6 ms·

How are his arguments in bad faith if he is the one that gets DDoSed by your software for over a year, and still tries to be helpful? Not sure if you realize t

How are his arguments in bad faith if he is the one that gets DDoSed by your software for over a year, and still tries to be helpful? Not sure if you realize the absurdity of this, but he has to pay traffic and server costs. Like everyone else, except probably Google as it seems!? I mean, you didn't even consider implementing a simple fetch of an already cloned repository in your mirroring server code. So yeah, I'd argue that the bad faith part is actually justified.

rfoo 4y ago
> and still tries to be helpful "Assuming everyone else have exactly same design choice and architecture as yourself, making suggestion on this ground and calling other people crazy because they can't implement what you suggest them to do" is not trying to be helpful. Well, or maybe I'm just frustrated reading his repeated "please keep a copy 'locally' somewhere and run git fetch". Just like how I'm frustrated arguing with him on HN about whether sending patch to mail list is better than GitHub pull request. Don't get me wrong, I understand this is a real Google-scale system v.s. individual code hosting website issue, I just don't see how his "please stop being Google and instead try my works-fine-on-one-box solution" take is helpful.
- ocdtrekkie 4y ago
  Cloudflare manages to cache things and then serve them to lots of people, without having to request the same content 50 times an hour. Maybe Google should move some of their services over to a better content delivery platform? o.O This is a scenario where anyone who isn't a Googler can see that "being Google" is not a justification for bad engineering. Do better.
- cycomanic 4y ago
  I often don't agree with DeVaults opinions, however the design decision here is actually costing other people real money and I have not seen a convincing argument why it is necessary. Instead they acknowledge it's an issue, but then continue that behavior for nearly a year, which IMO shows complete disregard for smaller services or individuals hosting their own repositories.
- thaway2839 4y ago
  Suggesting ideas is not the same as assuming everyone else should have the exact same design choice and architecture. The problem is that the actual issue owner on the Google side does not appear to have any solutions (or is burying solutions because they may be too complex). It's pretty clear that the issue owner agrees there is something wrong here. That's why the issue is kept open and their only reason for not fixing it is that it's a complicated fix which requires effort. As a workaround, they offer Drew the opportunity to essentially disable his service from being used as a useful source of Go modules.
- ajford 4y ago
  Just about every CDN out there manages to cache at a global scale from a single hit, so I don't understand what's so vastly different about the go mirror system that it can't do the same under the hood.
arccy 4y ago
bad faith refers to his behavior on other issue threads. also he (used to) spam the issue tracker with ads for his services
- pengaru 4y ago
  > also he (used to) spam the issue tracker with ads for his services If there's any entity I'm totally ok with anyone spamming with ads, it's Google.
  - tptacek 4y ago
    It's not "Google" you'd be spamming, it's the Go language community, most of which has nothing to do with Google. Please don't make high-drama arguments like this.
- cookiengineer 4y ago
  > also he (used to) spam the issue tracker with ads for his services Do you have links to those ad spams? I couldn't find obvious ones when I was using GitHub's issue search field. Edit: It seems ddevault opened and/or replied to only 10 issues, which I would hardly call "spam".
johnduhart 4y ago
> I mean, you didn't even consider implementing a simple fetch of an already cloned repository in your mirroring server code. So yeah, I'd argue that the bad faith part is actually justified. https://github.com/golang/go/issues/44577#issuecomment-1137818914 https://github.com/golang/go/issues/44577#issuecomment-11378... > We did consider caching clones, but it has security implications and adds complexity, so we decided not to. It is certainly not trivial to do and not something we are likely to do based on this issue. Drew continues to act as though he is always correct, and any viewpoint that isn't his is just moronic. I've repeatedly seen this behavior from him in multiple venues over the years, and I'm happy to see the wider community start calling this out as childish.
- ocdtrekkie 4y ago
  In this case, it's really hard to see thrashing other people's servers relentlessly to collect data you already have as anything but incredibly, incredibly poor engineering. Y'all should write him a check for that much resource waste.
  - adamrezich 4y ago
    without knowing anything about this situation outside of this thread and the post it links to, it comes across as willful negligence to screw over someone who was a bother in past community transgressions
    - tptacek 4y ago
      That's a risible suggestion. Even DeVault doesn't say that.
  - verdverm 4y ago
    It's less than $200 per month to send out 4G daily. If his business can't afford that, there is something else going on. What is the total daily bandwidth that sourcehut uses anyway? What percentage is go module fetching?
    - 4y ago
szbalint 4y ago
“DDoSed” He complains about outgoing traffic of 4GB/day. On a server. In 2022. If this is an issue he should not be hosting Go modules on his own servers.
- thaway2839 4y ago
  4 GB/day is a different person facing the same issue who is hosting a single module they claim is likely only used by them.
  - Ventito 4y ago
    Still whats 4GB a day? I really really don't get the issue. Is he io bound? Is there no reasonable way for git hosting services to actually cache git checkouts? DDoS / DoS should only be used, in my opinion, when the server goes down complelty not if it has a little bit of load and i still haven't seen anything which indicates that this is a real issue? And i don't want to come across negativly, i just don't get the issue.
    - tete 4y ago
      Given that Google decides to do that effectively out of bad design. What if your website hosted 100 Go modules and it scales linearly, that's 400GB, still not a problem? What if every programming language did that? I don't really understand how that's not an issue. Sure it's not a big deal, if just one service does that, but it's still something that should be fixed. If you are Google it should be expected that this fix is not taking over a year.

rfoo 4y ago

> and still tries to be helpful "Assuming everyone else have exactly same design choice and architecture as yourself, making suggestion on this ground and calling other people crazy because they can't implement what you suggest them to do" is not trying to be helpful. Well, or maybe I'm just frustrated reading his repeated "please keep a copy 'locally' somewhere and run git fetch". Just like how I'm frustrated arguing with him on HN about whether sending patch to mail list is better than GitHub pull request. Don't get me wrong, I understand this is a real Google-scale system v.s. individual code hosting website issue, I just don't see how his "please stop being Google and instead try my works-fine-on-one-box solution" take is helpful.

ocdtrekkie 4y ago
Cloudflare manages to cache things and then serve them to lots of people, without having to request the same content 50 times an hour. Maybe Google should move some of their services over to a better content delivery platform? o.O This is a scenario where anyone who isn't a Googler can see that "being Google" is not a justification for bad engineering. Do better.
cycomanic 4y ago
I often don't agree with DeVaults opinions, however the design decision here is actually costing other people real money and I have not seen a convincing argument why it is necessary. Instead they acknowledge it's an issue, but then continue that behavior for nearly a year, which IMO shows complete disregard for smaller services or individuals hosting their own repositories.
thaway2839 4y ago
Suggesting ideas is not the same as assuming everyone else should have the exact same design choice and architecture. The problem is that the actual issue owner on the Google side does not appear to have any solutions (or is burying solutions because they may be too complex). It's pretty clear that the issue owner agrees there is something wrong here. That's why the issue is kept open and their only reason for not fixing it is that it's a complicated fix which requires effort. As a workaround, they offer Drew the opportunity to essentially disable his service from being used as a useful source of Go modules.
ajford 4y ago
Just about every CDN out there manages to cache at a global scale from a single hit, so I don't understand what's so vastly different about the go mirror system that it can't do the same under the hood.

arccy 4y ago

bad faith refers to his behavior on other issue threads. also he (used to) spam the issue tracker with ads for his services

pengaru 4y ago
> also he (used to) spam the issue tracker with ads for his services If there's any entity I'm totally ok with anyone spamming with ads, it's Google.
- tptacek 4y ago
  It's not "Google" you'd be spamming, it's the Go language community, most of which has nothing to do with Google. Please don't make high-drama arguments like this.
cookiengineer 4y ago
> also he (used to) spam the issue tracker with ads for his services Do you have links to those ad spams? I couldn't find obvious ones when I was using GitHub's issue search field. Edit: It seems ddevault opened and/or replied to only 10 issues, which I would hardly call "spam".

johnduhart 4y ago

> I mean, you didn't even consider implementing a simple fetch of an already cloned repository in your mirroring server code. So yeah, I'd argue that the bad faith part is actually justified. https://github.com/golang/go/issues/44577#issuecomment-1137818914 https://github.com/golang/go/issues/44577#issuecomment-11378... > We did consider caching clones, but it has security implications and adds complexity, so we decided not to. It is certainly not trivial to do and not something we are likely to do based on this issue. Drew continues to act as though he is always correct, and any viewpoint that isn't his is just moronic. I've repeatedly seen this behavior from him in multiple venues over the years, and I'm happy to see the wider community start calling this out as childish.

ocdtrekkie 4y ago
In this case, it's really hard to see thrashing other people's servers relentlessly to collect data you already have as anything but incredibly, incredibly poor engineering. Y'all should write him a check for that much resource waste.
- adamrezich 4y ago
  without knowing anything about this situation outside of this thread and the post it links to, it comes across as willful negligence to screw over someone who was a bother in past community transgressions
  - tptacek 4y ago
    That's a risible suggestion. Even DeVault doesn't say that.
- verdverm 4y ago
  It's less than $200 per month to send out 4G daily. If his business can't afford that, there is something else going on. What is the total daily bandwidth that sourcehut uses anyway? What percentage is go module fetching?
  - 4y ago

szbalint 4y ago

“DDoSed” He complains about outgoing traffic of 4GB/day. On a server. In 2022. If this is an issue he should not be hosting Go modules on his own servers.

thaway2839 4y ago
4 GB/day is a different person facing the same issue who is hosting a single module they claim is likely only used by them.
- Ventito 4y ago
  Still whats 4GB a day? I really really don't get the issue. Is he io bound? Is there no reasonable way for git hosting services to actually cache git checkouts? DDoS / DoS should only be used, in my opinion, when the server goes down complelty not if it has a little bit of load and i still haven't seen anything which indicates that this is a real issue? And i don't want to come across negativly, i just don't get the issue.
  - tete 4y ago
    Given that Google decides to do that effectively out of bad design. What if your website hosted 100 Go modules and it scales linearly, that's 400GB, still not a problem? What if every programming language did that? I don't really understand how that's not an issue. Sure it's not a big deal, if just one service does that, but it's still something that should be fixed. If you are Google it should be expected that this fix is not taking over a year.