4 ms·

It sucks having to work around something like this, but maybe the following would work: only allow the first checkout from a given Go node, blackhole later acce

It sucks having to work around something like this, but maybe the following would work: only allow the first checkout from a given Go node, blackhole later accesses. If the repository is modified or a certain time elapsed, reset and allow a download again. Also, if you want to escalate, I wonder if there is a way to create a fake git repository that expands to a huge amount of data when cloning, but uses minimal bandwidth on the server side. Set up a bunch of those on some other host, and use them from go, and wait until google notices. Something like this: https://github.com/ilikenwf/git-zlib-bomb https://github.com/ilikenwf/git-zlib-bomb

verdverm 4y ago
Malicious behavior would come back to byte the author and his users & business
- SSLy 4y ago
  Yes, I also hope EU breaks Google apart.
- captainmuon 4y ago
  Not neccesarily. I was thinking of this story: https://news.ycombinator.com/item?id=26074139 https://news.ycombinator.com/item?id=26074139 > At the height of the browser wars I once woke up to Microsoft hotlinking a small button for downloading our software from the MSN homepage. I tried to reach someone there for hours but nobody cared enough to do something about it. The image was small (no more than a few K), but the millions of requests that page got were enough to totally kill our server. > Finally, I replaced the image on there with a 'Netscape Now' button. Within 15 minutes the matter was resolved. And there was another case where some Indian app was using excessive traffic from Wikimedia, which was solved similarly. Sometimes you have to do something to get the attention of the right people. (And I could imagine if you do it right and are not too malicious, you might actually get a bug bounty on top.)
minus7 4y ago
The problem is that a) you want it to work properly for users of Go modules hosted on your Git forge and b) you don't want to effectively waste time on working around a problem that the GoProxy engineers could just solve with a more intelligent (but maybe more complex) design.

verdverm 4y ago

Malicious behavior would come back to byte the author and his users & business

SSLy 4y ago
Yes, I also hope EU breaks Google apart.
captainmuon 4y ago
Not neccesarily. I was thinking of this story: https://news.ycombinator.com/item?id=26074139 https://news.ycombinator.com/item?id=26074139 > At the height of the browser wars I once woke up to Microsoft hotlinking a small button for downloading our software from the MSN homepage. I tried to reach someone there for hours but nobody cared enough to do something about it. The image was small (no more than a few K), but the millions of requests that page got were enough to totally kill our server. > Finally, I replaced the image on there with a 'Netscape Now' button. Within 15 minutes the matter was resolved. And there was another case where some Indian app was using excessive traffic from Wikimedia, which was solved similarly. Sometimes you have to do something to get the attention of the right people. (And I could imagine if you do it right and are not too malicious, you might actually get a bug bounty on top.)

minus7 4y ago

The problem is that a) you want it to work properly for users of Go modules hosted on your Git forge and b) you don't want to effectively waste time on working around a problem that the GoProxy engineers could just solve with a more intelligent (but maybe more complex) design.