Live data from Hacker News

Sourcehut will blacklist the Go module mirror

sourcehut.org

321–330 of 365 posts

Re: Sourcehut will blacklist the Go module mirror

#321
post #269

Earlier quoted context omitted.

[flagged]

In the context we're talking about here, "arguments they don't understand" is incredibly rude and also inaccurate. Please be more careful.

That was referencing past conversations I've had where it was very much like I describe. I'll admit I'm channeling some past frustrations and stereotyping and apologize for not making the distinction clear. I am not referring to you or anyone here or anyone on the golang thread, for the record.

Re: Sourcehut will blacklist the Go module mirror

#323
post #13

Earlier quoted context omitted.

Have to agree in as much banning people with legitimate issues is unhelpful. I was also taken aback when Peter Bourgon, a great programmer and contributor to the go ecosystem was banned from all go channels.

Why does the Go team ban so many people? Doesn't sound like a healthy community.

How many?

Re: Sourcehut will blacklist the Go module mirror

#324

Earlier quoted context omitted.

robots.txt was originally created to include such bots. That they think they don't need to respect it goes against the original intent. Eg: https://www.robotstxt.org/faq/kinds.html >"What's New" monitoring

I want my software to obey me, not someone else. If the software is discovering resources on its own, then obeying robots.txt is fair. But if the software is polling a resource I explicitly told it to, I would not expect it to make additional requests to fetch unrelated files such as a robots.txt

I can almost see both sides here... But ultimately when you are using someone else's resources, then not respecting their wishes (within reason) just makes you an asshole.

Re: Sourcehut will blacklist the Go module mirror

#325
post #27

According to some comments in the linked GitHub issue, including [1] from last May, Drew could have simply asked to be excluded from automatic refresh traffic from the mirror. If I understand correctly, that would still leave traffic from the mirror when it’s acting as a direct proxy for someone’s request, but that is traffic that would be going to sr.ht regardless. For some reason he did not do this and instead chos…

Seems like a weird default policy, until you remember Google's wifi mapping opt-out process: https://support.google.com/maps/answer/1725632?hl=en#zippy=%... "All this would go away if other people would just do what they're told" is a pretty dystopian policy, but it seems to be a popular choice in Google.

That right there is why i stopped using Google.

Anyway, things get a bit kafka-esque when you realise that there is another company doing this WiFi thing and to opt out from that one you need a different SSID suffix. Since you can't have both, you end up with at least one company data mining you.

Why GDPR has not put a stop to this is baffling

Re: Sourcehut will blacklist the Go module mirror

#326
post #316

Earlier quoted context omitted.

Should every person that hosts an instance of SourceHut, Gitea, or Forgejo have to opt-in to this? That just doesn't scale at all. Drew is standing up for all independent hosters as much as he is standing up for his own business interests.

No other independent hosters are having issues. I'm on one with no more than a few dozen users. Multiple of us write in Go, including the owner of the service, and yet Gitea and the VPS hosting it have never even blinked. If there were more of an issue, there would be more of a fuss than just two individuals. And one of those individuals was completely satisfied with the temporarily hackjob while a more permanent sol…

> No other independent hosters are having issues.

I could be wrong but in comments to https://github.com/golang/go/issues/44577 issue there at least 4 hosters that forced to manually disable background refresh because of this exactly issue?

Re: Sourcehut will blacklist the Go module mirror

#327
post #209

The Go team has been making progress toward a complete fix to this problem. Go 1.19 added "go mod download -reuse", which lets it be told about the previous download result including the Git commit refs involved and their hashes. If the relevant parts of the server's advertised ref list is unchanged since the previous download, then the refresh will do nothing more than the ref list, which is very cheap. The proxy.go…

If google is on the way to fix this, a look at the resources on (EVERYONES LOCAL!) not de-duplicated $GOMODCACHE would be very welcome too!

(At least from an enviromental perspective.)

Easy to verify, get a report [1]: go install paepcke.de/fsdd/cmd/fsdd@latest && cd $GOMODCACHE && fsdd .

[1] Warning: Apple user with fixed restricted & expensive nvme space maybe very upset. Easy fixable via fsdd . --hard-link.

Re: Sourcehut will blacklist the Go module mirror

#328

Earlier quoted context omitted.

What does a local cache even mean at Googles scale though? Some of the cache nodes are likely closer to Sourcehuts servers than to Google HQ. I guess local would mean here that Google pays for the traffic. But then it is not a technical problem, but a "financial" one. If you disregard the question who pays for a moment and only look at what makes sense for the "bits", the stateless architecture seems not so bad. Just…

Are you serious? Google Cloud Storage is a service that Google sells to folks using its cloud. If they can't use it for their own project, that would be shocking, no?

They are probably already using something like GCS to store the data at the cache nodes.

I was not talking about how the nodes store data, but about a central cache. Purely architecture wise, it doesn't make sense to introduce a central storage that just mirrors Sourcehut (and all other Git repositories). Sourcehut is already that central storage. You would just create a detour.

It's also not an easy problem. If the cache nodes try to synchronize writes to the central cache, you are effectively linearizing the problem. Then you might as well just have the one central cache access Sourcehut etc. directly. But then of course you lose total throughput.

I guess the technically "correct" solution would be to put the cache right in front of the Sourcehut server.

Re: Sourcehut will blacklist the Go module mirror

#329
post #107

Earlier quoted context omitted.

Everyone can make their own assessment of what is a reasonable default and what counts as a DoS (and they are welcome to opt-out of any traffic), but note that 4GB per day is 0.3704 Mbps.

> but note that 4GB per day is 0.3704 Mbps That's per Go repository. That's a non-trivial amount of egress data and probably adds up to thousands of dollars a month.

what? why isn't it only checking the checksum file for changes? :o

Re: Sourcehut will blacklist the Go module mirror

#330

Earlier quoted context omitted.

See, here you just did it again: "muzzle the other party", as if it was causally connected to your disagreement about how the module proxy should work, and not to the abuse you inflicted on members of that community.

[flagged]

The two of you are on my internal list of HN heroes. Keep fighting the good fight!
Post reply on HN