Sourcehut and Codeberg are both currently experiencing a DDoS attack

Original Article ↗ Hacker News Discussion ↗

Independent Git forges Sourcehut and Codeberg are facing sustained DDoS attacks, knocking key services offline and highlighting how vulnerable smaller, donation-funded platforms are to relatively cheap disruption. Commenters speculate on motives ranging from ransom and censorship of hosted content to culture‑war vendettas, while noting that effective commercial mitigation from providers like Cloudflare can be prohibitively expensive. The incident revives broader concerns about the centralization of DDoS protection, possible technical alternatives such as proof‑of‑work rate limiting or more distributed hosting, and the difficulty of defending open infrastructure without compromising its principles.

Motivations for the DDoS

  • Multiple speculative motives:
    • Personal grudge against the forge or its staff, including prior disputes and culture-war animus.
    • Attempted ransom/extortion, though some doubt this because both services are donation-funded and not wealthy.
    • Desire to suppress or remove specific hosted content, hoping operators cave under pressure.
    • “Dry run” to test techniques before attacking larger targets.
    • Broader political/state-actor motives; comparison made to past state-linked attacks on GitHub.

Cloudflare, pricing, and mitigation tradeoffs

  • Discussion focuses on why they don’t “just use Cloudflare” or similar:
    • Business plans appear cheap on paper but sales interactions reportedly surface much higher real costs, especially for non-HTTP protocols and heavier traffic.
    • Some see opaque pricing and upselling as off-putting; others say standard self-serve plans work if you don’t need special features.
    • Sourcehut’s use of SSH and email makes off-the-shelf HTTP-only protection insufficient; partial protection (web only) is proposed as a stopgap.

Decentralization and replication ideas

  • Several proposals to make source hosting harder to DDoS:
    • BitTorrent/IPFS-style distribution of repositories, possibly combined with signatures or blockchains for canonical “source of truth.”
    • Git replicas and DNS-based load balancing or advanced multi-master schemes.
    • Existing systems like Radicle, Fossil, Keybase-style models, and git-bug for decentralized issues are referenced.
  • Challenges noted: mutability, consensus on latest state, key compromise, and greatly increased complexity.

Cultural and personal targeting

  • Some recall earlier claims that attacks may be rooted in hatred against transgender developers or in the maintainer’s antagonistic public stance.
  • Others argue that’s a lot of effort for a personal vendetta and suggest financial or strategic motives instead.
  • Several commenters stress that organized hate mobs and culture-war harassment against individuals and small communities are common online.

Proof-of-work and rate limiting

  • Enthusiasts advocate proof-of-work (PoW)–based rate limiting as effective against some application-layer attacks.
  • Skeptics note:
    • Energy waste concerns.
    • Limited relevance when the network link itself is saturated (as Codeberg reports).
    • Practical friction for non-JavaScript or non-browser clients, especially given Sourcehut’s JS-averse philosophy.
  • Workarounds like external PoW tools and long-lived tokens are discussed.

Is DDoS “solved” and who pays?

  • Some assumed DDoS is a solved problem via large CDNs; others counter:
    • This centralizes the web behind a few corporations, conflicting with the ethos of independent, FOSS-hosting forges.
    • True “solution” would require better upstream abuse handling and ISP incentives, not just paid scrubbing centers.
  • Cost is a major constraint: both Sourcehut and Codeberg rely on limited donations and membership fees, and users note that participation/donations are low relative to usage, especially for Codeberg and its Europe-centric payment setup.