Statement regarding the ongoing Sourcehut outage

Original Article ↗ Hacker News Discussion ↗

A sustained DDoS attack has taken the open-source code hosting platform SourceHut offline, exposing how dependent smaller services are on upstream network providers and specialized mitigation vendors. Commenters examine why even major cloud platforms can remain vulnerable, the role of providers like Cogent and Cloudflare, and the high cost of protecting non-HTTP services such as Git over SSH. The incident also raises broader questions about attackers’ motives, the practicality of geo-blocking or traffic blackholing, and whether current internet protocols make expensive DDoS protection an unavoidable cost of doing business online.

Nature of the outage & upstream handling

  • Several commenters report DNS or reachability issues even for the outage status page, sharing archives and status mirrors.
  • Summary of events: a large DDoS against Sourcehut led its upstream provider (Cogent) to nullroute or blackhole traffic.
  • Some say Cogent “disabled the victim” due to poor DDoS handling and administrative lapses; others clarify that nullrouting under attack is common, and the real problem was poor support/communication.
  • Multiple people characterize Cogent as low-cost with a long-standing reputation for crude DDoS response (blackhole first).

Cloud vs self-hosting & DDoS economics

  • There is debate whether using a major cloud would have prevented this.
    • One side: large clouds + paid DDoS services have more capacity and tooling.
    • Other side: they are still just servers behind load balancers and can be overwhelmed or made unreachable if upstream networks cut paths.
  • Cloud hosting may simply change the failure mode: instead of downtime, you risk “denial-of-money” via huge scaling/bandwidth bills.

Cloudflare, pricing, and protocol limits

  • Confusion over Cloudflare’s “unmetered DDoS protection”: commenters note it really applies to HTTP(S) only.
  • Protecting non-HTTP services (e.g., git over SSH, arbitrary TCP/UDP) requires products like Spectrum or Magic Transit, which are enterprise-priced and/or metered, explaining the unaffordable quote Sourcehut mentioned.
  • Some argue Cloudflare shouldn’t be expected to subsidize protection; others suggest there could be PR value or negotiation.
  • There is criticism of “unlimited” marketing in general, and skepticism that truly unlimited HTTP traffic would be tolerated in practice.

Motivations and actors behind DDoS

  • Speculated motives: extortion, censorship, ideological grudges, or pure “for the lulz” disruption.
  • Examples cited include state-linked attacks on developer platforms and darknet-market ransom DDoS.
  • Some see current attacks as possibly signaling capability to future paying customers; others think targets were chosen to hurt open-source communities.

Geographic move & multi-site setup

  • Sourcehut’s planned move to an EU/Amsterdam site (AMS) predates the attack, but the incident accelerated it.
  • Commenters note that relocation alone won’t stop a determined attacker; benefits depend on the new provider’s built-in DDoS mitigation and upstreams.
  • Some discuss hiding new IP ranges and fronting with protection before public cutover.

Broader ecosystem impact

  • Codeberg and other open-source-related sites reportedly saw DDoS around the same time, raising suspicion of a campaign against forges.
  • Hacker News downtime was attributed by some to collateral damage from Cogent’s aggressive nullrouting around the Sourcehut attack.

Views on Sourcehut’s policies & posture

  • Sourcehut’s clear communication during the outage is widely praised.
  • Its stance against certain project types (e.g., cryptocurrency) is noted; some see this as principled curation, others as unwelcome value judgment.
  • There is tension between its prior blocking of Cloudflare’s reverse proxy on philosophical grounds and the current need for industrial-scale DDoS protection.

Structural / protocol concerns

  • Several commenters frame large-scale DDoS as a fundamental flaw of current internet protocols and economics, not just an operational failure.
  • It’s argued that paying specialized DDoS vendors has become a de facto cost of running any public-facing service, which some see as problematic but currently unavoidable.