Microsoft's GitHub under fire for DDoSing crucial open source project website | Hacker News Reader

Microsoft's GitHub under fire for DDoSing crucial open source project website

theregister.com

25 pointsjjgreen24 comments

Discussed a couple of weeks ago, there seems to be basically no information here.

https://news.ycombinator.com/item?id=36380325

Why does HN keep upvoting low quality clickbait garbage from The Register?

It was relevant but maybe not super-interesting. I thought The Register did a fair job of quoting people involved in the incident and explaining what happened, with less snark than usual.

Maybe a better title is "GMP software library admin accuses GitHub of DDoSing their site".

Why is GitHub the one under fire here? Users on GitHub are using GitHub Actions to build CI pipelines that build stuff, and happen to be pulling from GMP. That's not GitHub's problem that users are using their product in a legitimate manner, it seems to me it is GMP's problem that they can't handle traffic for artifacts from CI systems? It is noted the requests are identical, so would a modicum of caching in front of their origin not make this problem go away completely?

CI systems shouldn't have the ability to make network requests at all, honestly.

If all CI systems of the world went down, it would have cooled Earth by 0.001°C.

How would you suggest they install dependencies then?

At the very least, that's an issue that GMP or other projects shouldn't have to worry about. There are many options - you could manually cache things somewhere or pack in the dependencies in the repo. Or, maybe, in a world that wasn't completely set on wasting all resources possible, there just wouldn't be pointless automatic builds on forks, and those builds wouldn't need to re-download the world and could instead just incrementally update. (yes, there are nice consequences of doing fresh builds always, but there are also bad ones as can be seen, and unfortunately the downsides aren't seen by the initiator)

Why should this host (and presumably every similar host) take on the burden of this extra complexity?

Would a modicum of caching in GitHub Actions libraries not make this problem go away for all hosts in this category?

That's fair, I would agree that caching at either end would fix this. It just strikes me as odd that GitHub, the middle-man that's just providing CI runners, is the one under fire.

What GitHub is effectively doing is providing free DDoS hardware and lots of it, as far as the receiving end is concerned. I don't think GitHub should particularly be "under fire" for this, but it's still very not nice to provide a service that, under legitimate use (never mind illegitimate use!), can make unreasonable amounts of traffic to arbitrary sites.

I think a quite reasonable expectation from GitHub would be to have an all-of-GitHub-wide rate limit that CI can use for requests to any given site, and have jobs fail/delay if GitHub has exceeded that, and expect sites to explicitly opt in if they're fine with more than that rate. Would of course very much suck for GitHub CI users that want to pull from sites not opted in, but at least GitHub would stop offering free DDoS services.

For the same reason that ISPs tend to come under fire when their customers are using MTAs to deliver large volumes of e-mails to non-consenting recipients.

Are you saying it's not an ISP's problem that spammers are using their product in a legitimate manner, but instead it's up to the recipients to build their own spam fighting resources? Yes, that turned out wonderfully.

Is it the phone companies' fault that people make death threats over the phone? Do we say 'Phone company makes death threats' when that happens like the title is saying about GitHub?

Death threats? WTF? What metaphor are you using that git clone requests are now suddenly death threats?

Anyway, I don't think your example aligns with the argument you think you're making: https://www.fcc.gov/enforcement/areas/unwanted-communication...

Yes, phone companies definitely can be liable for bulk targeting by their users.

> What metaphor are you using that git clone requests are now suddenly death threats?

The headline and title are saying GitHub DDoSed a crucial open source site, so the metaphor is definitely valid. I did not compare DDoS to death threats, I compared the fact that it is being said that GitHub DDoSed the open source site and did a thought experiment to see what happens if something similar was said about the phone companies.

If it must go to internet, a MITM SSL proxy cache out of GH would help.

The problem is within GH's network, a 90s ISP would have blocked spammy users, GH should at least operate like an ISP if random stuff can execute and reach the 'net.

Curious that its MS who is drawing ire despite them being just basically service provider and middle-man here; its arguably the ffmpeg-builds project who are more responsible party.

I disagree. Microsoft has a duty to keep their systems from accessing others at unreasonable rates when requested, even if it's being done at a user's request. Microsoft may not be perpetuating the DoS, but they seem to be complicit.

This could easily be used by a truly nefarious party to do similar damage or worse to others.

I also disagree, and they were DDOS, so technically Microsoft broke a law.

>Granlund was not entirely satisfied with Blacker's explanation, nor the implied feebleness of the project's server(s)

So, every project needs to have a multi-million USD server Farm ? GMP is probably pulled by various Linux distros and the BSDs, along with other Misc projects. So no need for a huge server farm.

For people who do not know what it is:

https://gmplib.org/

> and they were DDOS, so technically Microsoft broke a law

And what law is that?

>In the US, denial-of-service attacks may be considered a federal crime under the Computer Fraud and Abuse Act with penalties that include years of imprisonment.[121] The Computer Crime and Intellectual Property Section of the US Department of Justice handles cases of DoS and DDoS. In one example, in July 2019, Austin Thompson, aka DerpTrolling, was sentenced to 27 months in prison and $95,000 restitution by a federal court for conducting multiple DDoS attacks on major video gaming companies, disrupting their systems from hours to days

You can do a google search to get more info

Are you sure? Comments usually have no "reply" button for a minute or two after posting (for everyone)

Clickbait

Reply on news.ycombinator.com