Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sourcehut will blacklist the Go module mirror

sourcehut.org

Post reply on HN
Print view View original

341–350 of 365 posts

Re: Sourcehut will blacklist the Go module mirror

#341

Post by jdiff »

sidewndr46 wrote: post #305
cbrozefsky wrote: post #102

Earlier quoted context omitted.

"Opt out of me DoSing" you is not legit behavior -- especially when the victim has raised it with you multiple times, suggested fixes, and you have then blocked them from communicating in your issue tracker. That's some really entitled thinking on the part of the Go team at Google, and it's sad to see people stanning for them.

They should have them add a file to their web service at a path of "/i_want_to_live.txt" to indicate not to DoS the server.

If an amount of traffic that nobody else even notices brings you to your knees, you're doing something wrong. Go could be far more efficient but pointing at this and calling it a DDoS is silly.

Re: Sourcehut will blacklist the Go module mirror

#342

Post by sidewndr46 »

jdiff wrote: post #341
sidewndr46 wrote: post #305

Earlier quoted context omitted.

They should have them add a file to their web service at a path of "/i_want_to_live.txt" to indicate not to DoS the server.

If an amount of traffic that nobody else even notices brings you to your knees, you're doing something wrong. Go could be far more efficient but pointing at this and calling it a DDoS is silly.

I called it a DoS, not a DDoS.

Re: Sourcehut will blacklist the Go module mirror

#343

Post by cmatthias »

yamtaddle wrote: post #265
jslql wrote: post #262

Earlier quoted context omitted.

Why should a git client respect an http standard such as robots.txt?

Google began pushing for it to become an Internet standard—explicitly to be applicable to any URI-driven Internet system, not just the Web—in 2019, and it was adopted as an Internet standard in 2022. https://developers.google.com/search/blog/2019/07/rep-id

This is true but irrelevant to the parent's question -- in the article, it's made clear that Google's requests are happening over HTTP, which is the most obvious reason why robots.txt should be respected.

Re: Sourcehut will blacklist the Go module mirror

#344

Post by yamtaddle »

cmatthias wrote: post #343
yamtaddle wrote: post #265

Earlier quoted context omitted.

Google began pushing for it to become an Internet standard—explicitly to be applicable to any URI-driven Internet system, not just the Web—in 2019, and it was adopted as an Internet standard in 2022. https://developers.google.com/search/blog/2019/07/rep-id

This is true but irrelevant to the parent's question -- in the article, it's made clear that Google's requests are happening over HTTP, which is the most obvious reason why robots.txt should be respected.

It's relevant because it attacks the premise of their objection.

Re: Sourcehut will blacklist the Go module mirror

#345

Post by adityasaky »

lanstin wrote: post #134
morelisp wrote: post #70

Earlier quoted context omitted.

> anyone who isn't fetching their packages through Google's proxy will get told that whatever they're using is trying to trick them. No, the error message you get is neutral about which side might be wrong - it says "verifying module: checksum mismatch" and "This download does NOT match the one reported by the checksum server." (I've seen it a lot because it also appears when module authors rebase, which a small but…

Wow, that is shocking. There is never a reason to rebase a public git repo, except maybe credentials leak in the past.

Even then, you want to revoke those credentials rather than try to wipe it from history, no?

Re: Sourcehut will blacklist the Go module mirror

#346

Post by simon_o »

maximilianburke wrote: post #223
rsc wrote: post #209

The Go team has been making progress toward a complete fix to this problem. Go 1.19 added "go mod download -reuse", which lets it be told about the previous download result including the Git commit refs involved and their hashes. If the relevant parts of the server's advertised ref list is unchanged since the previous download, then the refresh will do nothing more than the ref list, which is very cheap. The proxy.go…

I realize in the real world most modules are probably hosted by large providers that can absorb the bandwidth, like Github, but it seems incredibly discourteous to not prioritize the hammering of small providers, especially two years on when the response is still "maybe later this year". I think Drew is right in that he shouldn't take a personalized Sourcehut-only exception because this doesn't address the core issue…

> he shouldn't take a personalized Sourcehut-only exception because this doesn't address the core issue for any new small providers that pop up

Exactly. We already saw how this ended with Google vs. people running mail servers.

Re: Sourcehut will blacklist the Go module mirror

#347

Post by jdiff »

sidewndr46 wrote: post #342
jdiff wrote: post #341

Earlier quoted context omitted.

If an amount of traffic that nobody else even notices brings you to your knees, you're doing something wrong. Go could be far more efficient but pointing at this and calling it a DDoS is silly.

I called it a DoS, not a DDoS.

Technically it'd be a DDoS, but however distributed it is makes no difference to what we're talking about here. If you could respond to substance, it'd be appreciated.

Re: Sourcehut will blacklist the Go module mirror

#348

Post by simon_o »

jdiff wrote: post #340
rakoo wrote: post #308

Earlier quoted context omitted.

> the appropriate response is different for "I saw this in my logs and it looks weird but it's not bothering me" versus "this is causing serious problems for my site". We have been getting mixed signals about which it is We have not been reading the same tickets and articles it seems

No problems were ever mentioned, serious or otherwise. Elevated traffic isn't automatically a problem. Drew's played it up quite a lot elsewhere, but the Go team can only be reasonably expected to follow the one issue filed, not Drew's entire online presence.

You mean the issue they banned him from? ;-)

Re: Sourcehut will blacklist the Go module mirror

#349

Post by cmatthias »

tptacek wrote: post #298
ddevault wrote: post #281

Earlier quoted context omitted.

We can behave like adults, ask why it's not satisfactory, and come to a more agreeable mutual solution, or we can blithely offer an incomplete solution, muzzle the other party, and just continue our DDoS.

See, here you just did it again: "muzzle the other party", as if it was causally connected to your disagreement about how the module proxy should work, and not to the abuse you inflicted on members of that community.

I think it's worth taking a step back here to say that IMHO regardless of whether the OP's previous comments justify his expulsion from the issue tracker, having the only other available "DDoS opt-out" mechanism be to email Russ Cox directly is _completely insane_ and unacceptable for an organization of Google's size and funding level. If they're going to ban members from the community (perhaps justifiably so), Google needs to either provide another public place to make one of these requests, or preferably make the DDoS feature opt-in rather than opt-out.

Re: Sourcehut will blacklist the Go module mirror

#350

Post by lanstin »

adityasaky wrote: post #345
lanstin wrote: post #134

Earlier quoted context omitted.

Wow, that is shocking. There is never a reason to rebase a public git repo, except maybe credentials leak in the past.

Even then, you want to revoke those credentials rather than try to wipe it from history, no?

That is what I think but security people want both.
Post reply on HN