Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sourcehut will blacklist the Go module mirror

sourcehut.org

Post reply on HN
Print view View original

91–100 of 365 posts

Re: Sourcehut will blacklist the Go module mirror

#91

Post by ignaloidas »

teeray wrote: post #74
ignaloidas wrote: post #44

Earlier quoted context omitted.

If the proxy changes a new version of a package, when you update it, there's no way to detect it since it fetches through the cache anyways, so a poisoned sum will be added to sumdb, and anyone who isn't fetching their packages through Google's proxy will get told that whatever they're using is trying to trick them.

> anyone who isn't fetching their packages through Google's proxy will get told that whatever they're using is trying to trick them. That is exactly the detection of a poisoned module in the ecosystem. It would break builds, issues would get filed, and a new version would be released (and the malicious party may not be so lucky this time since it’s trust on anyone’s first use).

Considering how few people do so, I'm fairly certain it would take more than a month for somebody to catch that.

But I guess it's also fairly easy to test it: just serve a slightly different version to the google's go mirror (by the user agent), and see how long until somebody complains to you about it.

Re: Sourcehut will blacklist the Go module mirror

#92

Post by Macha »

xena wrote: post #9
lwagreputation wrote: post #2

Mhmmm. Yeah I wish the default were to not use a proxy. Though to be fair I'm not sure exactly what the performance implications would be.

From what I understand, the proxy also helps people make sure that an upstream deleting their GitHub repos doesn't result in builds breaking on new machines that don't have it cached locally. Imagine the problems that could happen if someone new joins your team, runs `go build` and then one of the vital dependencies 404s. The other problem is that it's Google so their perception of "not much traffic" is "biblical flo…

If they change the case on their username on the other hand, the Go ecosystem explodes: https://github.com/sirupsen/logrus/issues/570#issuecomment-3...

Re: Sourcehut will blacklist the Go module mirror

#93

Post by shortlived »

Beltalowda wrote: post #79
Semaphor wrote: post #58

Earlier quoted context omitted.

> And he also ranted about how people were all a bunch of morons. I don't blame anyone for getting tired of that. Do you have a source?

https://github.com/golang/go/issues/30141#issuecomment-46427... I don't have a full list of all posts at hand (some of which may be removed), but I've seen some other similar stuff as well; it's not an isolated incident. I was reading through the previous thread on this issue (goproxy sending loads of requests) and this one was posted as an example there.

Since GH requires login to see minimized comments, here it is:

  ddevault on Feb 15, 2019
  "EFAIL" is an alarmist puff piece written by morons to slander PGP and inflate their egos. The standards don't need to change to fix the problems it mentions. The proposals help... marginally. The problem is not and was never with OpenPGP, it's with poorly written email clients (e.g. all email clients).

Re: Sourcehut will blacklist the Go module mirror

#94

Post by tssva »

SuperSandro2000 wrote: post #65

So either you disable the proxy completely for your site or get overwhelmed by traffic from a not to well written service, similar to a small DDOS attack, which is run by google and they are not planning to fix this? Did I get anything wrong here?

There is a refresh exclusion list which you can request your site to be added to. The proxy will continue to process requests for modules from your site but will not perform the automatic refresh which caused issues for Sourcehut. The Go team extended an offer to add Sourcehut to the list if a request to do so was made. The request never came and instead Sourcehut blocked the proxy.

Re: Sourcehut will blacklist the Go module mirror

#95

Post by 0cf8612b2e1e »

FiloSottile wrote: post #78
throwaway_62022 wrote: post #67

Earlier quoted context omitted.

I think it is problematic that we are using github issues as "support forum" for asking a git host provider to be excluded from the refresh list. This should not have come to that. Whatever happened to "reasonable defaults", so as a random person hosting a single Go module doesn't get DOSed - https://github.com/golang/go/issues/44577#issuecomment-86087... ?

Everyone can make their own assessment of what is a reasonable default and what counts as a DoS (and they are welcome to opt-out of any traffic), but note that 4GB per day is 0.3704 Mbps.

> A single module can produce as much as 4 GiB of daily traffic from Google.

That’s (upper bound) 4Gib times 2500 per hour. That’s not nothing.

Re: Sourcehut will blacklist the Go module mirror

#96

Post by throwaway894345 »

pjmlp wrote: post #23
no_wizard wrote: post #17

Earlier quoted context omitted.

What’s the deal on package mangement? They did quite a few iterations here so I don’t follow. Don’t know about the Russ takeover either

TL;DR version. Go package management was quite poor for many real use cases outside Google, so the community railed around many competing proposals, and when it appeared there was a clear winner, the Go team came out with their own solution instead. This after kind of supporting the ongoing community efforts.

I was kind of miffed by this early on, but the Go team's solution has been surprisingly effective and it seems to have stood the test of time. Package management is hard, and Go modules are one of the best solutions in the entire programming ecosystem, which is to say they mostly do what you would expect with relatively little debugging. Some superficial stuff (e.g., error messages) could be improved and there are probably some niche use cases that aren't as intuitive as they could be (maybe something like nested modules?), but the overall approach generally works well.

Re: Sourcehut will blacklist the Go module mirror

#97

Post by throwaway_62022 »

FiloSottile wrote: post #78
throwaway_62022 wrote: post #67

Earlier quoted context omitted.

I think it is problematic that we are using github issues as "support forum" for asking a git host provider to be excluded from the refresh list. This should not have come to that. Whatever happened to "reasonable defaults", so as a random person hosting a single Go module doesn't get DOSed - https://github.com/golang/go/issues/44577#issuecomment-86087... ?

Everyone can make their own assessment of what is a reasonable default and what counts as a DoS (and they are welcome to opt-out of any traffic), but note that 4GB per day is 0.3704 Mbps.

Comes around $8-11 of egress monthly traffic on AWS. I would think twice before signing up for a service that charges me $10/month - not sure why this should be any different.

Also, how do you opt-out? Imagine a random developer in a startup, running a Gitlab instance and then pushing a Go module there and only to be left with inexplicable traffic pattern(and bill). I have no skin in the game but this default _does not_ sound reasonable to me, whichever way you slice it.

Re: Sourcehut will blacklist the Go module mirror

#98

Post by wwarner »

Beltalowda wrote: post #46
wwarner wrote: post #13

Earlier quoted context omitted.

Have to agree in as much banning people with legitimate issues is unhelpful. I was also taken aback when Peter Bourgon, a great programmer and contributor to the go ecosystem was banned from all go channels.

> I was also taken aback when Peter Bourgon, a great programmer and contributor to the go ecosystem was banned from all go channels. Bourgon was frequently helpful and great, but also frequently rude, condensing, dismissive, and generally just unpleasant. I've seen this countless of times first-hand on Slack, Reddit, and Lobsters. I specifically stopped interacting with him long before he was banned. Whether he's a g…

I dunno, aren't people a bunch of morons when you really get down to it? Like, isn't that a legitimate complaint too?

> Whether he's a great programmer/contributor not isn't really important here.

I'd make a distinction here between having a reputation as a great contributor and having something important and correct to say in a given exchange. No, a community shouldn't put up with a person with a great reputation (or elevated title or higher pay grade) if they are unpleasant and wrong. But if they're right and they're a little impatient or impulsive, the community has more to gain from listening and simply pointing out they don't need to be impatient and impulsive. Let him build up a reputation for being a jerk rather than just ban him.

Re: Sourcehut will blacklist the Go module mirror

#99

Post by fmajid »

geodel wrote: post #87
nouveaux wrote: post #69

Earlier quoted context omitted.

Go since inception has always been well funded. It is authored by some of the biggest names in programming and they are on staff at Google. This is not a side hobby. Not sure why you're suggesting that Go is lacking in resources.

No. It is much smaller team as far as resources go. Compared to Swift for Apple or Java for Oracle, Go is not strategic bet for Google. There is absolutely no dependency on Go to develop services for Google platform in it. Hell, large number of Google employees spend time on disparaging Go. It does not happen for other company sponsored languages.

Someone in the Go team (rsc, IIRC) commented on how a Google executive came to him in the cafeteria to congratulate him on the launch. It turns out the executive confused him with someone on the Dart or Flutter teams.

Re: Sourcehut will blacklist the Go module mirror

#100

Post by 0cf8612b2e1e »

tssva wrote: post #94
SuperSandro2000 wrote: post #65

So either you disable the proxy completely for your site or get overwhelmed by traffic from a not to well written service, similar to a small DDOS attack, which is run by google and they are not planning to fix this? Did I get anything wrong here?

There is a refresh exclusion list which you can request your site to be added to. The proxy will continue to process requests for modules from your site but will not perform the automatic refresh which caused issues for Sourcehut. The Go team extended an offer to add Sourcehut to the list if a request to do so was made. The request never came and instead Sourcehut blocked the proxy.

Does every site need to personally request they not be DoS attacked?
Post reply on HN