6 ms·
I have sympathy for some of the GitHub complaints. otoh just went to try to signup for Codeberg and it's down ... 95% uptime over the last 2 weeks? https://sta
by themgt 11mo ago
I have sympathy for some of the GitHub complaints. otoh just went to try to signup for Codeberg and it's down ... 95% uptime over the last 2 weeks?
https://status.codeberg.org/status/codeberg https://status.codeberg.org/status/codeberg
- worldsavior 11mo agoWhat? It says it's up for 98.56% for the last 2 weeks.
- qwertox 11mo agoThat's probably the average. But if Codeberg Translate shines with 99.58%, it is an unnecessary entry which harms the "92.42% Codeberg.org" reality.
- bayindirh 11mo agoI mean, they're battling with DDoS all the time. I follow their account on Mastodon, and they're pretty open about it. I believe the correct question is "Why they are getting DDoSed this much if they are not something important?" For anyone who wants to follow: https://social.anoxinon.de/@Codeberg https://social.anoxinon.de/@Codeberg Even their status page is under attack. Sorry for my French, but WTF?
- letmetweakit 11mo agoThat's rough ... it is a bad, bad world out there.
- bayindirh 11mo agoTry exposing a paswordless SSH server to outside to see what happens. It'll be tried immediately, non-stop. Now, all the servers I run has no public SSH ports, anymore. This is also why I don't expose home-servers to internet. I don't want that chaos at my doorstep.
- gear54rus 11mo agothis can be fixed by just using random ssh port all my services are always exposed for convenience but never on a standard port (except http)
- bayindirh 11mo agoIt reduces the noise, yes, but doesn't stop a determined attacker. After managing a fleet for a long time, I'd never do that. Tailscale or any other VPN is mandatory for me to be able to access "login" ports.
- letmetweakit 11mo agoYeah, I have been thinking about hosting a small internet facing service on my home server, but I’m just not willing to take the risk. I’d do it on a separate internet connection, but not on my main one.
- bayindirh 11mo agoYou can always use a small Hetzner server (or a free Oracle Cloud one if you are in a pinch) and install tailscale to all of your servers to create a P2P yet invisible network between your hosts. You need to protect the internet facing one properly, and set ACLs at tailscale level if you're storing anything personal on that network, though.
- letmetweakit 11mo agoI would probably just ssh into the Hetzner box and not connect it to my tailnet.
- nrhrjrjrjtntbt 11mo agoWould tailscale or cloudflare do the trick. Let them connect to the server.
- nrhrjrjrjtntbt 11mo agoYeah no need for public ssh. Or if you do pick a random port and fail2ban or better just whitelist the one IP you are using for the duration of that session. To avoid needing SSH just send your logs and metrics out and do something to autodeploy securely then you rarely need to be in. Or use k8s :)
- exceptione 11mo agoCrazy. Who would have an incentive to spend resources on DDoS'ing Codeberg? The only party I can think of would be Github. I know that the normalization of ruthlessness and winner-takes-all mentality made crime mandatory for large parts of the economy, but still cannot wrap my mind around it.
- Kelteseth 11mo agoNot just them. For example, Qt self hosted cgit got ddos just two weeks ago. No idea why random open source projects getting attacked. > in the past 48 hours, code.qt.io has been under a persistent DDoS attack. The attackers utilize a highly distributed network of IP addresses, attempting to obstruct services and network bandwidth. https://lists.qt-project.org/pipermail/development/2025-November/046747.html https://lists.qt-project.org/pipermail/development/2025-Nove...
- delfinom 11mo agoProbably some little script kiddie fucks who think they are elite mega haxors and use their mommie's credit card to pay one of the ddos services readily accessible.
- immibis 11mo agoSounds like the good old AI scraper DDoS - which, by the way, has no evidence of actually being AI related
- Ygg2 11mo ago> Who would have an incentive to spend resources That's not how threat analysis works. That's a conspiracy theory. You need to consider the difficulty of achieving it. Otherwise I could start speculating which large NAS provider is trying to DDoS me, when in fact it's a script kiddie. As for who would have the most incentives? Unscrupulous AI scrapers. Every unprotected site experiences a flood of AI scrapers/bots.
- theteapot 11mo ago
- bit1993 11mo agoPart of the problem is that Codeberg/Gitea's API endpoints are well documented and there are bots that scrape for gitea instances. Its similar to running SSH on port 22 or hosting popular PHP forums software, there are always automated attacks by different entities simply because they recognize the API.
- SideburnsOfDoom 11mo agoGitHub uptime isn't perfect either. You will notice these outages from time to time if your employer is using it for more than just "store some git repos", e.g. using GHA for builds and deploys, packages etc.
- p2detar 11mo agoThere have been complaints about it on Reddit as well. I registered an account recently and to me the annoying thing is the constant "making sure you are not a bot" check. For now I see no reason to migrate, but I do admit Forgejo looks very interesting to self-host.
- verdverm 11mo agohttps://tangled.org/ https://tangled.org/ is building on ATProto 1. use git or jj 2. pull-request like data lives on the network 3. They have a UI, but anyone can also build one and the ecosystem is shared I've been considering Gerrit for git-codereview, and tangled will be interesting when private data / repos are a thing. Not trying to have multiple git hosts while I wait
- bpavuk 11mo agoI, too, am extremely interested in development on Tangled, but I miss two features from GitHub - universal search and Releases. the web frontend of Tangled is so fast that I am still getting used to the speed, and jj-first features like stacked PRs are just awesome. kinda reminds me of how Linux patch submitting works.
- verdverm 11mo agoIt's fast because it lacks features I'm more interested in gerrit/git-codereview for stacked commits than jj. A couple extra commands for new folks, not a completely new tool and lexicon
- culi 11mo ago3 of the most exciting decentralized GitHub alternatives being developed today: Tangled (2024, ATP) Radicle (2019, IPFS) Codeberg (2018, Gitea fork which supports decentralized protocols)
- pabs3 11mo agoWhich decentralized protocols does Codeberg support?
- Daegalus 11mo agoJust a reminder, Codeberg is for open source projects only, and maybe some dotfiles and such. Its on their frontpage and in their TOS.
- Sammi 11mo agoBecause they are Codeberg I'm betting they have a philosophical aversion to using a cloud based ddos protection service like Cloudflare. Sadly the problem is that noone has come up with any other type of solution that actually works.
- everybodyknows 11mo agoHow well can Cloudflare protect against malicious account creation, where the attackers are set up to supply a response to email?
- psychoslave 11mo agoOne can always host Forgejo themselves if a service level has to be kept under control. With Github that’s not even an option. I would even consider that moving everything from one single point of failure to an other is not the brightest move.
- NoahZuniga 11mo ago> With Github that’s not even an option. Github does offer a self hosted product: GitHub Enterprise Server
- psychoslave 11mo agoForgejo is GPL 3, with the Github stuff apparently even running it on owned device is tied to a per user per month bill, and I have no idea if code is available and editable just having a look at https://azure.microsoft.com/en-us/pricing/details/githubenterprise/ https://azure.microsoft.com/en-us/pricing/details/githubente...
- naikrovek 11mo agoyes, GitHub Enterprise Server is not free. And yes you pay a license fee per user per month, billed annually, and the minimum license purchase is 10 users at something like $21/user/month. Microsoft discounts you qualify for will bring that down. You pay because you get support. You won't need it often, but when you do, you really need it. It is easy to administer even for 15k users, and mostly it takes care of itself if you give it enough RAM and CPU for all the activity. Downloading the virtual hard drive image from GitHub is easy and decrypting the code inside is borderline trivial, but I'm not going to help anyone do that. I've never had a need to do it. As a server product it is good. I recommend it if you can afford it. It is not intended for private individuals or non-profits, though. It's for corporations who want their code on-premise, and for that it is quite good.
- dwaite 11mo agoCommercial software support is not free. Contracting out for professional services or diverting internal developers to fix issues with open source software are also not free.
- nrhrjrjrjtntbt 11mo ago99.95 from something I use to do work is non negotiable.
- arccy 11mo agoyou probably wouldn't use it for work anyway, codeberg is for OSS only
- rprend 11mo agoAverage big tech alternative. Doesn’t solve your problems, doesn’t scale, terrible UX, but at least it’s run by fanatics.
- WolfeReader 11mo agoForgejo does solve my problems, doesn't scale yet (I am really looking forward to ForgeFed), has fine UX, and at least it's run by people who care.
- captainkrtek 11mo agoAs a customer of GitHub actions, anecdotally feels like Github experiences issues frequently enough to make this not a problem.