11 ms·
Sourcehut and Codeberg are both currently experiencing a DDoS attack
- palata 3y agoGenuinely interested: who the hell pays to DDoS services like Sourcehut and Codeberg? :/
- no_wizard 3y agoGitea! /s In all seriousness though, the reason why services end up under DDoS attacks are wide and sometimes complex. There is a likelihood that someone is simply upset at these services, or that there was a coordinated effort against source control programs more generally but its only succeeding against these two (that we're aware of), but not say, GitLab / GitHub. Another example: they may be targeted simply due to traffic and volume, and this is an attempt to "dry run" DDoS techniques that may be used against bigger sites down the road too. There's alot of room for why these things happen. I've learned that motivations and execution is very wide.
- the_duke 3y agoAnother reason is hosted content that someone really wants gone from the internet. Of course the efficacy of attacking a service with lots of content is questionable, but the plan is to put on so much pressure that the service removes the content.
- FiniteField 3y ago[flagged]
- kornhole 3y agoI know of some projects that were on Github and received cease and desist letters. So they moved their project to one of these other repos. It is entirely possible but of course only speculation.
- akerl_ 3y agoThe Venn diagram is of “entities that pay lawyers to send cease and desist letters” and “entities that launch DDoS attacks” is pretty non-overlapping.
- janc_ 3y agoYou would think so, but then I just read about eBay executives sending cockroaches & spiders, funeral/grieving-related items and a bloody pig mask to a couple that wrote some not-so-positive reviews about that company… https://www.theguardian.com/technology/2024/jan/11/ebay-fined-harassment-couple-spiders-cockroaches-newsletter-ecommercebytes https://www.theguardian.com/technology/2024/jan/11/ebay-fine...
- kornhole 3y agoYou should be using a phase diagram rather than a venn diagram here. It depends on persistence or tenacity of the adversary. Legal and administrative measures is the first phase. If that fails to deter adversary, non-traditional and perhaps extrajudicial measures can be employed.
- deleted 3y ago[deleted]
- kencausey 3y agoProbably someone seeking a ransom.
- pityJuke 3y agoHN's provider was DDoSed yesterday [0], I wonder if the popular website being targeted was HN itself. Either way, I do wonder if there is any relation. [0]: https://news.ycombinator.com/item?id=38939559 https://news.ycombinator.com/item?id=38939559
- pokstad 3y agoSubversion hold outs
- WD-42 3y agoWhat if some OSS hosted on one of these sites was compromised, and now that they are offline it will be harder to discover. Perhaps builds or binaries have already been distributed.
- cdchn 3y agoLike the infamous Linux kernel backdoor. If BitKeeper had been DDOS'd it would have been harder to detect the difference between the version with the backdoor that "appeared" in CVS.
- rakoo 3y agoGithub has already been DDoSed by state actors not willing to see something being distributed, such as anti-censorship tools: https://en.wikipedia.org/wiki/Censorship_of_GitHub#DDoS_attack https://en.wikipedia.org/wiki/Censorship_of_GitHub#DDoS_atta... Same state actors might do the same here
- jmprspret 3y agoCloudflare :^)
- fullspectrumdev 3y agoYou joke, but in the DDoS mitigation service industry it’s not unheard of as a high pressure sales tactic. Packeteering, as a friend called it.
- nonbirithm 3y agoMaybe someone who doesn't like Sourcehut or Drew for some reason.
- monster2control 3y agoMore likely Drew. Lol
- tourmalinetaco 3y agoThe Christian calculators are finally biting back.
- 0dayz 3y agoThis is some reference I don't get.
- tourmalinetaco 3y agoDrew is an antagonistic atheist, which is part of a good handful of reasons he was banned from Omnimaga, a calculator forum.
- monster2control 3y agoIt would be epic if the DDoS was from a swarm of KnightOS infected calculators. Even more if they were able to do it because Drew made a workable network stack. lol
- xigoi 3y agoBut why also Codeberg?
- WhyNotHugo 3y agostatus.sr.ht (sourcehut's status page) is hosted on codeberg.
- tiffanyh 3y ago> "we called [Cloudflare] and they quoted a very big number" [0] This is what I've never understood about Cloudflare. You're suppose to be able to purchase a business account for $200/mo [1] But it seems like at some point, Cloudflare says you need to upgrade to a custom pricing plan. What triggers Cloudflare to state you can't use the $200 Business Plan account? [0] https://fosstodon.org/@arch@floofy.tech/111739294821803544 https://fosstodon.org/@arch@floofy.tech/111739294821803544 [1] https://www.cloudflare.com/plans/ https://www.cloudflare.com/plans/
- notamy 3y ago> What triggers Cloudflare to state you can't use the $200 Business Plan account? iirc one reason is needing proxying of non-HTTP protocols.
- mortallywounded 3y agoahem if I was into tinfoil theories, I'd wonder if Cloudflare knew more about the attack =P Oh? You want that attack to stop? It's going to be big number.
- em-bee 3y agoit would be a shame if we had to keep letting all that traffic through... ...we'd have to charge you for causing to much traffic to your server
- tiffanyh 3y agoHN just yesterday had a DDOS, and switched over to using Cloudflare. https://news.ycombinator.com/item?id=38939559 https://news.ycombinator.com/item?id=38939559
- danpalmer 3y agoAt a previous company we ended up choosing against Cloudflare because their sales team were so terrible. > It's $200/mo! >> Ok, but the other quotes we're receiving for $requirements are 10x that, are you sure? > Yep, sure, it's $200/mo* (until it isn't) >> Right, so we might pay more than that, what would the pricing be for $requirements? > $200/mo* >> Ok, cool, just to confirm, if we put $requirements of traffic through this service, we will only be charged $200/mo? > Wellllllll, that might work out to more like $4000/mo. Compared to all the competitors who would happily take our $requirements, stick them in some internal calculator, and give us a real figure.
- deleted 3y ago[deleted]
- doublerabbit 3y ago[flagged]
- nine_k 3y agoA ton of source code that is stored on Sourcehut and Codeberg is also likely replicated over dozens or hundreds of other machines. I wonder if something like the BitTorrent protocol could be used to keep a repo accessible without directing all the traffic to one site. Take a magnet link to a particular repo and commit, receive the complete branch eventually. Now serve these commits to other peers. That would be rather harder to DDoS or censor. (This, of course, ignores other aspects of forges: CI/CD, releases, packages, etc. Issues and even code reviews can be branches, too; such tools exist, and e.g. Fossil has them built in.)
- mcepl 3y agoOnly not having access to https://todo.sr.ht https://todo.sr.ht made me to recognize fully, that I don’t have any access to it. https://github.com/MichaelMure/git-bug https://github.com/MichaelMure/git-bug suddenly looks much more interesting.
- palata 3y agoThe problem I see with the torrent approach being that you need to reach a consensus eventually, right? If I push a commit on the main branch, share that state, and you do the same with a different commit, then we have a conflict that we need to solve...
- hackernudes 3y agoThere would have to be a canonical source of truth (with private key). Then one could be reasonably sure an update is blessed by the owner. Makes me think of nostr + git + torrent/ipfs.
- palata 3y agoOh right. Not everyone modifies the torrent, then, just the maintainer. So as a user I get the magnet link, download (clone) the repo over torrent, then I can send a patch to the maintainer over email, discuss it there (maybe on a mailing list), and when the maintainer merges it, they can update the torrent and propagate the new state of the history. Is that about right? It actually sounds cool :-). I guess the next issue I see is that torrents are not mutable (I think there are some specs maybe, but it's not common/implemented? Not sure).
- tpoacher 3y agoThere's been a few of those for sourcehut ... makes you wonder wth is going on ... In one of the previous ones, they said there was high suspicion it related to 'hatred against a transgender developer in the company' or something like that. Like, who the hell targets a "company" because of an employee who works there you don't like ...
- deleted 3y ago[deleted]
- scandox 3y agoI have a paid account on Sourcehut and I like that it is independent. But...yeah there's a kind of "wife’s sister’s puppy fell into the strawberry patch" vibe to a lot of their official communications.
- silisili 3y agoCan you explain what you mean by that?
- tangonov 3y agoI think what they are saying is that they're being too unreliable/unprofessional. Like "whoops, my grandpa spilled is coffee on the server so we're down again." This is not the vibe that I'm getting from their messaging and this is the first time in my 2ish years of paying that I've ever felt impacted.
- lemper 3y agobro, can you speak more clearly? especially this one -> "wife’s sister’s puppy fell into the strawberry patch".
- dijit 3y agoThats the point, the parent is talking about complex and long-winded connections.
- rokkitmensch 3y agoI do wish folks would implement PoW ratelimiting. You can host the req'd JS on a CDN. I implemented this as a .NET lib (https://bvulpes.net/tarpit-a-proof-of-work-http-ratelimiting-scheme/ https://bvulpes.net/tarpit-a-proof-of-work-http-ratelimiting...) for obscure reasons, but an NGINX integration would really be ideal.
- tourmalinetaco 3y agoPOW rate limiting is such a Godsend. I know a few websites that receive regular DDoS attacks, and their uptime increased dramatically as a result. Large-scale DDoS is still unfortunately an issue, but that happens once to twice a year and can only last for so long.
- lyxell 3y agoIsn't it a bit more complicated than that if you, like Sourceforge, also host Git repos over SSH?
- xigoi 3y agoConsidering how much Drew DeVault hates cryptocurrency and sites that require JavaScript, I don’t think he’s going to like this idea.
- Intralexical 3y agoPoW rate limiting has been around for way longer than mainstream cryptocurrencies: https://en.wikipedia.org/wiki/Hashcash https://en.wikipedia.org/wiki/Hashcash Uh. Ignore the "Cash" in the name. That's mostly a coincidence.
- xigoi 3y agoThe problem of energy waste applies to proof-of-work in general. It could be argued that mitigating DDoS attacks might make it a net negative, but someone would have to do the calculations.
- 3y ago
- qxfys 3y agoWait. I thought the problem of being DDoS-ed is widely solved, i.e., just pick someone else (cloudflare, akamai, fastly, etc) to be the "proxy" of your site, and then let them defend the attack for you. No?
- cranberryturkey 3y agokind of goes against the principles for existing.
- ninjin 3y agoSure, but the problem with that solution is that it de facto centralises the Internet as everything then has to pass through a handful of large corporations. I do not claim to have a better solution though, but would be happy to hear other ways forward as DDoS appears to be a threat that is here to stay.
- tourmalinetaco 3y agoAs was mentioned and shown off earlier in the thread, I feel more websites would benefit from proof-of-work rate limiting. It doesn’t solve it entirely, but I’ve heard it can handle around tens-of-thousands of connections.
- koito17 3y ago> just pick someone else ... to be the "proxy" of your site, If you have deep enough pockets, sure, just pay anyone ASAP. But as far as I can tell, Codeberg is a non-profit entirely dependent on donations and, according to Drew DeVault, paying Cloudflare to protect SourceHut is prohibitively expensive even at his scale, so I doubt Codeberg is in any better position to finance this. See https://news.ycombinator.com/item?id=38960189 https://news.ycombinator.com/item?id=38960189
- rapnie 3y agoThey aren't. Even though many people use Codeberg, only few become members. This is a problem. Passing Join + Donate pages from archive.org. According to their November newsletter: > More than 100.000 projects as of late on Codeberg. Codeberg e.V. has 401 members in total, these are 281 members with active voting rights, 113 supporting members and 7 honorary members. [0] Joining: https://web.archive.org/web/20240106140505/https://join.codeberg.org/ https://web.archive.org/web/20240106140505/https://join.code... [1] Donating: https://web.archive.org/web/20240106140512/https://docs.codeberg.org/improving-codeberg/#donate-to-codeberg https://web.archive.org/web/20240106140512/https://docs.code...
- EGreg 3y ago[flagged]
- subtra3t 3y ago[flagged]
- crotchfire 3y agoTo use the Mastodon web application, please enable JavaScript. Alternatively, try one of the native apps for Mastodon for your platform.
- doublerabbit 3y ago[flagged]
- masa331 3y agoOutage statement from Drew: https://outage.sr.ht/ https://outage.sr.ht/
- doublerabbit 3y agoSimple solution, Rent a botnet and DDOS the DDOS. /s
- vfero 3y ago[flagged]
- masa331 3y agosome internet loser probably
- eesmith 3y agoWhen has he cheered the DDoSing of websites he doesn't like? Last year he pointed out how Google was effectively DDoSing Sourcehut[1], so it's not like this is something completely new. [1] https://news.ycombinator.com/item?id=34310674 https://news.ycombinator.com/item?id=34310674 . Also, example of "disconnecting of websites" were you thinking of? I mean, I can think of entirely reasonable situations, like if an employee created a website on a corporate subdomain solely to harass others, then asking the employer to disconnect that site is fine, right?
- tacticalturtle 3y agoIt’s interesting to me that both threads on HN discussing this DDoS incident have new accounts claiming that Drew supports DDoS, without sources: https://news.ycombinator.com/item?id=38966629 https://news.ycombinator.com/item?id=38966629
- nsagent 3y agoAnd they are both new accounts.
- ksjskskskkk 3y agotinfoil hats on. mystery solved: in the coming days github will announce obligatory 2fa linked to a phone number. some Microsoft exec is betting his job that people will not just abandon github if they turn the heat on too hard on the slow boiled frog that is open source still hosted there. to offset that theoretical exec fears that open source projects will jump ship, they spent the equivalent of one expensive dinner on ddos for hire to take the top competitors offline. this is not some coordinate evil plan at Microsoft, just something that someone with even as little as M3@microsoft money and very little cryptocoins can easily do in under an hour.