Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Packages Is Down

githubstatus.com

Post reply on HN
Print view View original

41–50 of 83 posts

Re: GitHub Packages Is Down

#41

Post by naikrovek »

0xbadcafebee wrote: post #28
mfer wrote: post #10

Earlier quoted context omitted.

Homebrew uses it to store bottles (the built assets).

Fun fact: Linux distributions (and some older open source programming language package managers) use hundreds of mirrors distributed around the world to distribute their assets. If any mirror goes down, you just pick a different one. Even when they could just use SourceForge as a mirror (formerly the largest repository for open source software), they still used hundreds more mirrors. Distribution was made easy with r…

GitHub uses pools of mirrors, too, they're just transparent.

twice this year I've had to spend an hour or more with a user because a mirror was down. that's one more time than I've had to deal with a GitHub packages outage this year.

the latest was yesterday. they chose another pool of mirrors and the mirror continually chosen from that pool was down as well. finally I manually checked a mirror, made sure it was up and that signatures matched, then gave them that specific hostname.

the Linux package distribution system is not better. it's just different.

Re: GitHub Packages Is Down

#42

Post by naikrovek »

jacobsenscott wrote: post #38
mfer wrote: post #10

Earlier quoted context omitted.

Homebrew uses it to store bottles (the built assets).

So this is why hb started asking for access to my keychain all the time? (macos) Does it need to log in to gh to install open source software now?

you don't have to, but hb will ask you to if you have a saved credential because your quota on GitHub for downloading packages is much higher if you are logged in.

anonymous stuff on GitHub is usually limited to 60 requests per hour per ip address. if you're authenticated, it's several hundred if not several thousand.

Re: GitHub Packages Is Down

#44

Post by naikrovek »

kreco wrote: post #14
VWWHFSfQ wrote: post #9

Earlier quoted context omitted.

I think it will break any of the open source package managers that rely on GitHub's proprietary hosting and distribution. Cargo, etc.

I did not know package managers relied on Github, this is the most unwise thing to do from a package manager perspective. Anyone could just change username/organization and break thousands/millions of build.

GitHub redirects when this happens. if you move/rename within GitHub, anyway. I don't know how long those redirects last but they probably last until the name is used again.

so it's not quite as bad as you're imagining but still not great.

fortunately GitHub is starting to require 2FA for very popular projects (starting with NPM) because of supply chain attacks like what you describe.

Re: GitHub Packages Is Down

#45

Post by naikrovek »

JamesonNetworks wrote: post #21
chisquared wrote: post #18

Earlier quoted context omitted.

> Anyone could just change username/organization and break thousands/millions of build. GitHub redirects you to the new name in the event of a rename and you look up the old one.

For now, hopefully

yeah. if GitHub is even real.

Re: GitHub Packages Is Down

#47

Post by dpkirchner »

yamtaddle wrote: post #39
lopkeny12ko wrote: post #34

What I find funny and unexplainable is that this class of problem was solved decades ago with distribution mirrors. It's not really clear to me why, within the last decade or so, we collectively decided to centralize hosting on one specific cloud service whose downtime now affects builds across nearly every company. What's perhaps even more surprising to me is that, after a repeated track history of severe and freque…

Those take more time and money to set up, host, maintain, and use, than a single provider. Maybe more than it's worth to avoid occasional downtime.

I think it's exactly this. We often see posts lamenting the lack of financial support for open source projects. How much more or less likely would it be for a mirror of a for-profit corporation's servers to receive financial support? How would they even reach out to potential sponsors without annoying users (ala donation requests in npm install output)?

Re: GitHub Packages Is Down

#48

Post by electroly »

lopkeny12ko wrote: post #34

What I find funny and unexplainable is that this class of problem was solved decades ago with distribution mirrors. It's not really clear to me why, within the last decade or so, we collectively decided to centralize hosting on one specific cloud service whose downtime now affects builds across nearly every company. What's perhaps even more surprising to me is that, after a repeated track history of severe and freque…

IMO we all realized that it doesn't actually matter that much, most of the time. Here we are, indeed, after three years of severe and frequent outages! But everything is... basically fine? Life is full of tradeoffs.

Re: GitHub Packages Is Down

#49

Post by dralley »

lopkeny12ko wrote: post #34

What I find funny and unexplainable is that this class of problem was solved decades ago with distribution mirrors. It's not really clear to me why, within the last decade or so, we collectively decided to centralize hosting on one specific cloud service whose downtime now affects builds across nearly every company. What's perhaps even more surprising to me is that, after a repeated track history of severe and freque…

It's a bit harder to "mirror" an active web app like a container registry than it is a directory of RPM or Debian packages + distro metadata.

Re: GitHub Packages Is Down

#50

Post by Karellen »

mrweasel wrote: post #31

I'm disappointed that this is an issue for some package management systems. 20 years ago I helped run a mirroring service, it's still running today. Distributions such as Debian have hundreds of mirrors. This is a solved problems, but we just decided to but everything in the hands of one for-profit company.

If only there were some way to make git distributed!

/s

Post reply on HN