4 ms·

I mean, they're battling with DDoS all the time. I follow their account on Mastodon, and they're pretty open about it. I believe the correct question is "Why t

I mean, they're battling with DDoS all the time. I follow their account on Mastodon, and they're pretty open about it. I believe the correct question is "Why they are getting DDoSed this much if they are not something important?" For anyone who wants to follow: https://social.anoxinon.de/@Codeberg https://social.anoxinon.de/@Codeberg Even their status page is under attack. Sorry for my French, but WTF?

letmetweakit 11mo ago
That's rough ... it is a bad, bad world out there.
- bayindirh 11mo ago
  Try exposing a paswordless SSH server to outside to see what happens. It'll be tried immediately, non-stop. Now, all the servers I run has no public SSH ports, anymore. This is also why I don't expose home-servers to internet. I don't want that chaos at my doorstep.
  - gear54rus 11mo ago
    this can be fixed by just using random ssh port all my services are always exposed for convenience but never on a standard port (except http)
    - bayindirh 11mo ago
      It reduces the noise, yes, but doesn't stop a determined attacker. After managing a fleet for a long time, I'd never do that. Tailscale or any other VPN is mandatory for me to be able to access "login" ports.
  - letmetweakit 11mo ago
    Yeah, I have been thinking about hosting a small internet facing service on my home server, but I’m just not willing to take the risk. I’d do it on a separate internet connection, but not on my main one.
    - bayindirh 11mo ago
      You can always use a small Hetzner server (or a free Oracle Cloud one if you are in a pinch) and install tailscale to all of your servers to create a P2P yet invisible network between your hosts. You need to protect the internet facing one properly, and set ACLs at tailscale level if you're storing anything personal on that network, though.
      - letmetweakit 11mo ago
        I would probably just ssh into the Hetzner box and not connect it to my tailnet.
    - nrhrjrjrjtntbt 11mo ago
      Would tailscale or cloudflare do the trick. Let them connect to the server.
  - nrhrjrjrjtntbt 11mo ago
    Yeah no need for public ssh. Or if you do pick a random port and fail2ban or better just whitelist the one IP you are using for the duration of that session. To avoid needing SSH just send your logs and metrics out and do something to autodeploy securely then you rarely need to be in. Or use k8s :)
    - bayindirh 11mo ago
      Whitelisting single IP (preferably a static one) sounds plausible. Kubernetes for personal infrastructure is akin to getting an aircraft carrier for fishing trips. For simple systems snapshots and backups are good enough. If you're managing a thousand machine fleet, then things are of course different. I manage both so, I don't yearn to use big-stack-software on my small hosts. :D
  - 63stack 11mo ago
    This is just FUD, there is nothing dangerous in having an SSH server open to the internet that only allows key authentication. Sure, scanners will keep pinging it, but nobody is ever going to burn an ssh 0day on your home server.
    - bayindirh 11mo ago
      > This is just FUD. No, it's just opsec. > Sure, scanners will keep pinging it, but nobody is ever going to burn an ssh 0day on your home server. I wouldn't be so sure about it, considering the things I have seen. I'd better be safe than sorry. You can expose your SSH if you prefer to do so. Just don't connect your server to my network.
      - 63stack 11mo ago
        "opsec" includes well defined things like threat modeling, risk factors, and such. "Things I have seen" and vague "better safe than sorry" is not part of that.
        bayindirh 11mo ago
        There are two golden rules of opsec: 1. Never tell everything you know and seen. 2. For what I do, you can refer to my profile.
    - hylaride 11mo ago
      A few years ago a vulnerable compression library almost got pushed out that major Linux distros linked their OpenSSH implementations to. That was caught by blind luck. I'm confident there's a lot more shit out there that we don't know about.
  - ectospheno 11mo ago
    Expose it on port 22 on ipv6 and it might as well be invisible. Cleanest logs ever.
exceptione 11mo ago
Crazy. Who would have an incentive to spend resources on DDoS'ing Codeberg? The only party I can think of would be Github. I know that the normalization of ruthlessness and winner-takes-all mentality made crime mandatory for large parts of the economy, but still cannot wrap my mind around it.
- Kelteseth 11mo ago
  Not just them. For example, Qt self hosted cgit got ddos just two weeks ago. No idea why random open source projects getting attacked. > in the past 48 hours, code.qt.io has been under a persistent DDoS attack. The attackers utilize a highly distributed network of IP addresses, attempting to obstruct services and network bandwidth. https://lists.qt-project.org/pipermail/development/2025-November/046747.html https://lists.qt-project.org/pipermail/development/2025-Nove...
  - delfinom 11mo ago
    Probably some little script kiddie fucks who think they are elite mega haxors and use their mommie's credit card to pay one of the ddos services readily accessible.
  - immibis 11mo ago
    Sounds like the good old AI scraper DDoS - which, by the way, has no evidence of actually being AI related
- Ygg2 11mo ago
  > Who would have an incentive to spend resources That's not how threat analysis works. That's a conspiracy theory. You need to consider the difficulty of achieving it. Otherwise I could start speculating which large NAS provider is trying to DDoS me, when in fact it's a script kiddie. As for who would have the most incentives? Unscrupulous AI scrapers. Every unprotected site experiences a flood of AI scrapers/bots.
  - theteapot 11mo ago
bit1993 11mo ago
Part of the problem is that Codeberg/Gitea's API endpoints are well documented and there are bots that scrape for gitea instances. Its similar to running SSH on port 22 or hosting popular PHP forums software, there are always automated attacks by different entities simply because they recognize the API.

letmetweakit 11mo ago

That's rough ... it is a bad, bad world out there.

bayindirh 11mo ago
Try exposing a paswordless SSH server to outside to see what happens. It'll be tried immediately, non-stop. Now, all the servers I run has no public SSH ports, anymore. This is also why I don't expose home-servers to internet. I don't want that chaos at my doorstep.
- gear54rus 11mo ago
  this can be fixed by just using random ssh port all my services are always exposed for convenience but never on a standard port (except http)
  - bayindirh 11mo ago
    It reduces the noise, yes, but doesn't stop a determined attacker. After managing a fleet for a long time, I'd never do that. Tailscale or any other VPN is mandatory for me to be able to access "login" ports.
- letmetweakit 11mo ago
  Yeah, I have been thinking about hosting a small internet facing service on my home server, but I’m just not willing to take the risk. I’d do it on a separate internet connection, but not on my main one.
  - bayindirh 11mo ago
    You can always use a small Hetzner server (or a free Oracle Cloud one if you are in a pinch) and install tailscale to all of your servers to create a P2P yet invisible network between your hosts. You need to protect the internet facing one properly, and set ACLs at tailscale level if you're storing anything personal on that network, though.
    - letmetweakit 11mo ago
      I would probably just ssh into the Hetzner box and not connect it to my tailnet.
  - nrhrjrjrjtntbt 11mo ago
    Would tailscale or cloudflare do the trick. Let them connect to the server.
- nrhrjrjrjtntbt 11mo ago
  Yeah no need for public ssh. Or if you do pick a random port and fail2ban or better just whitelist the one IP you are using for the duration of that session. To avoid needing SSH just send your logs and metrics out and do something to autodeploy securely then you rarely need to be in. Or use k8s :)
  - bayindirh 11mo ago
    Whitelisting single IP (preferably a static one) sounds plausible. Kubernetes for personal infrastructure is akin to getting an aircraft carrier for fishing trips. For simple systems snapshots and backups are good enough. If you're managing a thousand machine fleet, then things are of course different. I manage both so, I don't yearn to use big-stack-software on my small hosts. :D
- 63stack 11mo ago
  This is just FUD, there is nothing dangerous in having an SSH server open to the internet that only allows key authentication. Sure, scanners will keep pinging it, but nobody is ever going to burn an ssh 0day on your home server.
  - bayindirh 11mo ago
    > This is just FUD. No, it's just opsec. > Sure, scanners will keep pinging it, but nobody is ever going to burn an ssh 0day on your home server. I wouldn't be so sure about it, considering the things I have seen. I'd better be safe than sorry. You can expose your SSH if you prefer to do so. Just don't connect your server to my network.
    - 63stack 11mo ago
      "opsec" includes well defined things like threat modeling, risk factors, and such. "Things I have seen" and vague "better safe than sorry" is not part of that.
      - bayindirh 11mo ago
        There are two golden rules of opsec: 1. Never tell everything you know and seen. 2. For what I do, you can refer to my profile.
  - hylaride 11mo ago
    A few years ago a vulnerable compression library almost got pushed out that major Linux distros linked their OpenSSH implementations to. That was caught by blind luck. I'm confident there's a lot more shit out there that we don't know about.
- ectospheno 11mo ago
  Expose it on port 22 on ipv6 and it might as well be invisible. Cleanest logs ever.

exceptione 11mo ago

Crazy. Who would have an incentive to spend resources on DDoS'ing Codeberg? The only party I can think of would be Github. I know that the normalization of ruthlessness and winner-takes-all mentality made crime mandatory for large parts of the economy, but still cannot wrap my mind around it.

Kelteseth 11mo ago
Not just them. For example, Qt self hosted cgit got ddos just two weeks ago. No idea why random open source projects getting attacked. > in the past 48 hours, code.qt.io has been under a persistent DDoS attack. The attackers utilize a highly distributed network of IP addresses, attempting to obstruct services and network bandwidth. https://lists.qt-project.org/pipermail/development/2025-November/046747.html https://lists.qt-project.org/pipermail/development/2025-Nove...
- delfinom 11mo ago
  Probably some little script kiddie fucks who think they are elite mega haxors and use their mommie's credit card to pay one of the ddos services readily accessible.
- immibis 11mo ago
  Sounds like the good old AI scraper DDoS - which, by the way, has no evidence of actually being AI related
Ygg2 11mo ago
> Who would have an incentive to spend resources That's not how threat analysis works. That's a conspiracy theory. You need to consider the difficulty of achieving it. Otherwise I could start speculating which large NAS provider is trying to DDoS me, when in fact it's a script kiddie. As for who would have the most incentives? Unscrupulous AI scrapers. Every unprotected site experiences a flood of AI scrapers/bots.
- theteapot 11mo ago

bit1993 11mo ago

Part of the problem is that Codeberg/Gitea's API endpoints are well documented and there are bots that scrape for gitea instances. Its similar to running SSH on port 22 or hosting popular PHP forums software, there are always automated attacks by different entities simply because they recognize the API.