Live data from Hacker News

Sourcehut will blacklist the Go module mirror

sourcehut.org

201–210 of 365 posts

Re: Sourcehut will blacklist the Go module mirror

#201

Earlier quoted context omitted.

> I've noticed that claims like this are never backed by any evidence of this improvement, or evidence of people who actually have been chased away by rudeness. I am one of them. I've seen other people claim the same. I did not keep a list, nor did I keep a list of all of his posts that I found egregious, and I don't really feel like spending a lot of time crawling through all posts to find them, so I guess this is a…

> [1]: https://www.slideshare.net/dberkholz/assholes-are-killing-yo ... This is the kind of thing I'm asking about. Lots of numbers are trotted out but where's the actual data? Where's the methodology? The blurb says, "This talk will teach you, using quantified data and academic research from the social sciences, about the dramatic impact assholes are having on your organization today and how you can begin to repair…

> Social science research has a dramatically poor replication rate, so on that basis alone I'm skeptical of the numbers even if he did interpret them correctly.

It's not a perfect science, but that doesn't mean "do nothing" is the best option, or that we can't just use common sense for that matter. If someone joins a community space and their first interaction is being insulted then the chance that they will come back is lower than if they're not insulted. I don't think you need a whole lot of rigorous science to accept this basic point, just as we don't need a whole lot of rigorous science to accept that dogs can feel pain, have an emotional life, have different personalities, etc.

> That said, I agree asshole behaviour has to be reigned in, but exile is pretty dramatic if you really think about it. It's super easy and I think that's why people do it, but that doesn't make it good option.

It sure is dramatic! Like I said, I don't really have the full story on this, so it's very hard for me to judge if it's proportional. I don't think the decision was made lightly as everyone involved realized it's not J. Random Gopher but a fairly well-known person within the community.

Related story: in a community (unrelated to Go) I once sent a message to someone asking them not to insult people; pretty basic unambiguous "you can't call people idiots here" kind of stuff. They were also very helpful in other cases and I knew they were going to be sensitive about it, so I sent the kindest kid-gloves message I could come up with; no threats of any actions, just "hey, can you not do this here?" They just replied with "no, I will not change, fuck off". So ... I (temporarily) banned them. What else was I supposed to do at this point? Let them continue anyway even though it was clearly inappropriate? Anyone looking on might think "gosh, did you really have to ban them for those remarks? It wasn't that bad?" Not unreasonable, but ... they also weren't aware of the conversation I had with them, and their reply. No one made any remarks about it, but if they did, I wouldn't have commented on it because it's still a private conversation.

This is the kind of stuff we may be unaware of. In my first message I mentioned "unreceptive to criticism of it (often getting pretty defensive/aggressive)" for a reason. I don't know what happened behind the scenes, but from what I've seen in public cases where people commented on his behaviour I expect things didn't go swimmingly. It's one thing to screw up at times and at least acknowledge you screwed up, but it's quite another thing to be consistently dismissive about any concerns and outright reject the idea there is anything wrong with your behaviour. I expect that this attitude played a large factor in the decision.

Re: Sourcehut will blacklist the Go module mirror

#202

Earlier quoted context omitted.

https://github.com/golang/go/issues/30141#issuecomment-46427... I don't have a full list of all posts at hand (some of which may be removed), but I've seen some other similar stuff as well; it's not an isolated incident. I was reading through the previous thread on this issue (goproxy sending loads of requests) and this one was posted as an example there.

Since GH requires login to see minimized comments, here it is: ddevault on Feb 15, 2019 "EFAIL" is an alarmist puff piece written by morons to slander PGP and inflate their egos. The standards don't need to change to fix the problems it mentions. The proposals help... marginally. The problem is not and was never with OpenPGP, it's with poorly written email clients (e.g. all email clients).

Well, that is a take.

Re: Sourcehut will blacklist the Go module mirror

#203

> The situation remained so for over a year. In that time, I was banned from the Go issue tracker without explanation, and was unable to continue discussing the problem with Google Something tells me there's another side to this story that we aren't hearing.

Well Go's own CoC requires that Google explain the reason for the ban, and as of yet they've failed to do so.

Re: Sourcehut will blacklist the Go module mirror

#204
post #72

Earlier quoted context omitted.

Is this something other than Bazel (or the progenitor thereof)? If so, calling it an abomination compared to the unfinished go build system is rather strong.

Google's internal build system is called Blaze, and (as I understand it) it supports tons of use cases that the Go tool doesn't: * Distributing build jobs across clusters * Targeting any arbitrary platform, architecture combination * Supporting multiple languages and toolchains * Arbitrary build-time script execution (e.g., code generation)

Bazel is the open-source variant of Blaze: https://bazel.build/about/faq#what%E2%80%99s_up_with_the_wor...

Re: Sourcehut will blacklist the Go module mirror

#205

Earlier quoted context omitted.

https://github.com/golang/go/issues/30141#issuecomment-46427... I don't have a full list of all posts at hand (some of which may be removed), but I've seen some other similar stuff as well; it's not an isolated incident. I was reading through the previous thread on this issue (goproxy sending loads of requests) and this one was posted as an example there.

I was indeed in the wrong when I made this comment four years ago. I have since apologized for it. I don't intend to re-litigate anything on HN at this point, but I have good reason to believe that this incident is unrelated to the reason I am presently banned. The linked comment was indeed out of line, and perhaps you feel justified in thinking that it should be sufficient grounds for a permanent expulsion from the…

Obviously, your expulsion from the Go issue tracker for abusive conduct is a separable issue from the Go module proxy, as you can see from Go project participants reiterating that the offer to exclude you from the refresh list still stands.

Re: Sourcehut will blacklist the Go module mirror

#206
post #115

Earlier quoted context omitted.

Thanks, that is indeed not the greatest of comments.

[flagged]

Virtually nobody uses PGP, and it is not at all pivotal. It is one of the least important widely-known cryptosystems on the Internet; like the book "Applied Cryptography", it has a cheering section because of the era in which it was released, and a generation of lay-engineers has taken PGP as a synecdoche for all privacy cryptography.

It is also badly broken and has an archaic design.

Most notably: Filippo had nothing to do with EFail, which was one of the most important cryptographic results of the last 5 years. You don't so much need Drew Devault to tell you that; it's peer-reviewed research.

Re: Sourcehut will blacklist the Go module mirror

#207
post #40

Earlier quoted context omitted.

I would share their side as well, but I never heard it. This is a violation of their own code of conduct, which requires them to notify the affected person, explain why, and offer the opportunity to mediate the situation. This is not the first time I was banned from the Go community without notice or explanation, and the first time turned out to be frivolous -- the ban was overturned months later with an admission th…

DoSing SourceHut? And the perpetrator is known ? Why don't you try to sue them?

Because blocking is a lot easier and cheaper?

Re: Sourcehut will blacklist the Go module mirror

#208
post #131

Earlier quoted context omitted.

presumably the proxy backend is stateless

At the end of the day it has to store, consolidate, and present that state to the service's consumers, so there is state somewhere.

> there is state somewhere

Yeah, on third-party code hosting platforms :). And maaaaaybe in some short-lived cache somewhere. I mean, why spend on storage and complicate your life with state management, when you can keep re-requesting the same thing from the third-party source?

Joking, of course, but only a bit. There is some indication Google's proxy actually stores the clones. It just seems to mindlessly, unconditionally refresh them. Kind of like companies whose CI redownload half of NPM on every build, and cry loudly when Github goes down for a few hours - except at Google scale.

Re: Sourcehut will blacklist the Go module mirror

#209
The Go team has been making progress toward a complete fix to this problem.

Go 1.19 added "go mod download -reuse", which lets it be told about the previous download result including the Git commit refs involved and their hashes. If the relevant parts of the server's advertised ref list is unchanged since the previous download, then the refresh will do nothing more than the ref list, which is very cheap.

The proxy.golang.org service has not yet been updated to use -reuse, but it is on our list of planned work for this year.

On the one hand Sourcehut claims this is a big problem for them, but on the other hand Sourcehut also has told us they don't want us to put in a special case to disable background refreshes (see the comment thread elsewhere on this page [1]).

The offer to disable background refreshes until a more complete fix can be deployed still stands, both to Sourcehut and to anyone else who is bothered by the current load. Feel free to post an issue at https://go.dev/issue/new or email me at rsc@golang.org if you would like to opt your server out of background refreshes.

[1] https://news.ycombinator.com/item?id=34311621

Re: Sourcehut will blacklist the Go module mirror

#210

Earlier quoted context omitted.

Not to mention, it's likely a quite impactful form of marketing / developer relations gain for them. I think so because when I talk to people who start to learn Go, I usually see a transfer of positive feelings and excitement from Go itself to Google as its creator/backer - one of the clearest examples of "halo effect" I've seen first-hand.

Do you really imagine some significant number of Google's search, cloud, etc customers were driven to Google over a competitor because of "good vibes" derived from Go? Google only develops Go because it's a useful internal tool, and I'm pretty sure the marketing team nor the executives spend any meeting minutes discussing Go.

Marketing works in mysterious ways.

Yes, I do imagine that people who are really into Go are more likely than average to join or start Go shops, and then pick GCP over competitors because they have to start with something, and being Go people, Google stuff comes first to mind.

Lots of companies across lots of industries spend a lot of money to achieve more-less this fuzzy, delayed-action effect.

Post reply on HN