[Resolved] Ongoing DDoS of git.sr.ht and hg.sr.ht

What to do

• Check whether your product depends on SourceHut. Check your stack

  Paste a package.json, lockfile, Terraform or a list of domains at down.guide/stack to see every provider you depend on.

• Confirm your retries, queues and scheduled jobs caught up after the 0m it lasted.

  Anything that failed between 2025-01-02 19:30 UTC and 2025-01-02 19:30 UTC may need a replay.

• Subscribe to SourceHut's feed to hear about the next one first. RSS feed

  https://down.guide/feed?provider=sourcehut works in Slack (/feed subscribe), Discord feed bots and any RSS reader.

Updates from SourceHut 1

1. resolvedJan 2, 2025, 7:30 PM UTC

   Mitigations completed : We believe that we have the attack under control and that there is no need for end-user impacting mitigations to remain in place. (09:00 UTC — Jan 3) Attack still ongoing, but under control : Good morning. The attack is still ongoing, but we have been refining our mitigations this morning. We addressed some cases which were causing git and hg to crash under load, and narrowed our mitigations to better characterize the load. All of our mitigations have now been disabled for logged-in users, reducing the impact on legitimate traffic – if you hit an error page, log in and try again. Thank you for your patience. (09:00 UTC — Jan 3) A distributed denial of service (DDoS) attack on git.sr.ht is underway : An attack similar to the one we encountered in December is once again underway, summoning our sysadmins out of their holiday plans. We have deployed mitigations which have mostly restored service but there are some user-facing impacts for the time being. Happy new year! (19:30 UTC — Jan 2)

   provider

Corrections

None so far.

Something wrong on this page? Report an error or send us a note. Every fix is listed here.