Re:Docker limits unauthenticated pulls to 10/HR/IP from Dock...
by hinkley on Friday February 21, 2025 @01:35PM
(#43131184)
We are all getting a little tired of “Come Into My Parlor,” Said the Spider to the Fly.
Of if you want it a little more colorfully: capturing a market with free candy to get us into your van.
Or more accurately, this “free until we need something from you” is the moral equivalent of a free meal or ski trip but you are locked into a room to watch a timeshare marketing deck.
Open Source is built on a gift economy. When you start charging you break the rules of that socioeconomic model. So most of us make tools that we have a hope of keeping running the way they were designed. Some of us stay at the edges because we know we won’t still be interested in this tool in two years and we don’t want to occupy other people’s head space unfairly or dishonestly. Some of us believe we can persevere and then we find there’s a new programming language that we like so much more than this one that we fuck off and leave a vacuum behind us that others have to scramble to fill (I’m talking about you, TJ).
And then there’s these kinds of people who hoover up giant sections of the mindshare using VC money and don’t ever find a new revenue stream, like Mozilla managed. And it’s getting really fucking old.
One of the problems with XML is that the schemas aren’t cached by default, and so a build system or a test harness that scans dozens or hundreds of these files per run, or twenty devs running their sandboxes in a tight loop, can eat up ridiculous amounts of bandwidth. But the important difference is that they architected a way to prevent that, it’s just that it is fiddly to get set up and nobody reads the instructions. I found an email chain with the W3c.org webmaster complaining about it, and myself and a couple other people tried to convince him that they needed to add a 100ms delay to all responses.
My reasoning was that a human loading a single XML file would never notice this increase, but a human running 100s of unit tests definitely would want to know why they suddenly got slower, and doing something about it wouldn’t just get back that extra 20 seconds, they’d get back 40 (or in our case 5-10minutes) by making the call one more time and putting it into a PR. We only noticed we were doing it because our builds stopped working one day when the internet went down.
There’s no build tool I know of that will deal with being 429’d at 10 requests. Especially if you know anything about how layers work. There are tons that would work just fine being traffic shaped to a server with a lower SLA. Dedicate half of your cluster to paying customers and half to the free tier. Or add 250ms delay. It’ll sort itself out. People will install Artifactory or some other caching proxy and you’ll still have the mindshare at a lower cost per use.
Of if you want it a little more colorfully: capturing a market with free candy to get us into your van.
Or more accurately, this “free until we need something from you” is the moral equivalent of a free meal or ski trip but you are locked into a room to watch a timeshare marketing deck.
Open Source is built on a gift economy. When you start charging you break the rules of that socioeconomic model. So most of us make tools that we have a hope of keeping running the way they were designed. Some of us stay at the edges because we know we won’t still be interested in this tool in two years and we don’t want to occupy other people’s head space unfairly or dishonestly. Some of us believe we can persevere and then we find there’s a new programming language that we like so much more than this one that we fuck off and leave a vacuum behind us that others have to scramble to fill (I’m talking about you, TJ).
And then there’s these kinds of people who hoover up giant sections of the mindshare using VC money and don’t ever find a new revenue stream, like Mozilla managed. And it’s getting really fucking old.
One of the problems with XML is that the schemas aren’t cached by default, and so a build system or a test harness that scans dozens or hundreds of these files per run, or twenty devs running their sandboxes in a tight loop, can eat up ridiculous amounts of bandwidth. But the important difference is that they architected a way to prevent that, it’s just that it is fiddly to get set up and nobody reads the instructions. I found an email chain with the W3c.org webmaster complaining about it, and myself and a couple other people tried to convince him that they needed to add a 100ms delay to all responses.
My reasoning was that a human loading a single XML file would never notice this increase, but a human running 100s of unit tests definitely would want to know why they suddenly got slower, and doing something about it wouldn’t just get back that extra 20 seconds, they’d get back 40 (or in our case 5-10minutes) by making the call one more time and putting it into a PR. We only noticed we were doing it because our builds stopped working one day when the internet went down.
There’s no build tool I know of that will deal with being 429’d at 10 requests. Especially if you know anything about how layers work. There are tons that would work just fine being traffic shaped to a server with a lower SLA. Dedicate half of your cluster to paying customers and half to the free tier. Or add 250ms delay. It’ll sort itself out. People will install Artifactory or some other caching proxy and you’ll still have the mindshare at a lower cost per use.