linux-kernel - Re: git.kernel.org -> web.git.kernel.org

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250226-cheerful-delicate-partridge-33280c@lemur>
Date: Wed, 26 Feb 2025 15:16:43 -0500
From: Konstantin Ryabitsev <konstantin@...uxfoundation.org>
To: users@...nel.org
Cc: linux-kernel@...r.kernel.org
Subject: Re: git.kernel.org -> web.git.kernel.org

On Wed, Feb 26, 2025 at 03:08:21PM -0500, Konstantin Ryabitsev wrote:
> Hi, all:
> 
> The change is now in place -- all browser requests to git.kernel.org will be
> redirected to web.git.kernel.org, which is a CDN service currently fronted by
> Fastly. The backend requests for web.git.kernel.org are sent to a dedicated
> set of systems that are separate from git.kernel.org frontends, so hopefully
> this will help shift a large chunk of load from the systems where we actually
> want to serve git and lore traffic.
> 
> Please report any problems you encounter to helpdesk@...nel.org.

I just realized that I cc'd the linux-kernel list on this announcement, but
they don't have all of the context for why this change was needed (it was
discussed just on the users list).

So, here is why this was necessary:

- We've been struggling with near-ddos levels of bot traffic that tries to
  grab as many URLs as possible as fast as possible without any regard for the
  impact it has on a public service like git.kernel.org. It's a problem
  experienced by nearly all public resources -- see a write-up by LWN here
  that describes the problem, and goes into why obvious answers like "just
  throttle the bots" doesn't really work:
  https://lwn.net/Articles/1008897/

- For this reason, we've taken the decision to move repository browsing (and
  only repository browsing) to a separate domain that is backed by a different
  set of systems, so that if bots do knock out the web interface, it will not
  affect git operations.

- This change only affects browsing git repositories via the cgit interface.
  Git checkouts with their origin as  https://git.kernel.org will continue to
  work as-is without any change necessary.

- Existing URLs will continue to work, issuing a redirect from the
  old to the new location, so there is no need to adjust any existing links.

- Similarly, you can continue to use git.kernel.org links as before without
  needing to change your scripts.

If you have any other questions, please do not hesitate to ask.

-K