Sourcehut will not blacklist the Go module mirror

https://sourcehut.org/blog/2023-01-09-gomodulemirror/

213 42 3 years ago

dang• 3 years ago

Recent and related:

Sourcehut will blacklist the Go module mirror - https://news.ycombinator.com/item?id=34310674 - Jan 2023 (337 comments)

frankjr• 3 years ago

See, it is possible to make Google do some changes. You just have report the issue, wait a year, get banned, write a blog post, wait another year, and announce a block of their service. Easy.

ocdtrekkie• 3 years ago

And you have to be large enough or known enough in the first place that Google cares whether or not you block their service. ;)

tptacek7• 3 years ago

It does not appear to be the case that he was banned for anything about this issue.

cycomanic• 3 years ago

Nobody knows exactly why he was banned (except for the people banning him), because the ban was not communicated to him or anyone else (at least according to his words). However, he did get banned after putting the issue into the golang issue tracker, so there is at least a temporal correlation.

Gigachad• 3 years ago

Didn't google offer to immediately fix the issue for Sourcehut as a quick fix until they got the full fix out, and Drew declined stating Google needs to either fix the problem entirely or be blocked?

2h2• 3 years ago

thats a cop out. If he accepted the quick fix, then Go team could just say "well it works for him, so now we dont need to do the full fix", or maybe they decide to slow play it. It was nearly two years, enough is enough.

rakoo2• 3 years ago

There's a clear lack of communication. The engineering process is (was?) opaque. It's not clear the Go team acknowledged there was a problem with the proxy itself and not just upstream sources, it wasn't communicated that a fix was being worked on, it wasn't clear when it was due to get out. From the outside you can just wait and hope. But that's not OK when your server is getting hammered 24/7 and you have to pay the bills.

Only because DeVault complained do we see that things were happening. Information, but still no control.

It's only when DeVault started to actually annoy Google with real visibility that they decided to take responsibility for what they were doing.

There's an interesting analogy to class struggle, where DeVault uses his leveraging power of striking to make the big Kapitalist change their ways and assume responsibility of asking too much to the little hands doing the actual work of hosting.

MaxBarraclough• 3 years ago

Don't forget the all important Hacker News front page step.

8organicbits• 3 years ago

I'd be super curious to see what load GitHub was seeing from this. There's a lot of focus on protecting smaller sites (who presumably have less funding) but the amount of redundant network traffic this generates must be quite large for other sites as well.

I'm also still questioning the need for the proxy in the first place.

notpushkin• 3 years ago

I think GitHub is special-cased somehow.

arp2423• 3 years ago

The source for the proxy isn't available, but I'd be surprised if this was the case, based on what the Go team has written about this issue. They made some changes to allow excluding sites from refresh traffic in 2021 in response to this issue, but no mention of throttling or anything else. And if GitHub is special-cased, I don't see why any other site can't be special-cased either.

rakoo2• 3 years ago

The Go team has decided that the automatic refresh behavior is their responsibility, not the responsibility of other operators

I am stunned it took so much kerfuffle to get there. Why is it not the default behavior ?

Sourcehut will not blacklist the Go module mirror

Related Stories