Live data from Hacker News

Sourcehut will blacklist the Go module mirror

sourcehut.org

361–365 of 365 posts

Re: Sourcehut will blacklist the Go module mirror

#361
post #341

Earlier quoted context omitted.

They should have them add a file to their web service at a path of "/i_want_to_live.txt" to indicate not to DoS the server.

If an amount of traffic that nobody else even notices brings you to your knees, you're doing something wrong. Go could be far more efficient but pointing at this and calling it a DDoS is silly.

You are correct, it was more a complaint about resource usage and costs, as opposed to a breakage of the src.ht service.

Re: Sourcehut will blacklist the Go module mirror

#362

Earlier quoted context omitted.

Per the issue, both.

I recently moved to docker build pipeline for a project, and it’s redownloading all deps on each source file change, unlike the efficient on disk incremental compilation, because of how docker layer caching works, so my usage skyrocketed (and my build times went from seconds to minutes).

Since writing this, I have seen the trick - copy just the go.sum and go.mid files into an earlier layer, then get the deps, then copy all the other source code.

Re: Sourcehut will blacklist the Go module mirror

#363

Earlier quoted context omitted.

That is what I think but security people want both.

Strange, I hadn't come across that before. Not sure what they're trying to achieve, deny they ever had a leak?

Third party security consultants, following a check list.

Re: Sourcehut will blacklist the Go module mirror

#364
post #99

Earlier quoted context omitted.

Someone in the Go team (rsc, IIRC) commented on how a Google executive came to him in the cafeteria to congratulate him on the launch. It turns out the executive confused him with someone on the Dart or Flutter teams.

I just hope it wasn't Rob Pike.

Found it: Ian Lance Taylor:

https://groups.google.com/g/golang-nuts/c/6dKNSN0M_kg/m/EUzc...

Now a bit of personal history. The Go project was started, by Rob, Robert, and Ken, as a bottom-up project. I joined the project some 9 months later, on my own initiative, against my manager's preference. There was no mandate or suggestion from Google management or executives that Google should develop a programming language. For many years, including well after the open source release, I doubt any Google executives had more than a vague awareness of the existence of Go (I recall a time when Google's SVP of Engineering saw some of us in the cafeteria and congratulated us on a release; this was surprising since we hadn't released anything recently, and it soon came up that he thought we were working on the Dart language, not the Go language.)

Re: Sourcehut will blacklist the Go module mirror

#365
post #209

The Go team has been making progress toward a complete fix to this problem. Go 1.19 added "go mod download -reuse", which lets it be told about the previous download result including the Git commit refs involved and their hashes. If the relevant parts of the server's advertised ref list is unchanged since the previous download, then the refresh will do nothing more than the ref list, which is very cheap. The proxy.go…

Hey Russ, I got your messages that my emails aren't coming through but I'm not sure why. As an alternative, you can reach me on IRC at ddevault on Libera Chat. I'm in CEST, but my bouncer is always online. Cheers!
Post reply on HN