Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google has been DDoSing Sourcehut for over a year

drewdevault.com

Post reply on HN
Print view View original

131–140 of 225 posts

Re: Google has been DDoSing Sourcehut for over a year

#131

Post by randomtwiddler »

FiloSottile wrote: post #46
threatofrain wrote: post #14

> I was banned from the Go issue tracker for mysterious reasons, so I cannot continue to nag them for a fix.¹ I can’t blackhole their IP addresses, because that would make all Go modules hosted on git.sr.ht stop working for default Go configurations (i.e. without GOPROXY=direct). I tried to advocate for Linux distros to patch out GOPROXY by default, citing privacy reasons, but I was unsuccessful. I have no further re…

> In the meantime, if you would prefer, we can turn off all refresh traffic for your domain while we continue to improve this on our end. That would mean that the only traffic you would receive from us would be the result of a request directly from a user. This may impact the freshness of your domain's data which users receive from our servers, since we need to have some caching on our end to prevent too frequent fet…

Seems like recrimination to bring up unrelated items.

Re: Google has been DDoSing Sourcehut for over a year

#132

Post by spicybright »

CryptoBanker wrote: post #24
toast0 wrote: post #18

Earlier quoted context omitted.

Yeah, but that's not an option according to the article. > I can’t blackhole their IP addresses, because that would make all Go modules hosted on git.sr.ht stop working for default Go configurations (i.e. without GOPROXY=direct)

That’s more of a “won’t” than a “can’t”

You could easily proxy around it. It's inconvenient to set up, but it can definitely be a set it and forget it thing.

Re: Google has been DDoSing Sourcehut for over a year

#133

Post by lupire »

prepend wrote: post #130
res0nat0r wrote: post #105

Earlier quoted context omitted.

They offered to turn off refreshing of his domain it appears on Jun 8, 2021: https://github.com/golang/go/issues/44577#issuecomment-85692...

That doesn’t seem like a solution at all and is actually kind of punative as that would make srht bad for hosting go. I think this is just an example of Google being a jerk and not caring enough to do proper software engineering. Go seems really interesting but I have avoided using it because it’s so tied to Google. And I don’t trust Google to make good decisions for developers or users.

It looks like a solution to me: Google stops proactive refreshing, and so users get data that is fresh up to the cache timeout.

Users who can't wait that long can disable the proxy, and SourceHut can recommend users do that.

Re: Google has been DDoSing Sourcehut for over a year

#134

Post by cycomanic »

tptacek wrote: post #113
cycomanic wrote: post #72

Earlier quoted context omitted.

> Disclosure: I was on the Go team at Google until earlier this month. Dealing with DeVault's bad faith arguments is one of the few things I won't miss of that job. So does or does not the problem persist? Second was or was he not banned from the commenting issue tracker. Third does the CoC require that a person gets notified by the moderator and was DeVault notified? If the answers are yes to all those problems I wo…

The subthread we're commenting on is about the ban, not about the proxy.

The OP specifically said:

> Dealing with DeVault's bad faith arguments is one of the few things I won't miss of that job.

They didn't say bad faith argument about banning, they said argument_s_. So he is not just talking about a single one. Which are the bad faith arguments? I asked if any of the things were not true, nobody said they were untrue. How can any of the arguments (I did not just talk about the proxy, I also talked about the banning) be bad faith if they are true?

Re: Google has been DDoSing Sourcehut for over a year

#135

Post by cycomanic »

verdverm wrote: post #99
cycomanic wrote: post #97

Earlier quoted context omitted.

The 4G daily was a different user who hosted a go module where he was the single user on his own server, this was not DeVault. I'd be pretty pissed if I hosted a go module essentially for myself and suddenly I have a $200 dollar bill, because google decided to clone my repository 500 times a day. If it doesn't bother you, how about you donate $200 a month to a charity of my choosing, because it doesn't matter to you.

Self hosting costs money, for this one user it would seem the options of blocking or other options are more tenable If money was a problem, I'd expect this individual to ha e rectified it on their end

So tell me why do people use DDoS protection? It's just money. If you run a server you should be able to eat all the cost!

Seriously do you follow through what your arguments actually mean if applied in general?

Re: Google has been DDoSing Sourcehut for over a year

#136

Post by randomtwiddler »

joshuamorton wrote: post #106
cycomanic wrote: post #103

Earlier quoted context omitted.

The guy who had 4G of traffic a day was self-hosting his go-module where he was the only user. Google downloaded his repo 500 times a day, that's some serious traffic for a single person, and no he was not a git hosting service. Also traffic is not free, so even if they maintain a cache somewhere there is a cost to this.

> The guy who had 4G of traffic a day was self-hosting his go-module where he was the only user. Google downloaded his repo 500 times a day, that's some serious traffic for a single person, and no he was not a git hosting service. Ok so let me answer your previous question more explicitly: > So the solution is that everyone who does not want that behavior should request that they turn of refresh traffic for their dom…

> We have an answer to this. It is, empirically, a very long time, as there seem to be a handful (possibly only 2, certainly less than 5) users impacted negatively enough to report an issue. It does not usually make sense to solve an issue that doesn't exist. Presumably dozens of users reporting the same issue would cause a reprioritization, but if no one is complaining, there's no reason to change priorities.

You have enough information to understand that it is a problem, regardless of how many people are actually complaining to you. I self host git, if Google was chewing up 120gb a month of my bandwidth I'd definitely feel it but I wouldn't figure out what was going on easily, let alone figure how how to complain and stop it.

The behavior is rude and bad engineering. Just because people aren't yelling at you for leaving dog poop in their yard doesn't mean it isn't a problem for them too.

Re: Google has been DDoSing Sourcehut for over a year

#137

Post by chitowneats »

ShowalkKama wrote: post #15
toast0 wrote: post #10

If it were me, and I wasn't willing to just block the traffic, I might just set a 128 kbps limit on it and call it a day[1]. Eventually, the other side will figure out that their fetchers are all backed up and work out how to do their job without burning so much bandwidth. [1] Yeah, that can be a bit of a pain to setup depending on the server settings, but some people have to pay for bandwidth and server resources, s…

Or you could mess with a random percentage of the requests: tarpit them, drop random packets, reply with malformed answers etc. If you keep the percentage low they might have a fun time debugging :)

Seems like there's no need for this. HTTP spec covers "too many requests" already. Why further antagonize things rather than clearly state the problem?

Re: Google has been DDoSing Sourcehut for over a year

#138

Post by ezfe »

pretext-1 wrote: post #34
ezfe wrote: post #8

Earlier quoted context omitted.

How could node not do that? NPM hosts all the packages so of course it does.

They could do it similar to Go. Instead of "facebook/react" it could be "facebook.com/react" in "package.json".

Well yes, but my point here is that NPM's entire design is around not doing that - whereas Go's design isn't

Re: Google has been DDoSing Sourcehut for over a year

#139

Post by joshuamorton »

cycomanic wrote: post #134
tptacek wrote: post #113

Earlier quoted context omitted.

The subthread we're commenting on is about the ban, not about the proxy.

The OP specifically said: > Dealing with DeVault's bad faith arguments is one of the few things I won't miss of that job. They didn't say bad faith argument about banning, they said argument_s_. So he is not just talking about a single one. Which are the bad faith arguments? I asked if any of the things were not true, nobody said they were untrue. How can any of the arguments (I did not just talk about the proxy, I a…

The bad faith arguments being referred to are ones made on the issuetracker, not in the article.

Re: Google has been DDoSing Sourcehut for over a year

#140

Post by spacexsucks »

FiloSottile wrote: post #46
threatofrain wrote: post #14

> I was banned from the Go issue tracker for mysterious reasons, so I cannot continue to nag them for a fix.¹ I can’t blackhole their IP addresses, because that would make all Go modules hosted on git.sr.ht stop working for default Go configurations (i.e. without GOPROXY=direct). I tried to advocate for Linux distros to patch out GOPROXY by default, citing privacy reasons, but I was unsuccessful. I have no further re…

> In the meantime, if you would prefer, we can turn off all refresh traffic for your domain while we continue to improve this on our end. That would mean that the only traffic you would receive from us would be the result of a request directly from a user. This may impact the freshness of your domain's data which users receive from our servers, since we need to have some caching on our end to prevent too frequent fet…

No post body was provided.
Post reply on HN