90
Kitchenowl creator has been flagged without warning making all of their repositories return 404, while in their settings all of the repositories still look normal with public visibility. (lemmy.ml)
submitted 7 months ago by to c/selfhosted@lemmy.world
12 comments fedilink hide all child comments
 

cross-posted from: https://lemmy.ml/post/45529149

Here is the message where he found out what happened:

I didn't receive any information about it but when creating a support ticket I was told my account has been flagged and I had to do some extra verification. I've created a support ticket now and will keep you posted. I'll believe it's nothing major though, I use 2FA everywhere, the last commit on all repos is what I expect, and all sessions and usages look fine

Absolutely fuck Github and Microslop, they can just vanish your projects without notice whenever they want with barely any justification for it, and then take their sweet time to fix it too.

all 12 comments

sorted by: hot top controversial new old
[–] 49 points 7 months ago (5 children)

Self host your own code repo. Forgejo is adding activitypub and federation features, not sure how far long they are, but someday if enough people start self-hosting we might have a viable decentralized way to collaborate on and contribute to each others' projects.

  • permalink
  • fedilink
  • source
  • hideshow 5 child comments
    •
  • [–] 8 points 7 months ago* (last edited 7 months ago) (2 children)

    The scraping/bandwidth abuse problem can easily be worked around.

    But there still are actual good reasons to not host a public forge.

    For example, as long as pull requests are allowed (which is required for actual contributors), anyone can abuse the PR feature to fork your repository, then start pushing random shit into their fork (since the fork is an actual separate git repository).

    Bad actors can do it on github all they want, it's not my storage, not my server used to host potentially illegal content.

    Self-hosting public services where you are the only authenticated user and sole publisher of content is easy (using your public forge as a mirror with account creation disabled is fine), hosting other's people content is another can of worms. Think twice before you do that.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 7 months ago (1 child)

    The scraping/bandwidth abuse problem can easily be worked around.

    how?

    anubis does not protect the APIs, and it cannot protect against bot traffic coming from many different residential proxies

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 7 months ago

    It can protect APIs as much as any other URL. Or more simply you could disallow any unauthenticated API access in gitea or at the reverse proxy level?

    cannot protect against bot traffic coming from many different residential proxies

    It can block anything that doesn't pass the proof-of-work/JS challenge. Most bots don't interpret JS.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 8 points 7 months ago (1 child)

    With AI search engines hosting public repo is very expensive.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 26 points 7 months ago*

    Because of the AI-induced scraping traffic? While not perfect, Anubis and similar are coarse-but-effective solutions for self-hosting repos.

    And if it it were acceptable to outsource such protection to a CDN (eg Cloudflare) in order to retain firm control over the repo, then that's a choice that's also available. Not everyone agrees that CDNs have a role in self-hosting -- fair enough -- but when a project's very repo and existence can be wiped off the internet, owning a domain name and the affirmative upstream repository is a tractable and intermediate goal, even if it doesn't achieve full independence.

    Self hosting is an exercise in harm reduction.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 14 points 7 months ago (1 child)

    Centralization strikes again

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • [–] 10 points 7 months ago* (last edited 7 months ago) (2 children)

    VLLM litellm supply chain attack.

    Creator possibly was compromised and likely a security measure.

    Affected versions were not pushed IMO, but the owners machine may have been compromised.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 3 points 7 months ago (1 child)

    How do you know that?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 5 points 7 months ago*

    I do not know for sure, but the repo did contain the dependency litellm with version specifier >=1.65.0 (if I recall correctly) and an early march build did use the version 1.81.0 per the uv.lock (version before the compromised litellm==1.82.7 and litellm==1.82.8 )

    https://docs.litellm.ai/blog/security-update-march-2026

    Not saying that the Dev was compromised, but it is possible, and it could be some Github precaution to disable repos with that dependency where a pip install at the wrong time could have compromised all the Devs credentials.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 7 points 7 months ago

    Honestly as much as people hate the complexity sometimes replicating the repo from Github to Codeberg or other places is great for redundancy. Or maybe use a local repo for all development and releases and push out to public VSC.

  • permalink
  • fedilink
  • source
    •