Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The GMP library's repository is under attack by a single GitHub user

gmplib.org

Post reply on HN
Print view View original

1–10 of 91 posts

Re: The GMP library's repository is under attack by a single GitHub user

#2

Post by bramhaag »

From their website: "NEWS 2023-06-16: The GMP server is under attack by several hundred IP addresses owned by Microsoft cooperation. We do not know if this is made with malice, if it is some sort of mistake, or if some of their cloud customer is running the attack. The attack targets the GMP repo, with thousands of identical requests, most of which makes our server compress the data.

We're firewalling off all of Microsoft's IP addresses as an emergency response. This is a blunt response, but it is the only response which solves the problem quickly, allowing legitimate site usage to work again."

"UPDATE 2023-06-18: We got a reply from somebody with an impressive title at Github. This person explains that Microsoft and Github have investigated this, and they blame a Github user and the poor GMP infrastructure. It is very interesting that they have done nothing to stop the traffic; we need to keep defending our server by firewalling off more Microsoft IP ranges as I write this 30 hours after Github's response. It is also curious that they blame the victim. (Our infrastructure is pretty resilient with powerful server-class hardware and great connectivity to the Internet.)"

Re: The GMP library's repository is under attack by a single GitHub user

#5

Post by notamy »

From the description, it sounds like someone(s) is automatically downloading GMP as a part of a CI process. GHA being the source would explain why it's coming from "several hundred IP addresses owned by Microsoft cooperation (sic)," as well as (maybe) why GH puts the blame on the GMP project for not being able to handle the load.

Edit: This seems to be the responsible project/issue: https://github.com/BtbN/FFmpeg-Builds/issues/278

Re: The GMP library's repository is under attack by a single GitHub user

#6

Post by Aardwolf »

notamy wrote: post #5

From the description, it sounds like someone(s) is automatically downloading GMP as a part of a CI process. GHA being the source would explain why it's coming from "several hundred IP addresses owned by Microsoft cooperation (sic)," as well as (maybe) why GH puts the blame on the GMP project for not being able to handle the load. Edit: This seems to be the responsible project/issue: https://github.com/BtbN/FFmpeg-Bui…

Github could cache it then to improve this?

Re: The GMP library's repository is under attack by a single GitHub user

#7

Post by samwillis »

So another classic case of someone's constant integration system DoS'ing an open source project. We've all become so blinded by big tech and how they operate we fail to see how our actions can affect smaller projects we depend on

CI providers really should do more to prevent and mitigate these when they happen. They should have outbound firewalls, and the ability to request a rate limit on IPs. Having to resort to a ban hammer when people depend on your tool is a shame.

Re: The GMP library's repository is under attack by a single GitHub user

#8

Post by rwmj »

Aardwolf wrote: post #6
notamy wrote: post #5

From the description, it sounds like someone(s) is automatically downloading GMP as a part of a CI process. GHA being the source would explain why it's coming from "several hundred IP addresses owned by Microsoft cooperation (sic)," as well as (maybe) why GH puts the blame on the GMP project for not being able to handle the load. Edit: This seems to be the responsible project/issue: https://github.com/BtbN/FFmpeg-Bui…

Github could cache it then to improve this?

The title is a bit confusing. It seems the GMP project has a self-hosted Mercurial repo (https://gmplib.org/devel/repo-usage) which is being hit by a user at Microsoft that they've somehow tied back to a single github account.

I'm sure it's going to be CI or mirroring or some other automated process.

Re: The GMP library's repository is under attack by a single GitHub user

#9

Post by jsnell »

retrocryptid wrote: post #3

Microsoft employee is dismissive of world outside Microsoft. Film at 11. Which is to say... what's MSFT's motivation to worry about this?

They've clearly worried enough about it to have somebody investigate the initial report and rootcause it. (And the motivation for that wasn't just some kind of a huge public outcry on the first report, because as far as I can tell that sank without a trace at least on HN). If the traffic from that customer is within the typical norms of git usage, rather than clearly abusive, then what further action would you expect [0]?

And honestly, whoever is maintaining the GMP server isn't appearing particularly competent based on the messages they've written so far. That they'd misidentify or mischaracterize non-attack traffic as abusive seems pretty plausible.

[0] Ok, I'll admit that there is one thing that GitHub should do even if these particular requests are not abusive, just as a best practice when operating a system for running untrusted code that can connect to the Internet. The egress IPs from any single GitHub customer should be sticky, rather than them having a massive pool of IPs shared by all the users. But if that's not how their systems are already architected, making it happen is probably a multi-quarter effort.

Post reply on HN