Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sourcehut will blacklist the Go module mirror

sourcehut.org

Post reply on HN
Print view View original

171–180 of 365 posts

Re: Sourcehut will blacklist the Go module mirror

#171

Post by calvinmorrison »

leetrout wrote: post #8

I feel like Drew has been in a pissing match with the Go team for a while so this outcome doesnt surprise me. I love Go but not Google's stewardship of it. The tracking proxy, Russ' takeover / squash of the package management work, the weird silence / stonewalling on other community issues... Drew has a valid complaint. I hate to hear he was banned from the issue tracker but that sounds about right. As a sibling said…

Doesn't sound like a pissing match:

"Due to the relatively large traffic requirements of git clones, this represents about 70% of all outgoing network traffic from git.sr.ht. A single module can produce as much as 4 GiB of daily traffic from Google."

Re: Sourcehut will blacklist the Go module mirror

#172

Post by joshuamorton »

naasking wrote: post #158
Beltalowda wrote: post #128

Earlier quoted context omitted.

> I've noticed that claims like this are never backed by any evidence of this improvement, or evidence of people who actually have been chased away by rudeness. I am one of them. I've seen other people claim the same. I did not keep a list, nor did I keep a list of all of his posts that I found egregious, and I don't really feel like spending a lot of time crawling through all posts to find them, so I guess this is a…

> [1]: https://www.slideshare.net/dberkholz/assholes-are-killing-yo ... This is the kind of thing I'm asking about. Lots of numbers are trotted out but where's the actual data? Where's the methodology? The blurb says, "This talk will teach you, using quantified data and academic research from the social sciences, about the dramatic impact assholes are having on your organization today and how you can begin to repair…

No one considers it a good option. It's usually the last option, done after a fair bit of mediation to try and improve the assholes behavior. Only when it's clear that they can't or won't do you ban.

Re: Sourcehut will blacklist the Go module mirror

#173

Post by throwaway894345 »

yamtaddle wrote: post #116
throwaway894345 wrote: post #109

Earlier quoted context omitted.

Yes, Google staffs its Go team, but the original comment invokes Google's vast wealth as though its entire market cap is available for the development of Go, which is of course absurd. Google probably spends single-digit millions of dollars on Go annually, and it seems they've determined that supporting Drew's use case would require a nontrivial share of that budget which they feel could be spent to greater effect el…

Knowing that "we only have a few million in funding per year" was a valid excuse for generating abusive traffic and refusing to do anything about it, would definitely have changed a few conversations I've had working at startups. Interesting.

Of course, Google doesn't materially benefit from optimizing the module proxy for Drew's use case, and I doubt your startups would have made traffic optimization its top priority either under similar circumstances (which is to say "no ROI from traffic optimization").

Re: Sourcehut will blacklist the Go module mirror

#174

Post by znpy »

leetrout wrote: post #8

I feel like Drew has been in a pissing match with the Go team for a while so this outcome doesnt surprise me. I love Go but not Google's stewardship of it. The tracking proxy, Russ' takeover / squash of the package management work, the weird silence / stonewalling on other community issues... Drew has a valid complaint. I hate to hear he was banned from the issue tracker but that sounds about right. As a sibling said…

The go language should probably be spun off to an independent non-profit foundation.

Of course I’m well aware this is not going to happen.

Re: Sourcehut will blacklist the Go module mirror

#175

Post by treis »

throwaway_62022 wrote: post #97
FiloSottile wrote: post #78

Earlier quoted context omitted.

Everyone can make their own assessment of what is a reasonable default and what counts as a DoS (and they are welcome to opt-out of any traffic), but note that 4GB per day is 0.3704 Mbps.

Comes around $8-11 of egress monthly traffic on AWS. I would think twice before signing up for a service that charges me $10/month - not sure why this should be any different. Also, how do you opt-out? Imagine a random developer in a startup, running a Gitlab instance and then pushing a Go module there and only to be left with inexplicable traffic pattern(and bill). I have no skin in the game but this default _does n…

AWS gouges the crap out of people with their egress fees, though. You can get 20TB of transfer for ~$5 a month from Hetzner plus a server to go with it.

Re: Sourcehut will blacklist the Go module mirror

#176

Post by Beltalowda »

josephcsible wrote: post #142
Beltalowda wrote: post #46

Earlier quoted context omitted.

> I was also taken aback when Peter Bourgon, a great programmer and contributor to the go ecosystem was banned from all go channels. Bourgon was frequently helpful and great, but also frequently rude, condensing, dismissive, and generally just unpleasant. I've seen this countless of times first-hand on Slack, Reddit, and Lobsters. I specifically stopped interacting with him long before he was banned. Whether he's a g…

> Whether he's a great programmer/contributor not isn't really important here. Why not? Why shouldn't we offer more leeway to more valuable contributors?

The question is: how many other valuable contributors are you missing out on because of that person?

The "classic" example of this is Ulrich Drepper, who maintained GNU libc for many years. Everyone agrees he's a great programmer. He's a better programmer than I am. But he was also ... difficult. More difficult than anyone else I've seen in a mainstream widely-used project. Many people didn't contribute purely because they just didn't want to deal with Drepper. Debian found it necessarily to fork GNU libc because of Drepper.

So even if we adopt a purely utilitarian attitude on this (and I don't think we should in the first place), I think it's still a bad idea to grant some people a license to be a jerk. In many cases you're not going to come out with better contributions and code.

Re: Sourcehut will blacklist the Go module mirror

#177

Post by landhar »

brnt wrote: post #55
m4lvin wrote: post #53

Earlier quoted context omitted.

I thought that too, but then sr.ht needs to keep state which IP made how many requests already, and as the post mentions google makes these requests from many different places. So they would have to count requests from the specific user agent and by that point it is again special purpose work and load on sr.ht (whereas general rate limiting per IP might be a good idea anyway).

Per blogpost: > git clone requests with a GoModuleMirror User-Agent will receive a 429 So only one counter seems to be needed. Sure, it's doing work for an adversarial party, but it's not much extra work either.

But since it looks like the proxy fleet is made of a large set of nodes and each one of them only keeps track of their own state, if sourcehut were to only keep one counter for the whole user-agent it would lead to a large number of nodes not being able to refresh their cache for potentially long periods of time (there's nothing that would guarantee for example that it's always a new node that gets to make the one request per hour).

That's precisely why it's so unfair to ask the sourcehut team to try to come up with a solution to this problem: it's the very design of the proxy that Google put together that is causing this issue in the first place. And the sourcehut team has no control over their design. And to add insult to injury: when the sourcehut team offers recommendations on how to improve their implementation, Google responds with "it's too much work".

Re: Sourcehut will blacklist the Go module mirror

#178

Post by throwaway894345 »

monocasa wrote: post #130
throwaway894345 wrote: post #109

Earlier quoted context omitted.

Yes, Google staffs its Go team, but the original comment invokes Google's vast wealth as though its entire market cap is available for the development of Go, which is of course absurd. Google probably spends single-digit millions of dollars on Go annually, and it seems they've determined that supporting Drew's use case would require a nontrivial share of that budget which they feel could be spent to greater effect el…

They wouldn't write significant parts of their backend in a side project.

This is obviously untrue because we know that Google does write significant portions of its backend in Go and that Google derives ~0% of its revenue from Go (the very definition of a side project). My guess is that you're assuming that a side project for Google is the same as a side project for a lone developer or a small team, which is (pretty obviously, IMHO) untrue.

Re: Sourcehut will blacklist the Go module mirror

#179

Post by hdjjhhvvhga »

fmajid wrote: post #99
geodel wrote: post #87

Earlier quoted context omitted.

No. It is much smaller team as far as resources go. Compared to Swift for Apple or Java for Oracle, Go is not strategic bet for Google. There is absolutely no dependency on Go to develop services for Google platform in it. Hell, large number of Google employees spend time on disparaging Go. It does not happen for other company sponsored languages.

Someone in the Go team (rsc, IIRC) commented on how a Google executive came to him in the cafeteria to congratulate him on the launch. It turns out the executive confused him with someone on the Dart or Flutter teams.

I just hope it wasn't Rob Pike.

Re: Sourcehut will blacklist the Go module mirror

#180

Post by yamtaddle »

throwaway894345 wrote: post #173
yamtaddle wrote: post #116

Earlier quoted context omitted.

Knowing that "we only have a few million in funding per year" was a valid excuse for generating abusive traffic and refusing to do anything about it, would definitely have changed a few conversations I've had working at startups. Interesting.

Of course, Google doesn't materially benefit from optimizing the module proxy for Drew's use case, and I doubt your startups would have made traffic optimization its top priority either under similar circumstances (which is to say "no ROI from traffic optimization").

Drew's use case?!
Post reply on HN