Fox, who also oversees Apache Maven, a popular Java build tool, explained that its repository site is at risk of being overwhelmed by constant Git pulls. The team has dug into this and found that 82 percent of the demand comes from less than 1 percent of IPs. Digging deeper, they discovered that many companies are using open source repositories as if they were content delivery networks (CDNs). So, for example, a single company might download the same code hundreds of thousands of times in a day, and the next day, and the next. This is unsustainable.

GitHub added rate limits for unauthenticated users last year

https://github.blog/changelog/2025-05-08-updated-rate-limits-for-unauthenticated-requests/

Making big companies pony up is always good.

a single company might download the same code hundreds of thousands of times in a day, and the next day, and the next

Why would anyone ever need to do this?

Why does this article repeat itself? It reads super weird.

ohhhh i misinterpreted the title as meaning hogs like right wing cranks. LOL

Do it, please. My company doesn't care and has pipelines running that pull from npm and pypi for every push, merge, etc. - and devs use AI that has been ordered to commit and push as frequently as possible. With around 100 devs, just imagine the traffic.

They were forced to pay for dockerhub because of the pipelines failing. But they must be forced to pay for packages repos too. I sneakily changed our pipeline to pull from the in-house docker registry, and for pipelines to require pulling from package repos only when locks changed. Our CI is faster than every other team, but nobody noticed.

So yeah, charge the companies! Please!

Charging is a good idea.

In any case it would not be crazy to rate-limit. If you’re downloading the same 10,000 components a million times, you deserve to be limited.

I've seen this almost happen due to ignorance. A product making company that is oblivious to the issue until it's pointed out, and then immediately understands why it's an issue and does the right thing. In that case it was mirroring Linux repos instead of constantly pulling from the distribution when it was for their own internal purposes.

If you're working inside an organisation just mentioning this issue might be enough.

In one case, a department store's team of 60 developers generated more traffic than global cable modem users worldwide due to misconfigured React Native builds bypassing their Nexus repository manager. He detailed extreme examples, such as large organizations downloading the same 10,000 components a million times each month. "That's ridiculous," Fox said. Throttling efforts led to "brownouts" via 429 errors, but patterns mutated, forcing a "Whack-a-Mole" game, especially since most consumption is headless and unnoticed. Registries are also burdened by commercial use, with companies publishing closed source components or massive SDKs as free CDNs. Fox noted that top publishers release gigabyte-scale artifacts daily, unlike in typical open source projects.

This plays in to my idea that every HTTP request could have a microtransaction (like 0.001 c) attached and those who couldn't pay would have ads on the browser level and not on the page level. Altermatively you'd get a fixed monthly budget as part of your ISP plan.

What I am essentially advocating for is that part of what you currently pay for your mobile data plan should go directly to the sites you visit.

Throttling efforts led to "brownouts" via 429 errors

Does this mean for the (ab)users, or for the repo? If it's for the bandwidth hogs, then the brownouts are properly a good thing, as it'll force people to pay attention to these otherwise unmonitored systems.

Also, if it makes the upstream service seem flaky and unreliable, it could convince users to set up the proper caching proxy just for self-interested availability reasons.

I can see some companies happily paying for access, as they'll think it's easier than paying someone internally to manage a proxy/mirror, especially as on-prem is unfashionable lately.