Live data from Hacker News

The GMP library's repository is under attack by a single GitHub user

gmplib.org

41–50 of 91 posts

Re: The GMP library's repository is under attack by a single GitHub user

#41
post #27

Why does forking cause a GitHub actions schedule to run? This is pretty unexpected. I wonder what % of actions builds are useless runs like this? Edit: to the shadowbanned guy who hasn’t realised he’s been shadowbanned for years, that’s not correct.

It’s a cron workflow

Yes?

Re: The GMP library's repository is under attack by a single GitHub user

#42
post #28

Earlier quoted context omitted.

I’m a bit confused as to why 700 automated clone requests per day would be an unreasonable amount of traffic for a project like GMP. That doesn’t sound like much traffic to me, especially since they reportedly have a 24 core CPU with 256GB of RAM. Is cloning a mercurial repo highly server intensive?

Those 700 clones would all hit at exactly the same time. That's quite a load for a single server, especially since Mercurial can't be cached that easily.

So if they're all hitting at exactly the same time, why not set up a firewall rule to block traffic from GitHub at exactly that time of day?

Re: The GMP library's repository is under attack by a single GitHub user

#43
post #15

More context: https://github.com/BtbN/FFmpeg-Builds/issues/278 The FFmpeg-Builds repo has a GitHub Actions Workflow which clones the Mercurial repo. However, this runs as a (daily?) cronjob. In addition, this repo has 700 forks and now all of them are running the same workflow. This is out of control for the original author of the repo as there’s no way to change those 700 forks… EDIT: Also relevant is that there’s n…

The idea that not hosting your code on GitHub makes you a “trouble maker” is ridiculous.

Re: The GMP library's repository is under attack by a single GitHub user

#44
post #34

The whole thread is curated yet again (as all Microsoft criticism threads are). Shame on everyone who does not appreciate the volunteer work on gmp and ridicules their servers.

Microsoft isn't to blame here, other than being kind of a dick diminishing some other project's server. The same kind of attack could just as easily come from Gitlab or any other service that allows easy CI/CD cloning.

The problem started with someone making a poorly built automated build script for another project, and that build script getting forked hundreds of times, triggering a huge load all by the lack of spread in the upstream build script.

This is nothing compared to an actual DDoS attack, which Microsoft was partially blamed for in the previous email. I can see why someone over at MS would be annoyed to find out the supposed DDoS was just 700 requests.

Re: The GMP library's repository is under attack by a single GitHub user

#45
post #27

Why does forking cause a GitHub actions schedule to run? This is pretty unexpected. I wonder what % of actions builds are useless runs like this? Edit: to the shadowbanned guy who hasn’t realised he’s been shadowbanned for years, that’s not correct.

[dead]

Re: The GMP library's repository is under attack by a single GitHub user

#46
post #28

Earlier quoted context omitted.

It's totally reasonable to say that it isn't malicious and they aren't going to stop it, but it's unreasonable and unhelpful to add "seems like your servers just suck". They also missed or failed to mention that there are 700 forks of the project running the same thing at the same time.

I’m a bit confused as to why 700 automated clone requests per day would be an unreasonable amount of traffic for a project like GMP. That doesn’t sound like much traffic to me, especially since they reportedly have a 24 core CPU with 256GB of RAM. Is cloning a mercurial repo highly server intensive?

[deleted]

Re: The GMP library's repository is under attack by a single GitHub user

#48
post #41

Earlier quoted context omitted.

It’s a cron workflow

Yes?

Why would you expect a cron task to work differently because a repo is a fork or not? Maybe Actions/Workflows shouldn’t be enabled by default on forks, which used to be the case but that has its problems too. You can disable actions on your forks.

Re: The GMP library's repository is under attack by a single GitHub user

#49
post #19

Sounds like GitHub actions should be caching clones of foreign Git repos. People already trust GH CI enough to run their code, so why not trust their cache as well?

FWIW, it’s not a git repo, it’s a mercurial repo.

And even if it was a git repo, seems this would still be a problem if everything wasn't on github. I guess the solution is to put all code on github...
Post reply on HN