4 ms·
Crazy. Who would have an incentive to spend resources on DDoS'ing Codeberg? The only party I can think of would be Github. I know that the normalization of ruth
by exceptione 10mo ago
Crazy. Who would have an incentive to spend resources on DDoS'ing Codeberg? The only party I can think of would be Github. I know that the normalization of ruthlessness and winner-takes-all mentality made crime mandatory for large parts of the economy, but still cannot wrap my mind around it.
- Kelteseth 10mo agoNot just them. For example, Qt self hosted cgit got ddos just two weeks ago. No idea why random open source projects getting attacked. > in the past 48 hours, code.qt.io has been under a persistent DDoS attack. The attackers utilize a highly distributed network of IP addresses, attempting to obstruct services and network bandwidth. https://lists.qt-project.org/pipermail/development/2025-November/046747.html https://lists.qt-project.org/pipermail/development/2025-Nove...
- delfinom 10mo agoProbably some little script kiddie fucks who think they are elite mega haxors and use their mommie's credit card to pay one of the ddos services readily accessible.
- immibis 10mo agoSounds like the good old AI scraper DDoS - which, by the way, has no evidence of actually being AI related
- Ygg2 10mo ago> Who would have an incentive to spend resources That's not how threat analysis works. That's a conspiracy theory. You need to consider the difficulty of achieving it. Otherwise I could start speculating which large NAS provider is trying to DDoS me, when in fact it's a script kiddie. As for who would have the most incentives? Unscrupulous AI scrapers. Every unprotected site experiences a flood of AI scrapers/bots.
- theteapot 10mo agoActually I think that's roughly how threat analysis works though.
- Ygg2 10mo agoFor threat analysis, you need to know how hard you are to break in, what the incentives are, and who your potential adversaries are. For each potential adversary, you list the risk strategy; that's threat analysis 101. E.g. you have a locked door, some valuables, and your opponent is the state-level. Risk strategy: ignore, no door you can afford will be able to stop a state-level actor.
- theteapot 10mo agoI concur the question, "Who would have an incentive to spend resources on DDoS'ing Codeberg?" is a bit convoluted in mixing incentive and resources. But it's still, exactly, threat analysis, just not very useful threat analysis.
- Ygg2 10mo agoWouldn't an AI scraper working for a huge firm have more incentive to scrape your code, than a competitor?
- exceptione 10mo agoI think the goal is unclear, but the effect will be that Codeberg will be perceived as less of a real, stable alternative. Breaking in was not in my mind, but that will have the same effect, maybe even more damaging. Now, if that has been the intended effect, I hope I won't have to believe that. Story time: I remember that back in the day I had a domain name for a pretty hot keyword with a great, organic position in Google rankings. Then someday it got all of a sudden serious boost from black-SEO, with a bazillion links from all kinds of unrelated websites. My domain got penalized and dropped of from the front page.
- tonyhart7 10mo agoits easier for MS to buy codeberg and close it than to spent time and money to DDOS things
- matrss 10mo agoHow do you buy an e.V.?
- tonyhart7 10mo agoYou goes to BYD dealership???
- matrss 10mo agoI said e.V., not EV. Codeberg is an e.V., i.e. a "registered association" in Germany. I am not actually sure if you could technically buy an e.V., but I am 100% certain that all of the Codeberg e.V. members would not take kindly to an attempt at a hostile takeover from Microsoft. So no, buying Codeberg is not easier than DDoSing them.
- tonyhart7 10mo agothey can't buy the orgs but they can buy the codeberg or its member which is basically the same thing
- matrss 10mo agoWhat do you mean by "orgs", and what do you mean by "the codeberg"? Sure, they could try to bribe the Codeberg e.V. active members into changing its mission or disbanding the association entirely, but they would need to get a 2/3 majority at a general assembly while only the people actively involved in the e.V. and/or one of its projects can get voting rights. I find that highly unlikely to succeed.
- notpushkin 10mo agohttps://en.wikipedia.org/wiki/OpenAI#Transition_from_non-profit https://en.wikipedia.org/wiki/OpenAI#Transition_from_non-pro...
- sznio 10mo ago>The only party I can think of would be Github. I think it's not malice, but stupidity. IoT made even a script kiddie capable of running a huge botnet capable of DDoSing anything but CloudFlare.
- rcxdude 10mo agoDDoS are crazy cheap now, it could be a random person for the lulz, or just as a test or demo (though I suspect Codeberg aren't a bit enough target to be impressive there).
- Sammi 10mo agoIs it because the s in iot stands for security? I'm asking genuinely. Where are these requests coming from?
- gilrain 10mo agoSearch for “residential proxy”.
- rcxdude 10mo agoI would put it down to 4 things: - the internet's a lot bigger nowadays - there are a lot of crappily secured iot devices - the average household internet connection has gotten a lot faster, especially on upload bandwidth. - there's a pile of amplification techniques which can multiply the bandwidth of an attack by using poorly-configured services.
- exceptione 10mo agoWhat is cheap and what are the risks of getting caught? I can understand that for a 15 yo it might be for the lulz, but I am having a hard time to imagine that this would give street creds, and why be persistent about it. AI-bots would make more sense, but these can be dealt with.
- ncruces 10mo agoBig tech would be far more interested in slurping data than DDoS'ing them. An issue with comments, linked to a PR with review comments, the commit stack implementing the feature, and further commits addressing comments is probably valuable data to train a coding agent. Serving all that data is not just a matter of cloning the repo. It means hitting their (public, documented) API end points, that are likely more costly to run. And if they rate limit the scrappers, the unscrupulous bunch will start spreading requests across the whole internet.