183
Github confirms random 401 responses on unauthenticated git clones are no mistake (eviltoast.org)
submitted 1 month ago by to c/programming@programming.dev
78 comments fedilink hide all child comments
 

Since yesterday a lot of users in Europe found their workflows failing due to Github seemingly randomly throwing HTTP/401 on git clone/git pull when interacting with public repos without authentication.

It was now confirmed by staff member that this indeed is intentional and no further steps are planned at this point.

you are viewing a single comment's thread
view the rest of the comments
[–] 19 points 1 month ago (13 children)

This might be a problem for many projects. Rust, comes to mind, that pulls everything from Github and is 100% dependent on it. Same as Go. They pull everything from Github.

It might make sense for them to use something like radicle, a distributed git. Many people can easily pick what they want to distribute. Scripts can be written that make the local node only host the projects you depend on. That would naturally make popular projects more available.

  • permalink
  • fedilink
  • source
  • hideshow 13 child comments
    •
  • [–] 7 points 1 month ago (7 children)

    Wait, doesn't rust cargo pull from crates.io?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 2 points 1 month ago* (last edited 1 month ago) (6 children)

    crates.io pulls everything from github.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 15 points 1 month ago (3 children)

    No true at all.

    The index used to be from github but now it pulls from a CDN by default and doesn't do a full clone of the index. Crate downloads have always been pulled from a CDN.

    The index was quite small in the beginning this is why it worked.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 0 points 1 month ago (2 children)

    The service itself pulls from github to create the crates. Cargo pulls from crates.io, that is correct.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 9 points 1 month ago

    Who pulls from Github to create the crates? The crates are pushed by cargo publish to crates.io's API, not to github.

    crates.io does have an index in GitHub, but that's legacy and pretty much unused for reads now. GitHub doesn't store the crates themselves.

  • permalink
  • fedilink
  • source
  • parent
  • [–] -4 points 1 month ago (1 child)

    Does all of that access really need to be anonymous access? I get that it's convenient. But let's be practical; they have to manage anonymous bot spam somehow.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 6 points 1 month ago

    Yeah I'm not managing several different accounts for each vm in qubes os.

    The only real way to maintain any semblance of digital privacy is to build information silos.

    That will always be more important than Microsoft's hosting costs. (Though probably not to them.)

  • permalink
  • fedilink
  • source
  • parent