Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sourcehut will blacklist the Go module mirror

sourcehut.org

Post reply on HN
Print view View original

291–300 of 365 posts

Re: Sourcehut will blacklist the Go module mirror

#291

Post by jen20 »

mseepgood wrote: post #204
throwaway894345 wrote: post #106

Earlier quoted context omitted.

Google's internal build system is called Blaze, and (as I understand it) it supports tons of use cases that the Go tool doesn't: * Distributing build jobs across clusters * Targeting any arbitrary platform, architecture combination * Supporting multiple languages and toolchains * Arbitrary build-time script execution (e.g., code generation)

Bazel is the open-source variant of Blaze: https://bazel.build/about/faq#what%E2%80%99s_up_with_the_wor...

Indeed - Bazel is a complete build system. “go build” is really not, and go modules are typically used for dependency management in Bazel for Go anyway.

Re: Sourcehut will blacklist the Go module mirror

#292

Post by [deleted] »

ddevault wrote: post #226
rsc wrote: post #209

The Go team has been making progress toward a complete fix to this problem. Go 1.19 added "go mod download -reuse", which lets it be told about the previous download result including the Git commit refs involved and their hashes. If the relevant parts of the server's advertised ref list is unchanged since the previous download, then the refresh will do nothing more than the ref list, which is very cheap. The proxy.go…

Hi Russ! Thank you for sharing. I am pleased to hear that there is finally some progress towards a solution for this problem. If you or someone working on the issue can reach out via email (sir@cmpwn.com), I would be happy to discuss the issue further. What you described seems like an incomplete solution, and I would like to discuss some additional details with your team, but it is a good start. I'm also happy to pos…

[deleted]

Re: Sourcehut will blacklist the Go module mirror

#293

Post by 0cf8612b2e1e »

counttheforks wrote: post #192

I'll just rehost my git repos on a git host who doesn't mind actually doing their job as a git host by letting git clients clone git repos.

Some napkin math:

- peak queries are 2500 requests per hour

- some repos are 4gb in size

- let’s round and say 2000 requests at 1gb = 2000 gb/hour = 48000 gb/day

- AWS bandwidth at $0.02 / gb = $960 / day = $28,800 / month

So, one of the richest companies in the world is charging you nearly $30k monthly because they cannot be bothered to be polite. Would you be ok with that situation?

Re: Sourcehut will blacklist the Go module mirror

#294

Post by pjmlp »

throwaway894345 wrote: post #248
pjmlp wrote: post #233

Earlier quoted context omitted.

Pity that even Limbo from 20th century was more feature rich than Go.

Pity that people still argue as though "feature rich" is some unmitigated good. :)

If it wasn't, Go wouldn't have gotten newer features.

Re: Sourcehut will blacklist the Go module mirror

#295

Post by yamtaddle »

maximilianburke wrote: post #223
rsc wrote: post #209

The Go team has been making progress toward a complete fix to this problem. Go 1.19 added "go mod download -reuse", which lets it be told about the previous download result including the Git commit refs involved and their hashes. If the relevant parts of the server's advertised ref list is unchanged since the previous download, then the refresh will do nothing more than the ref list, which is very cheap. The proxy.go…

I realize in the real world most modules are probably hosted by large providers that can absorb the bandwidth, like Github, but it seems incredibly discourteous to not prioritize the hammering of small providers, especially two years on when the response is still "maybe later this year". I think Drew is right in that he shouldn't take a personalized Sourcehut-only exception because this doesn't address the core issue…

It's super-weird that the Google-side Go folks' responses to this have basically been "we don't have the resources to run this service that we decided to run and that's now misbehaving, responsibly". Like... don't, then? Why take on that kind of thing in the first place if urgent fixes to its generating abusive traffic for no good reason take three years?

Re: Sourcehut will blacklist the Go module mirror

#297

Post by daenney »

I can see this happening on my own git hosting too. I've started moving my Go code off GitHub and the module mirror shows up every 25min for each repo it's aware of doing a full clone. Thankfully the few modules I've moved are very small ones with very little history. This won't come anywhere near my egress allocation for that box.

But the whole thing is frankly a little rude.

Re: Sourcehut will blacklist the Go module mirror

#298

Post by tptacek »

ddevault wrote: post #281
tptacek wrote: post #249

Earlier quoted context omitted.

Clearly it was not satisfactory to you, since it was made over 8 months ago, and you didn't take them up on it. I'm objecting here only to the framing you've created that your ouster from the Go issue forum --- which we can see was done with cause --- is what precipitated this situation.

We can behave like adults, ask why it's not satisfactory, and come to a more agreeable mutual solution, or we can blithely offer an incomplete solution, muzzle the other party, and just continue our DDoS.

See, here you just did it again: "muzzle the other party", as if it was causally connected to your disagreement about how the module proxy should work, and not to the abuse you inflicted on members of that community.

Re: Sourcehut will blacklist the Go module mirror

#299

Post by ddevault »

tptacek wrote: post #298
ddevault wrote: post #281

Earlier quoted context omitted.

We can behave like adults, ask why it's not satisfactory, and come to a more agreeable mutual solution, or we can blithely offer an incomplete solution, muzzle the other party, and just continue our DDoS.

See, here you just did it again: "muzzle the other party", as if it was causally connected to your disagreement about how the module proxy should work, and not to the abuse you inflicted on members of that community.

I admitted that my comments about EFAIL -- four years ago now -- were in the wrong, and apologized for them. Unless you're going to argue that this issue should justify consuming 70% of my system's network bandwidth without recourse, move on.

In the interest of not feeding the trolls, I think I can safely stop engaging with you on this thread. Or maybe on any thread -- you and I never seem to have a productive conversation on this website.

Re: Sourcehut will blacklist the Go module mirror

#300

Post by jdiff »

bigbillheck wrote: post #267
josephcsible wrote: post #142

Earlier quoted context omitted.

> Whether he's a great programmer/contributor not isn't really important here. Why not? Why shouldn't we offer more leeway to more valuable contributors?

Why shouldn't better drivers get to ignore speed limits?

Why should better drivers be permitted to road rage? That's just a nonsensical question, being unable to drive without being a menace makes you a worse driver.
Post reply on HN