that it is the responsibility of each victim individually to cope with the abusive load being sent their way by engaging directly with their abuser. Rather than the sender, who is truly the one responsible, fixing it for every target by reduc…

More importantly, there is no threshold of usefulness where continuing the behavior is justified.

If the behavior is unimportant enough that drew should accept eliminating it, then its value does not justify the load.

If the behavior is important enough to justify the load, then eliminating it is no solution.

Re: Google has been DDoSing Sourcehut for over a year

#193

Post by tptacek »

voxtech wrote: post #192
kcartlidge wrote: post #191

Earlier quoted context omitted.

> He should just tell them to push the button. If you think he shouldn't, you should be able to say why. Accepting that Drew should get them to just push the button is accepting that it is the responsibility of each victim individually to cope with the abusive load being sent their way by engaging directly with their abuser. Rather than the sender, who is truly the one responsible, fixing it for every target by reduc…

More importantly, there is no threshold of usefulness where continuing the behavior is justified. If the behavior is unimportant enough that drew should accept eliminating it, then its value does not justify the load. If the behavior is important enough to justify the load, then eliminating it is no solution.

I don't understand how this logic is meant to hold. The behavior can be of enough value to justify it where the cost to source hosts is low, but not of enough value to justify it for all hosts. Which is where we are now.

It feels like some comments here are trying to reconstruct what happened axiomatically purely from comments on the thread, without any empirical input from, like, how the Go module proxy actually works, and ending up in weird places as a result.

Re: Google has been DDoSing Sourcehut for over a year

#194

Post by kcartlidge »

tptacek wrote: post #193
voxtech wrote: post #192

Earlier quoted context omitted.

More importantly, there is no threshold of usefulness where continuing the behavior is justified. If the behavior is unimportant enough that drew should accept eliminating it, then its value does not justify the load. If the behavior is important enough to justify the load, then eliminating it is no solution.

I don't understand how this logic is meant to hold. The behavior can be of enough value to justify it where the cost to source hosts is low, but not of enough value to justify it for all hosts. Which is where we are now. It feels like some comments here are trying to reconstruct what happened axiomatically purely from comments on the thread, without any empirical input from, like, how the Go module proxy actually wor…

Personally I'm trying to keep it tied down to an issue of responsibilities.

The abuser of resources should stop abusing. It isn't the fault of the victims and they shouldn't each individually need to address it. Stop the issue at source for everyone by stopping being anti-social/parasitical on the use of resources through excessive polling. I think that's the extent of my own argument here.

Re: Google has been DDoSing Sourcehut for over a year

#195

Post by tptacek »

kcartlidge wrote: post #194
tptacek wrote: post #193

Earlier quoted context omitted.

I don't understand how this logic is meant to hold. The behavior can be of enough value to justify it where the cost to source hosts is low, but not of enough value to justify it for all hosts. Which is where we are now. It feels like some comments here are trying to reconstruct what happened axiomatically purely from comments on the thread, without any empirical input from, like, how the Go module proxy actually wor…

Personally I'm trying to keep it tied down to an issue of responsibilities. The abuser of resources should stop abusing. It isn't the fault of the victims and they shouldn't each individually need to address it. Stop the issue at source for everyone by stopping being anti-social/parasitical on the use of resources through excessive polling . I think that's the extent of my own argument here.

It's not a great argument? If Github and Gitlab are fine with the polling, and the polling has even marginal benefits for Go users, why should we care how they handle Github and Gitlab? It sure looks like nobody on the Go project knew that sr.ht would care about these module clones, and when they found out, they gave DeVault the option of stopping them. I'm still not clear what the issue is.

If they knew DeVault's host wasn't going to be able to handle repeated module clones, a priori, then doing it anyways would be a problem. It doesn't look like anyone expected this to be a problem. It turned out it was, and there's a fix.

Re: Google has been DDoSing Sourcehut for over a year

#196

Post by tete »

tptacek wrote: post #115
ziml77 wrote: post #96

Earlier quoted context omitted.

I don't particularly care for Drew, but the issue he's reported here seems totally valid. And if he requested that he be excluded from getting hit by the crawler, wouldn't that mean it would be impossible for people to use packages from sr.ht unless they change their config? Plus, it does seem reasonable to think that only one of the crawlers needs to hit the site. The global replication can happen at the FS level or…

No. According to the Go project, adding his site to the exclusion list would reduce traffic to his site at the cost of freshness of the data the proxy collects; it would not make it "impossible" for people to use packages from sr.ht. This is all in the thread that DeVault linked to from his post.

Which would still be far from great for any kind of source hosting website.

Re: Google has been DDoSing Sourcehut for over a year

#197

Post by kageurufu »

tptacek wrote: post #164
rurban wrote: post #154

Earlier quoted context omitted.

drew articulated it very well why google's offer doesn't help at all. https://github.com/golang/go/issues/44577#issuecomment-85693... A full git clone just to DDOS a hoster to check if the user-experience is still first-class, and filling a proxy is not an acceptable solution for a module hoster who has the pay the hosting bills by himself. If they want to know if their proxy is still uptodate, a cheap latest change…

You didn't answer my question. What's the problem with the Go team's workaround? I get that DeVault would like to redesign the Go modules system to suit his own preferences, but that's not on the table.

What would be the problem with the go team doing a quick `git ls-remote` instead of jumping to a full clone? All it would take is tracking the last `ls-remote` result in any of the Google's many options for databases, and only doing a clone when the remote updates.

Re: Google has been DDoSing Sourcehut for over a year

#198

Post by tptacek »

kageurufu wrote: post #197
tptacek wrote: post #164

Earlier quoted context omitted.

You didn't answer my question. What's the problem with the Go team's workaround? I get that DeVault would like to redesign the Go modules system to suit his own preferences, but that's not on the table.

What would be the problem with the go team doing a quick `git ls-remote` instead of jumping to a full clone? All it would take is tracking the last `ls-remote` result in any of the Google's many options for databases, and only doing a clone when the remote updates.

Maybe there's no problem? It's totally fair to critique the design of the current module proxy. The odds of them developing precisely the right proxy were low; of course we'll be able to come up with things they can do better. That's how open source works.

It's when we turn this into a morality play that we go off the rails.

Re: Google has been DDoSing Sourcehut for over a year

#199

Post by tptacek »

tete wrote: post #196
tptacek wrote: post #115

Earlier quoted context omitted.

No. According to the Go project, adding his site to the exclusion list would reduce traffic to his site at the cost of freshness of the data the proxy collects; it would not make it "impossible" for people to use packages from sr.ht. This is all in the thread that DeVault linked to from his post.

Which would still be far from great for any kind of source hosting website.

In what way would it be "far from great"?

Re: Google has been DDoSing Sourcehut for over a year

#200

Post by tete »

Ventito wrote: post #161
thaway2839 wrote: post #87

Earlier quoted context omitted.

4 GB/day is a different person facing the same issue who is hosting a single module they claim is likely only used by them.

Still whats 4GB a day? I really really don't get the issue. Is he io bound? Is there no reasonable way for git hosting services to actually cache git checkouts? DDoS / DoS should only be used, in my opinion, when the server goes down complelty not if it has a little bit of load and i still haven't seen anything which indicates that this is a real issue? And i don't want to come across negativly, i just don't get the…

Given that Google decides to do that effectively out of bad design.

What if your website hosted 100 Go modules and it scales linearly, that's 400GB, still not a problem? What if every programming language did that?

I don't really understand how that's not an issue. Sure it's not a big deal, if just one service does that, but it's still something that should be fixed. If you are Google it should be expected that this fix is not taking over a year.

Post reply on HN