Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sourcehut will blacklist the Go module mirror

sourcehut.org

Post reply on HN
Print view View original

241–250 of 365 posts

Re: Sourcehut will blacklist the Go module mirror

#241

Post by adenozine »

vladharbuz wrote: post #220
adenozine wrote: post #200

What's the value proposition of not using Github? Github is such an incredibly useful project. I actually go out of my way to avoid projects on Gitlab and co, just because I don't want to have to worry that it's going to just disappear one day because they thought they could out-build Microsoft.

Your argument seems to be based on the idea that Microsoft would do a better job than its competition technically. The fact that you're happy to rely on them also seems to imply you think they're unlikely to act abusively. However, you're writing your comment in a thread about a similar megacorporation, Google, who is acting abusively, because their engineers are saying parsing a robots.txt file would be too difficul…

I actually wasn't making an argument but posing a question. Your reply seems defensive and emotional.

I'm not sure what you mean by "act abusively" since the core of the product is storing and viewing source code. I mean, I could verify checksums if I needed to, and such a thing is common in workplaces I frequent.

What I asked before, and I will reiterate for an additional attempt to your comprehension, is how can Sourcehut store and view source code BETTER than Github can?

Re: Sourcehut will blacklist the Go module mirror

#242

Post by aborsy »

Beltalowda wrote: post #148
dcow wrote: post #115

Earlier quoted context omitted.

[flagged]

> I’m glad people spoke up. You could reasonably agree or disagree with Filippo take, and after quite a bit of discussion it was decided to not deprecate the opengpg[1]. I'm pretty sure that Drew's comment contributed exactly 0% to that decision. [1]: It was deprecated a two years later as no one stepped up to maintain it, so it bitrotted even further, and there are other (better) 3rd party implementations anyway. Sp…

PGP is difficult to replace. It’s very well supported, and frankly works sufficiently well (sure, it’s outdated, but so is SSH, TLS etc). There are other software that might be more secure and user friendly, but PGP is also secure. A lot of extremely sensitive information is encrypted with pgp.

Re: Sourcehut will blacklist the Go module mirror

#243

Post by Arnavion »

Beltalowda wrote: post #176
josephcsible wrote: post #142

Earlier quoted context omitted.

> Whether he's a great programmer/contributor not isn't really important here. Why not? Why shouldn't we offer more leeway to more valuable contributors?

The question is: how many other valuable contributors are you missing out on because of that person? The "classic" example of this is Ulrich Drepper, who maintained GNU libc for many years. Everyone agrees he's a great programmer. He's a better programmer than I am. But he was also ... difficult. More difficult than anyone else I've seen in a mainstream widely-used project. Many people didn't contribute purely becaus…

>Many people didn't contribute purely because they just didn't want to deal with Drepper.

I have no numbers to be able to confirm or deny this, but...

>Debian found it necessarily to fork GNU libc because of Drepper.

... Debian created eglibc because they needed glibc to support their use case and Drepper didn't. Even if Drepper had been the nicest person in the world, if he rejected patches to run glibc on non-x86 then forking was unavoidable.

Re: Sourcehut will blacklist the Go module mirror

#244

Post by Beltalowda »

FiloSottile wrote: post #78
throwaway_62022 wrote: post #67

Earlier quoted context omitted.

I think it is problematic that we are using github issues as "support forum" for asking a git host provider to be excluded from the refresh list. This should not have come to that. Whatever happened to "reasonable defaults", so as a random person hosting a single Go module doesn't get DOSed - https://github.com/golang/go/issues/44577#issuecomment-86087... ?

Everyone can make their own assessment of what is a reasonable default and what counts as a DoS (and they are welcome to opt-out of any traffic), but note that 4GB per day is 0.3704 Mbps.

That 4GB figure is for a repo at git.lubar.me, a self-hosted git repo where – quoting the person running it – "I am the only person in the world using this Go module".

In this context, that seems like a lot. Of course the module mirror can't know about this context, but there are certainly a lot of scenarios where this is comparatively a lot of bandwidth. Not everyone is running beefy servers.

Seems like an exceedingly poor and unreasonable default, and it doesn't take much imagination to see how this could be improved fairly easily (e.g. scale to number of actual go gets would already be an improvement).

Re: Sourcehut will blacklist the Go module mirror

#245

Post by rsc »

eadmund wrote: post #229
rsc wrote: post #209

The Go team has been making progress toward a complete fix to this problem. Go 1.19 added "go mod download -reuse", which lets it be told about the previous download result including the Git commit refs involved and their hashes. If the relevant parts of the server's advertised ref list is unchanged since the previous download, then the refresh will do nothing more than the ref list, which is very cheap. The proxy.go…

This reminds me a bit of a disfunctional relationship: clearly Sourcehut wants Google to stop DDoS their servers; clearly Google don’t actually want to DDoS Sourcehut, but Sourcehut also doesn’t want to ask Google to stop, and Google also want to be asked to stop. And so nothing gets done. The question is who will swallow their pride first: Sourcehut or Google.

This isn't true. Sourcehut reported a bug, and since the bug is somewhat involved to fix entirely, we asked what the impact of the bug is to them and offered to make a custom change for the site in the interim. The impact matters: the appropriate response is different for "I saw this in my logs and it looks weird but it's not bothering me" versus "this is causing serious problems for my site". We have been getting mixed signals about which it is, as I noted, but since Sourcehut told us explicitly not to put in a special case, we haven't.

Re: Sourcehut will blacklist the Go module mirror

#246

Post by rsc »

ddevault wrote: post #226
rsc wrote: post #209

The Go team has been making progress toward a complete fix to this problem. Go 1.19 added "go mod download -reuse", which lets it be told about the previous download result including the Git commit refs involved and their hashes. If the relevant parts of the server's advertised ref list is unchanged since the previous download, then the refresh will do nothing more than the ref list, which is very cheap. The proxy.go…

Hi Russ! Thank you for sharing. I am pleased to hear that there is finally some progress towards a solution for this problem. If you or someone working on the issue can reach out via email (sir@cmpwn.com), I would be happy to discuss the issue further. What you described seems like an incomplete solution, and I would like to discuss some additional details with your team, but it is a good start. I'm also happy to pos…

Sounds good. I will reach out over email. Thanks.

Re: Sourcehut will blacklist the Go module mirror

#247

Post by tptacek »

dcow wrote: post #215
tptacek wrote: post #206

Earlier quoted context omitted.

Virtually nobody uses PGP, and it is not at all pivotal. It is one of the least important widely-known cryptosystems on the Internet; like the book "Applied Cryptography", it has a cheering section because of the era in which it was released, and a generation of lay-engineers has taken PGP as a synecdoche for all privacy cryptography. It is also badly broken and has an archaic design. Most notably: Filippo had nothin…

I am no cheering fan, for sure, but I think it's disingenuous to say PGP is one of the least important systems on the internet. Debian package distribution, notably, depends rather pivotally on PGP to ensure authenticity. Keybase uses PGP as it's root trust mechanism. There are plenty of email services that use PGP to secure messages. I've even come across some recent (as in the last few years) startups using PGP to…

It is one thing to make a case for the continued maintenance of PGP, or even to say that it has a place in modern cryptography (that's an outré thing to say among cryptography engineers, but, whatever).

It's another thing entirely to say that any cryptography engineer critical of PGP must have a weird personal vendetta against it, as you did upthread.

Harsh criticism of the failings of PGP is practically an orthodoxy among cryptography engineers. It is not a good design by modern standards, and lots of cryptographers would dearly love to be rid of it. Push back on them because you don't think it's worth the time for Debian to switch to minisign, fine, but don't slander people while you're doing it.

Re: Sourcehut will blacklist the Go module mirror

#248

Post by throwaway894345 »

pjmlp wrote: post #233
throwaway894345 wrote: post #189

Earlier quoted context omitted.

The pedants among us might prefer: "novel among mainstream programming languages of the 21st century which predated Go".

Pity that even Limbo from 20th century was more feature rich than Go.

Pity that people still argue as though "feature rich" is some unmitigated good. :)

Re: Sourcehut will blacklist the Go module mirror

#249

Post by tptacek »

ddevault wrote: post #239
tptacek wrote: post #205

Earlier quoted context omitted.

Obviously, your expulsion from the Go issue tracker for abusive conduct is a separable issue from the Go module proxy, as you can see from Go project participants reiterating that the offer to exclude you from the refresh list still stands.

1. We would like to have a more complex discussion than saying "1" or "0" to this specific offer 2. This specific offer is not satisfactory: https://news.ycombinator.com/item?id=34313802

Clearly it was not satisfactory to you, since it was made over 8 months ago, and you didn't take them up on it. I'm objecting here only to the framing you've created that your ouster from the Go issue forum --- which we can see was done with cause --- is what precipitated this situation.

Re: Sourcehut will blacklist the Go module mirror

#250

Post by ikiris »

rsc wrote: post #245
eadmund wrote: post #229

Earlier quoted context omitted.

This reminds me a bit of a disfunctional relationship: clearly Sourcehut wants Google to stop DDoS their servers; clearly Google don’t actually want to DDoS Sourcehut, but Sourcehut also doesn’t want to ask Google to stop, and Google also want to be asked to stop. And so nothing gets done. The question is who will swallow their pride first: Sourcehut or Google.

This isn't true. Sourcehut reported a bug, and since the bug is somewhat involved to fix entirely, we asked what the impact of the bug is to them and offered to make a custom change for the site in the interim. The impact matters: the appropriate response is different for "I saw this in my logs and it looks weird but it's not bothering me" versus "this is causing serious problems for my site". We have been getting mi…

Now witness the firepower of this fully ARMED and OPERATIONAL Google cloud.
Post reply on HN