|
|
Log in / Subscribe / Register

Information on the SourceHut outage

Users of SourceHut will have noticed that the site has been unreachable; Drew DeVault has now posted a report on what is happening (it's a distributed denial-of-service attack) and what is being done to recover.

We deal with ordinary DDoS attacks in the normal course of operations, and we are generally able to mitigate them on our end. However, this is not an ordinary DDoS attack; the attacker posesses considerable resources and is operating at a scale beyond that which we have the means to mitigate ourselves. In response, before we could do much ourselves to understand or mitigate the problem, our upstream network provider null routed SourceHut entirely, rendering both the internet at large, and SourceHut staff, unable to reach our servers.


to post comments

Information on the SourceHut outage

Posted Jan 12, 2024 16:21 UTC (Fri) by IanKelling (subscriber, #89418) [Link] (4 responses)

Some ISP or company that mitigates DDOS should do a good deed and donate service to help them out. Unfortunately, DDOS mitigation companies usually have a 2-tier price system, the regular tier, and then then 10x higher price if you are actively being DDOSed.

They are working on continuing to run the software on their own computers, not jumping AWS or something, and that is commendable and people should be patient with them. Seems like part of their difficulty is they can't switch to a better ISP without moving data centers, likely because they have a small data center presence, a resold 1/2 or 1/4 rack that bundles the ISP service.

I've gotten a few sales calls from Cogent wanting to be our data center ISP, and I tell them: your computers rely on the GNU software we host, so how about you donate us some bandwidth? It hasn't worked yet.

Information on the SourceHut outage

Posted Jan 12, 2024 16:24 UTC (Fri) by IanKelling (subscriber, #89418) [Link]

> their own computers

I should have said: their own physical computers. A virtual machine is still your computer in most ways, but the VM provider has access to it if they want.

Information on the SourceHut outage

Posted Jan 14, 2024 2:53 UTC (Sun) by patrakov (subscriber, #97174) [Link] (1 responses)

In a layer-3 DDOS situation, AWS would be a huge mistake due to traffic costs.

Information on the SourceHut outage

Posted Jan 14, 2024 17:59 UTC (Sun) by Cyberax (✭ supporter ✭, #52523) [Link]

AWS will refund costs incurred due to DDoS, they also can provide engineering support to help with mitigations.

Information on the SourceHut outage

Posted Jan 18, 2024 11:15 UTC (Thu) by maniax (subscriber, #4509) [Link]

Might be a bit off-topic, but when I saw Cogent, got some really bad flashbacks...

Nobody should use Cogent as their only provider, or at all. The only way those should be used is if they PAY YOU to use them, there's no global-scale ISP this bad. If I had to use a DC's internet, and their only provider was Cogent, I'd run away.

(I'd also run away if they had a single ISP, that makes no sense for even a relatively small DC)

Information on the SourceHut outage

Posted Jan 12, 2024 19:05 UTC (Fri) by Vorpal (guest, #136011) [Link] (22 responses)

Git itself is distributed, but all the services around it (url for getting discovery and getting access as a new user, bug reports, PRs, releases, etc) are not.

It would be interesting if a truly fully distributed system was possible, or at least one with minimal centralisation (unless you want people to find your project via some sort of content hash you need *something* for looking up human readable names).

That should be more resilient, at least in theory, while avoiding having to depend on Microsoft for github or similar.

Seems like a massive undertaking, and might not be as user friendly of course. But to me it sounds like a worthy endeavour, though way outside my expertise.

Information on the SourceHut outage

Posted Jan 12, 2024 21:10 UTC (Fri) by ceplm (subscriber, #41334) [Link] (17 responses)

> Git itself is distributed, but all the services around it (url for getting discovery and getting access as a new user, bug reports, PRs, releases, etc) are not.

Let’s break it down:

* “URL for getting discovery” … I am not sure if I understand what you mean. Does anybody search for a project by going to GitHub.com and search in that search box? I always come from somewhere else (PyPI, package in my distribution, somebody mentioning a project somewhere). For read-only browsing repo, one could use GitWeb/cgit or something of that kind.

* bug reports … this is a real problem. I was playing with hosting my own bugzilla, but it doesn’t work, because nobody in their sane mind creates a new account on yet another tiny website they don’t care about. I guess, filing reports to email list is the only available option, because it gets sufficiently low threshold for access. The ticketing system probably would be just a read-only website (with bugzilla or anything else, see https://todo.sr.ht), or perhaps the future lies in git-bug and its web interface to display bugs.

* getting access as a new user … if the preferred communication channel is email, then this whole question goes away.

* PRs … git send-email(1) and an email list?

* releases … some static website?

Information on the SourceHut outage

Posted Jan 12, 2024 21:55 UTC (Fri) by NYKevin (subscriber, #129325) [Link] (16 responses)

Objection! An email list is still a centralized solution in practice.

A truly decentralized solution, IMHO, must (at least) not be possible for a single person (or entity) to unilaterally turn off. A mailing list fails that test, unless it is designed in a highly atypical manner (involving something like onion routing, blockchains, etc., instead of typical SMTP and DNS MX records). You could have something like IRC or Matrix, which are at least more plausibly decentralized if deployed correctly, but then you're going to have a really hard time figuring out a robust way of tracking bugs.

Information on the SourceHut outage

Posted Jan 12, 2024 22:11 UTC (Fri) by Wol (subscriber, #4433) [Link] (13 responses)

You've just described Usenet?

Cheers,
Wol

Information on the SourceHut outage

Posted Jan 12, 2024 22:54 UTC (Fri) by NYKevin (subscriber, #129325) [Link] (12 responses)

If you think convincing new developers to install MUAs and interact with "regular" mailing lists is hard, just imagine trying to get them to install newsreaders.

Information on the SourceHut outage

Posted Jan 13, 2024 1:28 UTC (Sat) by dsommers (subscriber, #55274) [Link] (11 responses)

Information on the SourceHut outage

Posted Jan 13, 2024 1:57 UTC (Sat) by Cyberax (✭ supporter ✭, #52523) [Link] (2 responses)

How do I do that on my phone?

Information on the SourceHut outage

Posted Jan 13, 2024 3:20 UTC (Sat) by lutchann (subscriber, #8872) [Link] (1 responses)

Is...that the device you generally use to interact with GitHub?

Information on the SourceHut outage

Posted Jan 13, 2024 6:36 UTC (Sat) by Cyberax (✭ supporter ✭, #52523) [Link]

Not the main one, but I do quite often use a phone and a tablet to check for updates on issues I'm tracking.

Information on the SourceHut outage

Posted Jan 13, 2024 10:42 UTC (Sat) by excors (subscriber, #95769) [Link] (7 responses)

From that article:

> Enter the address of the newsgroup server that you are subscribing to, for example news.mozilla.org and click Next.

From https://groups.google.com/g/mozilla.support.thunderbird/c... in March 2021:

> Mozilla is shutting down the newsgroup server (news.mozilla.org) [...] Mozilla has been migrating off of mailing lists and newsgroups for many years now. Many of the mailing lists have already closed down and moved to https://discourse.mozilla.org/

(Coincidentally, that Google link also says "Effective February 22, 2024, Google Groups will no longer support new Usenet content.")

I assume news.mozilla.org wasn't general Usenet access anyway, probably it was only the Mozilla groups? In any case, nowadays you'll need to search for a commercial Usenet provider and sign up for maybe $10/month. I think they charge that much because the main use case is piracy.

Usenet does not seem like much of a success story for decentralised services.

Information on the SourceHut outage

Posted Jan 13, 2024 15:57 UTC (Sat) by notriddle (subscriber, #130608) [Link] (3 responses)

So, has anyone tried building a Git forge on top of the Matrix protocol?

Matrix channels are distributed. They support using email-ish DNS names to discover channels, like @rust:mozilla.org, but those are actually just petnames. The real channel name is a random number, multiple homeservers can have their own name for the same channel, and every homeserver with members in the channel keeps a copy of the whole history.

This seems like exactly how I'd want a canonical Git repository to work.

Information on the SourceHut outage

Posted Jan 14, 2024 21:28 UTC (Sun) by ruscur (guest, #104891) [Link] (1 responses)

Does this not have the exact same problem as git forges now? Everyone keeps the history (as they do with git), but the channel still lives on one specific homeserver, and if that homeserver goes down then all everyone has is their local copy, which is the same as with git.

Information on the SourceHut outage

Posted Jan 15, 2024 5:19 UTC (Mon) by agraven (subscriber, #159039) [Link]

Rooms are distributed across all participating homeservers. The server a room was created on is not special in any way in terms of the protocol.

Information on the SourceHut outage

Posted Jan 18, 2024 12:05 UTC (Thu) by kpfleming (subscriber, #23250) [Link]

This is what the ForgeFed project is working on (not using Matrix, but approaching the same goal).

Information on the SourceHut outage

Posted Jan 18, 2024 7:46 UTC (Thu) by anton (subscriber, #25547) [Link] (1 responses)

Google Groups has been the injection site of a massive DOS attack on Usenet in the last months, so many Usenetizens are welcoming the end of the participation of Google Groups on Usenet. For text Usenet access, there are free Usenet sites, such as eternal-september.org, or, if you want to pay, news.individual.net for EUR 10/year. You have to pay more for providers that also carry binary groups.

For those who don't want to install a newsreader, there is the Rocksolid light Web front end for Usenet, and of course those people also want someone else to run that for then, and that service is provided for free by NovaBBS.

One may wonder why many users switched from Usenet to Web Fora and later social networks. I don't know, because I have not felt the urge. Some people claim it was the lack of moderation (most newsgroups are unmoderated), some think it has to do with the plain-text interface compared to the additional font, colour, and picture capabilities of the alternatives. You seem to think it has something to do with Usenet being decentral. Anyway, if anyone is interested, they can get an impression by looking at NovaBBS.

Information on the SourceHut outage

Posted Jan 18, 2024 14:14 UTC (Thu) by Wol (subscriber, #4433) [Link]

> One may wonder why many users switched from Usenet to Web Fora and later social networks. I don't know, because I have not felt the urge.

As far as I was concerned, it was when Demon Internet basically got taken over and sacked all the network engineers who actually knew what was going on. Probably true for a lot of people, I subscribed to Usenet via my ISP's news-server, and as they disappeared, so did the people who used them. I'd gone by the time they ended up in the hands of Clueless & Witless (aka Cable & Wireless).

Sounds like it might be worth re-subscribing.

Cheers,
Wol

Information on the SourceHut outage

Posted Jan 20, 2024 1:24 UTC (Sat) by jschrod (subscriber, #1646) [Link]

My Usenet provider is news.individual.net, for 10€ per *year*. It doesn't carry binary groups, but IMNSHO that's an advantage and not a disadvantage.

But in fact, I'm happy that few lay persons know how to use it. It's almost like in the good old days before the AOL folks arrived.

Information on the SourceHut outage

Posted Jan 13, 2024 18:38 UTC (Sat) by ceplm (subscriber, #41334) [Link]

I think there is a difference between Indie Website (what I care for) and distributed Internet (which is in my opinion to large extent a pie in the sky). I really don’t care if some services are provided by commercial providers, if the protocol is independent and there are multiple providers interchangeable one for another. So, technically I am considering moving my email from my own VPS to Fastmail.fm, because email is properly standardized and replaceable.

Also, it is not that difficult to run mailman on your server (as I do here, https://redcrew.org/mailman/private/m2crypto/).

Information on the SourceHut outage

Posted Jan 14, 2024 8:46 UTC (Sun) by oldtomas (guest, #72579) [Link]

"Objection! An email list is still a centralized solution in practice."

Yes and no. MX records are built in a way that it's much easier to set up fallbacks.

More important,though:due to its store-and-forward architecture, its "front-end" part is actually decentralized.

Information on the SourceHut outage

Posted Jan 12, 2024 22:34 UTC (Fri) by rahulsundaram (subscriber, #21946) [Link] (1 responses)

> It would be interesting if a truly fully distributed system was possible, or at least one with minimal centralisation

I don't think a fully distributed system is easy to use. Look at Mastadon for how that approach fails to scale outside of the tech audience since there is no simple answer to the question which website should I go to which is how people think about it. However you can make it more distributed than say GitHub for sure. https://docs.pagure.org/pagure/ for instance stores a lot more of the associated metadata data (tickets, prs, doc etc) directly in that repo so when you clone it, you get all of it.

Information on the SourceHut outage

Posted Jan 15, 2024 2:00 UTC (Mon) by ssmith32 (subscriber, #72404) [Link]

Mastadon has plenty of non-technical users, and, relative to most software, plenty of users in general - from farmers in Scotland who post pictures of beautiful forest walks to random folks taking pictures of cats.

Most of the complaining I saw on it was ex-Twitter folks complaining it didn't have some feature that they deemed essential (e.g re-posting) and foolishly claiming they "knew" users wanted it because they had so utterly drank the Twit sauce they equated clicks & other measures of "engagement" with what folks actually wanted. Or people who were mad they couldn't change communities, and get other folks to adopt certain behaviors, by being really, really mad at them.

You literally:
- download app
- pick something from a list that has a name that sounds like a community you want to be part of
- and go...

It's not hard. Unless you want it to be Twitter. Which it is not.

Information on the SourceHut outage

Posted Jan 12, 2024 23:51 UTC (Fri) by himi (subscriber, #340) [Link]

Any kind of distributed system requires distributed *hosting* capacity - this is the key requirement for everything else, the data has to be in lots of buckets that are physically located in lots of different places and which are using physically independent resources.

The problem with that is that only a very small percentage of the population has the technical skills or financial resources to be able to set up that kind of hosting capacity, and even then the scale of hosting that they can support is extremely varied. Mastodon is a great example of that - sure it's not (that) hard to set up your own self-hosted server, but very few people can set up a server which can handle enough traffic to be useful for much, so most people use a few big centralised servers.

Git is inherently well suited to fully distributed hosting, because every single git repo (as a fairly good first approximation) has *all* the data you might want to host - by its very nature, the data is already in lots of physically independent buckets everywhere there are people interested in that bit of software. The problem is, those buckets are almost all in locations where they can't be involved in any kind of public access - they're on people's personal or development machines, or spread across servers in support of deployment tooling, and so on. So it's distributed *storage* capacity, but not distributed *hosting* capacity.

The closest thing I can think of to that kind of distributed storage capacity is hosting at the individual ISP level - effectively having each individual pushing the data up to their own ISP, who then provides a hosting service for it. Which is kind of already a thing, since most ISPs do provide some level of hosting service for their clients, but it's not the kind of thing that can scale up to the level of a sizeable forge replacement, definitely not a replacement for something on the scale of github, and probably not even the scale of a smaller forge. And there's a simple reason for that: hosting costs money and resources, ISPs aren't making money from it, and therefore they don't offer it as more than an afterthought or as a small-scale paid service.

I can't think of any alternatives to ISPs as a source of truly broad-scale distributed hosting - if anyone has suggestions I'd be interested in hearing them.

The key problem is really that there are *massive* economies of scale in the hosting business - the incremental costs of adding capacity to an existing data centre are insanely small compared to the initial cost of the data centre itself (up to a point, obviously), so lots of smaller data centres is a lot more expensive than a few big ones, and "truly" distributed "data centres" (one for each individual) is scaling massively in the wrong direction. So any time you want to scale up a service, there's a very strong cost push towards big centralised hosting - it's just vastly cheaper that way, as well as being easier to implement and manage. We're not going to move away from that any time soon, and probably never - this is pretty much inherent to the nature of the technology.

But when you actually look at the world, there are *lots* of data centres out there, of various sizes and providing various levels of service - we probably don't *need* to distribute the actual physical hosting capacity much further than it already is. The bigger problem for the kind of distributed service that you're talking about is the fact that very few people have the *practical capability* to use that hosting capacity - the technical skills, the financial resources, the willingness to jump over the various structural hurdles that are put in their way by the modern hosting service model.

ISPs generally need their own data centre presence just to be able to do normal business, which is why they're probably the first choice for getting around that - anyone with an Internet connection already has a paid contract with an organisation that has the technical capability to provide hosting. If the goal is ultimately to allow *every* individual to be able to push their own little bucket of shared/shareable data up to an external hosting provider then this is surely the best starting point. But for ISPs, hosting services are going to be a money sink, as well as exposing them to extra risks (apparently random DDoSes being the perfect example) - they need a revenue stream to offset that. If you want it to be universal then that revenue stream needs to come out of everyone's pockets, which then makes everyone's ISP bills higher; for most people who aren't particularly interested in hosting services (except for the kind of thing they post on Facebook or similar) that's going to be unacceptable. All of which adds up to ISPs not having any reason to provide hosting services for their users, even if they technically could do so reasonably easily.

The gist of it all is that the way the world is structured (right now, at least) simply doesn't make truly distributed systems viable, certainly not compared with a centrally hosted version of the same system.

The only way I can think of to change that would be to change the way that things are paid for - if it was possible for the hosting provider to get money from people's *actual use* of a service (rather than having the people running the service get that money, and then use some of it to pay the hosting provider) it'd be far more viable for organisations like ISPs to get into the hosting game. In fact, if that was possible then it would provide financial incentives to move towards distributed hosting - with a centralised model all that money would go to the centralised provider (Facebook, etc) rather than the people who actually created the content that the centralised provider was hosting. With the kind of usage payments I'm thinking about, distributed hosting would see those usage payments going to the right place.

But it's easier to *say* "get money from people's use of a service" than it is to make the world actually work that way. A *lot* easier.

Information on the SourceHut outage

Posted Jan 13, 2024 1:01 UTC (Sat) by stefanha (subscriber, #55072) [Link]

There is work going on in this area. Radicle is a peer-to-peer git hosting project: https://radicle.xyz/

Information on the SourceHut outage

Posted Jan 13, 2024 2:29 UTC (Sat) by gdt (subscriber, #6284) [Link]

Change ISP. There's a world of design and system alternatives for internet service providers to ameliorate volumetric DDoS attacks. But an ISP won't pay the (substantial) cost if they don't see a reason, such as customers leaving.


Copyright © 2024, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds