Github confirms random 401 responses on unauthenticated `git clone`s are no mistake
Since yesterday a lot of users in Europe found their workflows failing due to Github seemingly randomly throwing HTTP/401 on git clone/git pull when interacting with public repos without authentication.
It was now confirmed by staff member that this indeed is intentional and no further steps are planned at this point.
78 replies
The word is “scrapers,” as in to scrape.
no disassemble!
Well given the waves of "buy book, scan, scrap" scrappers might become an acceptable version as well soon.
We’re talking about AI bots scraping GitHub in this post. Nothing to do with books.
Yes, and I was talking about the practice of some AI companies buying books in bulk to feed to their LLMs en masse which sometimes/often destroys the book in the process.
I was trying to build a bridge between those two related topics to "justify" the mistake and make it an intentional remark instead.
Wooooooooosh
Are you claiming that “AI scrappers” is a valid term and not just an (all too common) misspelling? If so, I’ll need to see a source on that, please.
Hah. No. I'm claiming there's a joke that went over your head. And apparently over the heads of quite a few more readers. That's OK.
I made a typo, so no joke was intended 🤷
otoh bots scrapping the internet infra with massive traffic... 🤔
Thanks for clarifying! cc @[email protected]
What was the joke?
That the misspelling is amusing because if you look at it in a certain way it would still apply to AI/LLM companies. Whether it was intended or not.
Do we always have to be so tight and literal about everything?
Yeah except in the context of the post/article, it seems pretty far fetched for someone to be referring to the “scrapping” of books (assuming that’s what you meant; it’s strange that neither you nor the person who posted “whoosh” was willing to clearly state what the supposed joke was).
Misspellings annoy me, especially when they’re common like this one. Trying to explain away the misspelling as some kind of “joke” annoys me even more.
did microsoft just lock up a good chunk of open source behind a (stochastic (for now)) login wall?
this feels like it should violate the gpl, but i bet it doesn't. truly devious.
Uh okay.
I wonder why people still keep up with this bullshit and not switch to some better public Git hosting provider.
Could you suggest an alternative?
I know Codeberg exists, but they had reliability problems recently IIRC?
sr.ht and Gitlab are paid products.
Technically one can self-host a forge, but my attempts at setting up CI were unsuccessful (IMO that's way more complicated that setting up the forge itself).
Codeberg's couldn't be much worse than github's reliability since 2019
Codeberg only targets a subset of projects.
For example, I no longer want most of my self-written code to be publicly available, but Codeberg only supports public repos.Codeberg allows private repositories: https://docs.codeberg.org/collaborating/repo-permissions/
https://docs.codeberg.org/getting-started/first-repository/
Oh, I had no idea! Thanks, that's great to know!
The problem with Codeberg now is that there is a spectrum of AI usage between manually coding and AI slop that Codeberg chooses to ignore with their new policy.
I get it that's their platform and their choice, and at some point I even looked for ways to support them financially if that meant I could migrate all my repos from GitHub - I wouldn't mind paying for my use, "vibe coded" or not - but an intransigent LLM ban creates uncertainty for many of my active projects, and I can't consider them a viable alternative to GitHub anymore.
So sure, I'll take 3h of GH actions downtime a month over a platform ban. I'm sure I'm not alone there.
So, you should be fine with the measures against scraping, then?
That doesn't affect me, but you can't eat your cake and have it too. I'd rather have open source content actually open and easy to access, but GitHub has an availability issue and they're trying to address it, so I don't see this as a hostile move.
I'm sure if codeberg was nearly as popular as github, they'd be forced to restrict some clones too. Their current load is unprecedented, even for their standards.
you can self host gitlab too, and its free. yes, you CAN buy a license, but you can run it free forever. you can also use their SaaS free forever too.
at least right now, I think it's the best alternative, though I completely understand people wanting to favor OSS.
disclaimer: I have contributed code to gitlab, but I am NOT an employee.
Their SaaS is pretty good but of course you are running the same chain trust. You're betting that gitlab doesn't enshittify within the next 5 years which is hardly a guarantee.
Self-hosting gitlab is very resource-intense and complex from what I tried, though I did only try it two or three times.
I did set up forgejo which was way easier and less heavy but I haven't tested it much so who knows.
I hosted GitLab Community Edition on-prem as a trial for a very small team, but switched to a Microsoft offering. Part of it was it being demanding, part of it was not. The point is you can host CE yourself and get an experience that’s very similar to their service, “for free,” where “free” translates to your hardware requirements and responsibility. I’d even say it’s worth it to go with GitLab, in that context, for the familiarity you can provide your team. “You’ll have to learn gitonator9000” turns into “you’ve used GitLab, right?”
Personal use? You could run it in a container and periodically backup your data. Is it proportionally more demanding than other things? Probably.
Like GitHub, yes. But if you're not going to selfhost Forgejo they're the best option.
Codefloe is very nice and fast, and their CI can do Jsonnet instead of only dumb YAML.
Sounds interesting, thanks for the tip!
Yes, they had reliability problems because so many fucking people are suddenly switching to them because they're so much better overall and not evil. Those are the kind of reliability problems that it is genuinely nice to see someone having. Having a little bit of a bumpy road when scaling due to significant rapid adoption is normal. So what?
Imagine not wanting to use Linux because it recently had a bunch of security flaws. And it did. But again, so what? Does that mean Linux has always been insecure? Well for those things it was. But is it still insecure? Maybe, who knows, nothing is perfect. Are you going to refuse to use it because you're not sure? Why? Past performance is not an indicator of future success.
If some minor reliability issues are your foremost concern to the point that the other things codeberg provides for free are not valuable to you because of it, I question the depth of your priorities.
That said, it is much healthier and better for people to self-host or use smaller less centralized providers if possible. I do not wish Codeberg to become a victim of their own success, and a healthy ecosystem is a diverse one. But it is not for everyone, and if all you need is a minimal fuss alternative to Github, Codeberg is right there.
Can you help me find a solution that:
Number 4 rules out Codeberg. The only other one that really supports that level is Azure DevOps, and well….
It's new reddit then. I was still using Github as a shitty backup for my projects, but an alternative may be required faster than expected.
Holy crap this is huge!
Open source is no longer open source on github.
Be ready to supply your fingerprints using Microsoft Authenticator app and your free source access subscription for only 49 USD per month! /s
I deleted my repos on github and moved to a mix of codeberg and selfhosted forgejo.
But I do occasionally fork/clone/reupload random projects from github to github so they have to spend money on storage and the scrapers.
Git objects are deduplicated, the storage cost doesn't increase.
What if they run a rebase script that changes the timestamp or sth on every commit, before the reupload?
This might be a problem for many projects. Rust, comes to mind, that pulls everything from Github and is 100% dependent on it. Same as Go. They pull everything from Github.
It might make sense for them to use something like radicle, a distributed git. Many people can easily pick what they want to distribute. Scripts can be written that make the local node only host the projects you depend on. That would naturally make popular projects more available.
I'm worried about nix, honestly. An absolute truckload of nix packages pull their source from GitHub. It's the primary way to distribute flakes, too.
nixpkgs is literally a GitHub repo
Wait, doesn't rust cargo pull from crates.io?
crates.io pulls everything from github.
No true at all.
The index used to be from github but now it pulls from a CDN by default and doesn't do a full clone of the index. Crate downloads have always been pulled from a CDN.
The index was quite small in the beginning this is why it worked.
The service itself pulls from github to create the crates. Cargo pulls from crates.io, that is correct.
Who pulls from Github to create the crates? The crates are pushed by
cargo publishto crates.io's API, not to github.crates.iodoes have an index in GitHub, but that's legacy and pretty much unused for reads now. GitHub doesn't store the crates themselves.It seems that's not the case. Crates.io only needs Github for logging in. Publishing a package uploads a .tar.gz to crates.io with the source code.
https://users.rust-lang.org/t/publishing-crates-without-github-and-some-criticism/134597/11
yikes, what a terrible design lol. And here I thought cargo was actually pretty solid.
You can only publish packages via github, so it's not a surprise, IMO. I don't know why they did that in the first place instead of using email like every normal service.
Flathub
Nixos
GrapheneOS
uBlue (Bazzite, Bluefin etc), Secureblue
90% of android and linux apps
github is scary big
Does all of that access really need to be anonymous access? I get that it's convenient. But let's be practical; they have to manage anonymous bot spam somehow.
Yeah I'm not managing several different accounts for each vm in qubes os.
The only real way to maintain any semblance of digital privacy is to build information silos.
That will always be more important than Microsoft's hosting costs. (Though probably not to them.)
Time to leave github! Boycott is the only language companies understand!
Done a long time ago. It would be great if others at least had official mirrors. A
mirrors.txtwith a list of links in the repo would be very helpful and could be a start.But I'm afraid people will either just stay or start hosting on the cursor git forge.
Embrace. Extend. Extinguish.
AI bot problem is real and there is no good solution to it. Look, I very much dislike GitHub for various reasons BUT currently there is no good way to throttle AI bots that literally trash web. They are like that geeky classmate who can never hold his liquors: it's nice having them around for some answers, but they ramble a lot and shit/puke in random places of the house making it unlivable.
They are the ones who created this crap
Sure is. There are plenty of protocols resilient to DDOS.
DDOS is most effective on expensive endpoints. A git clone isn't exactly cheap. Fetching is especially expensive if you vary the revisions you fetch.
Does GitHub have an alternative here? A Git-compatible protocol with anonymous access that is DDoS-resilient?
have you never heard of anubis? tons of websites use that to screen out most of the AI scrapers.
I believe that it is some fuckup and they don't know where exactly problem is and while they are looking for a way to fix it they've created plausible lie. When they'll fix it or believe that it's fixed there would be a public announcement like 'we heard the community and reversed our decision' and users will be happy. There is a serious need for github mirror, they are becoming less and less stable every year.
I'm 100% sure this is damage control on their part, they refused to acknowledge the incident and are looking for their way out.
What users found in this thread is
gitbuilds (gix version x TLS lib x TLS lib version in place)If these are LLM scrapper mitigation steps then apparently fighting LLM scrappers is 7D chess game or something 🤷
The Microslop marketing department was always their best department.
First time ever seeing color in a post title
Rendered
fixed fontwith the use of one and only bacticks (`)As I expected, it's about combating (excessive) bot traffic.
Hmm... I don't know whose building all those bots to scrape all of internet
"We're all trying to find the scraping LLM who did this!"
This seems reasonable. Cry all you want but if even smaller sites are getting overwhelmed with bots imagine what it's like for GitHub.
I'm not sure scrappers are so kind to
git cloneinstead of rendering every single file in HTML 🤔I expect they are for GitHub. GitHub is really well known and huge so it makes sense to set up specific scrapers for it.
Fair enough, may as well be the case.
The web page is probably behind CloudFlare or something similar.
My obscure site for my small business is getting hundreds of thousands of hits a month and its practically all bots.
When Cloudflare says bots are most traffic nowadays, I believe it based off what I see.