3 ms·

Microsoft's GitHub under fire for DDoSing crucial open source project website

25 points by jjgreen 3y ago

zgluck 3y ago
<I removed this comment after it became clear that I was not allowed to reply to its comments.>
- mat_epice 3y ago
  I disagree. Microsoft has a duty to keep their systems from accessing others at unreasonable rates when requested, even if it's being done at a user's request. Microsoft may not be perpetuating the DoS, but they seem to be complicit. This could easily be used by a truly nefarious party to do similar damage or worse to others.
- jmclnx 3y ago
  I also disagree, and they were DDOS, so technically Microsoft broke a law. >Granlund was not entirely satisfied with Blacker's explanation, nor the implied feebleness of the project's server(s) So, every project needs to have a multi-million USD server Farm ? GMP is probably pulled by various Linux distros and the BSDs, along with other Misc projects. So no need for a huge server farm. For people who do not know what it is: https://gmplib.org/ https://gmplib.org/
  - belltaco 3y ago
    > and they were DDOS, so technically Microsoft broke a law And what law is that?
    - jmclnx 3y ago
      >In the US, denial-of-service attacks may be considered a federal crime under the Computer Fraud and Abuse Act with penalties that include years of imprisonment.[121] The Computer Crime and Intellectual Property Section of the US Department of Justice handles cases of DoS and DDoS. In one example, in July 2019, Austin Thompson, aka DerpTrolling, was sentenced to 27 months in prison and $95,000 restitution by a federal court for conducting multiple DDoS attacks on major video gaming companies, disrupting their systems from hours to days You can do a google search to get more info
- jjgreen 3y ago
  Are you sure? Comments usually have no "reply" button for a minute or two after posting (for everyone)
MattIPv4 3y ago
Why is GitHub the one under fire here? Users on GitHub are using GitHub Actions to build CI pipelines that build stuff, and happen to be pulling from GMP. That's not GitHub's problem that users are using their product in a legitimate manner, it seems to me it is GMP's problem that they can't handle traffic for artifacts from CI systems? It is noted the requests are identical, so would a modicum of caching in front of their origin not make this problem go away completely?
- chungy 3y ago
  CI systems shouldn't have the ability to make network requests at all, honestly.
  - sam_lowry_ 3y ago
    If all CI systems of the world went down, it would have cooled Earth by 0.001°C.
  - TrickyRick 3y ago
    How would you suggest they install dependencies then?
    - dzaima 3y ago
      At the very least, that's an issue that GMP or other projects shouldn't have to worry about. There are many options - you could manually cache things somewhere or pack in the dependencies in the repo. Or, maybe, in a world that wasn't completely set on wasting all resources possible, there just wouldn't be pointless automatic builds on forks, and those builds wouldn't need to re-download the world and could instead just incrementally update. (yes, there are nice consequences of doing fresh builds always, but there are also bad ones as can be seen, and unfortunately the downsides aren't seen by the initiator)
- myhf 3y ago
  Why should this host (and presumably every similar host) take on the burden of this extra complexity? Would a modicum of caching in GitHub Actions libraries not make this problem go away for all hosts in this category?
tronicdude 3y ago
Clickbait
zokier 3y ago
Curious that its MS who is drawing ire despite them being just basically service provider and middle-man here; its arguably the ffmpeg-builds project who are more responsible party.
belltaco 3y ago
Why does HN keep upvoting low quality clickbait garbage from The Register?
- axus 3y ago
  It was relevant but maybe not super-interesting. I thought The Register did a fair job of quoting people involved in the incident and explaining what happened, with less snark than usual. Maybe a better title is "GMP software library admin accuses GitHub of DDoSing their site".
jsnell 3y ago
Discussed a couple of weeks ago, there seems to be basically no information here. https://news.ycombinator.com/item?id=36380325 https://news.ycombinator.com/item?id=36380325

25 points by jjgreen 3y ago

zgluck 3y ago

mat_epice 3y ago
I disagree. Microsoft has a duty to keep their systems from accessing others at unreasonable rates when requested, even if it's being done at a user's request. Microsoft may not be perpetuating the DoS, but they seem to be complicit. This could easily be used by a truly nefarious party to do similar damage or worse to others.
jmclnx 3y ago
I also disagree, and they were DDOS, so technically Microsoft broke a law. >Granlund was not entirely satisfied with Blacker's explanation, nor the implied feebleness of the project's server(s) So, every project needs to have a multi-million USD server Farm ? GMP is probably pulled by various Linux distros and the BSDs, along with other Misc projects. So no need for a huge server farm. For people who do not know what it is: https://gmplib.org/ https://gmplib.org/
- belltaco 3y ago
  > and they were DDOS, so technically Microsoft broke a law And what law is that?
  - jmclnx 3y ago
    >In the US, denial-of-service attacks may be considered a federal crime under the Computer Fraud and Abuse Act with penalties that include years of imprisonment.[121] The Computer Crime and Intellectual Property Section of the US Department of Justice handles cases of DoS and DDoS. In one example, in July 2019, Austin Thompson, aka DerpTrolling, was sentenced to 27 months in prison and $95,000 restitution by a federal court for conducting multiple DDoS attacks on major video gaming companies, disrupting their systems from hours to days You can do a google search to get more info
jjgreen 3y ago
Are you sure? Comments usually have no "reply" button for a minute or two after posting (for everyone)

MattIPv4 3y ago

Why is GitHub the one under fire here? Users on GitHub are using GitHub Actions to build CI pipelines that build stuff, and happen to be pulling from GMP. That's not GitHub's problem that users are using their product in a legitimate manner, it seems to me it is GMP's problem that they can't handle traffic for artifacts from CI systems? It is noted the requests are identical, so would a modicum of caching in front of their origin not make this problem go away completely?

chungy 3y ago
CI systems shouldn't have the ability to make network requests at all, honestly.
- sam_lowry_ 3y ago
  If all CI systems of the world went down, it would have cooled Earth by 0.001°C.
- TrickyRick 3y ago
  How would you suggest they install dependencies then?
  - dzaima 3y ago
    At the very least, that's an issue that GMP or other projects shouldn't have to worry about. There are many options - you could manually cache things somewhere or pack in the dependencies in the repo. Or, maybe, in a world that wasn't completely set on wasting all resources possible, there just wouldn't be pointless automatic builds on forks, and those builds wouldn't need to re-download the world and could instead just incrementally update. (yes, there are nice consequences of doing fresh builds always, but there are also bad ones as can be seen, and unfortunately the downsides aren't seen by the initiator)
myhf 3y ago
Why should this host (and presumably every similar host) take on the burden of this extra complexity? Would a modicum of caching in GitHub Actions libraries not make this problem go away for all hosts in this category?

tronicdude 3y ago

Clickbait

zokier 3y ago

Curious that its MS who is drawing ire despite them being just basically service provider and middle-man here; its arguably the ffmpeg-builds project who are more responsible party.

belltaco 3y ago

Why does HN keep upvoting low quality clickbait garbage from The Register?

axus 3y ago
It was relevant but maybe not super-interesting. I thought The Register did a fair job of quoting people involved in the incident and explaining what happened, with less snark than usual. Maybe a better title is "GMP software library admin accuses GitHub of DDoSing their site".

jsnell 3y ago

Discussed a couple of weeks ago, there seems to be basically no information here. https://news.ycombinator.com/item?id=36380325 https://news.ycombinator.com/item?id=36380325