Live data from Hacker News

GitHub experiencing a large DDoS attack

status.github.com

51–60 of 105 posts

Re: GitHub experiencing a large DDoS attack

#51
post #33

Earlier quoted context omitted.

This happens to our team too. Does anyone else find it ironic that Git is a distributed version control system, yet we rushed to centralize it and base our entire workflow around GitHub?

Github is just a node. IF Github dies , people still have the full repos on their computers.That's not always the case with SVN... And most people are too lazy/dont have resources to set up a git server anyway.

If your workflow involves tickets on github, you're going to have a bad time.

Re: GitHub experiencing a large DDoS attack

#52
post #33

Earlier quoted context omitted.

This happens to our team too. Does anyone else find it ironic that Git is a distributed version control system, yet we rushed to centralize it and base our entire workflow around GitHub?

Github is just a node. IF Github dies , people still have the full repos on their computers.That's not always the case with SVN... And most people are too lazy/dont have resources to set up a git server anyway.

The problem isn't developer access to the code, but that GitHub gets tightly linked to other tools, such as continuous integration and test tools. If Jenkins is expecting to pull the latest code from GitHub, but GitHub is down it's a PITA.

There's also stuff like GitHub Issues, which are separate from the actual Git hosting. So even if the source code is available and the 3rd party tools aren't broken, work can still be interrupted.

Re: GitHub experiencing a large DDoS attack

#53
post #7

This is getting really problematic. It stops our whole team every time. Anybody has experience with Gitlab and Gitlab CI? How's the flow compared to Github, especially for pull requests, commenting and collaboration?

time to learn peer to peer git pull for your team

Re: GitHub experiencing a large DDoS attack

#54

Why is this happening to them almost every day? Is someone jealous? Proving a point? If so, what point? Surely by now, GitHub must know who's responsible and putting more in place to mitigate as much as possible before this happens. Right?

Everyday? The last attack was August 4th.

https://status.github.com/messages

Re: GitHub experiencing a large DDoS attack

#55

Earlier quoted context omitted.

Have you tried Jenkins as a CI server? While the core Gitlab product is quite nice, the feedback I've heard on the CI component is that it becomes problematic once builds become non-trivial (though to be fair, I've heard this mostly from Jenkins folks).

We just built our own build scripts (in make(1) like god intended) and wrap jenkins around that. Pretty hard to go wrong with tech that's been tested for the last 35 years

With due respect, God probably had little to do with make.

Re: GitHub experiencing a large DDoS attack

#56

Can someone with experience mitigating an attack like this describe how it's done? A known set of hosts/address spaces is fine, but it's the "distributed" part I don't understand how to deal with.

Usually there is some pattern to the traffic that can be identified and filtered out. There are manual ways to do this (iptables, basic firewalls) or more sophisticated "anti-DDOS" boxes you can buy to automate or simplify the process (e.g. Cisco Anomaly Guard or Juniper Junos DDoS Secure).

Re: GitHub experiencing a large DDoS attack

#57
post #47

Earlier quoted context omitted.

The so what is that the majority of people on HN are developers and the majority of them use Github either personally or with their teams. So a major outage is costing potentially millions of dollars in potentially lost developer time. If you calculate an average hourly of just $50 and a developer loses 20 minutes. Then that outage costs $17 x the number of affected developers. That's a pretty big loss. I'm reading H…

You can't pull code from another node, i.e another developer? Git is distributed, if you want centralised source control use Perforce or SVN or something.

sure, and I can build a commenting and pull request system while I'm at it. It's highly inefficient to change workflow for an outage that might not last an hour.
Post reply on HN