GitHub hit by DDoS attack

Re:GitHub hit by DDoS attack by tsheeeep on Friday March 27, 2015 @05:14AM (#9275287)

We use bower and npm for our project. Every couple of months github is under attack by a DDoS or not working correctly leaving us with broken deploy scripts. What is the best way to fix this? We don't like the idea of commiting the node_modules or bower_components folder. Is there a tool which will cache the npm and bower sources so they only have to be downloaded if something changes?

[ Parent | on HN ]

Re:GitHub hit by DDoS attack by Cthulhu_ on Friday March 27, 2015 @07:56AM (#9275731)

You could install something like Angry Caching Proxy (https://www.npmjs.com/package/angry-caching-proxy) to cache commonly downloaded packages in your local network. That should also please whoever's paying for the NPM repository.

Another thing I used to do was have a simple script that tried to do npm install, if that failed, npm install using the NPM Europe mirror - although I see now that that one's been deprecated because NPM's primary repository has become more reliable and hosted at a CDN with multiple locations across the world, etc.

[ Parent | on HN ]

Re:GitHub hit by DDoS attack by xtrumanx on Friday March 27, 2015 @09:36AM (#9276135)

Another option is Sinopia (https://www.npmjs.com/package/sinopia) which is a private npm repository server. After installing it, you'll have to change the npm registry url to your new private server and any npm requests (install, update, etc.) will go through your private server and fallback onto the official server if a package is unavailable.

[ Parent | on HN ]

Re:GitHub hit by DDoS attack by STRML on Sunday March 29, 2015 @06:14AM (#9284375)

Sinopia is great. It is a good idea to run your own npm repository anyway; not only do you have some protection from tampered packages (in combination with shrinkwrap), but you can also publish your own minor bugfix updates and private packages, without having to rely on GitHub URLs.

You're also insulated from npm and GitHub downtime - win-win-win.

[ Parent | on HN ]

Re:GitHub hit by DDoS attack by kowdermeister on Friday March 27, 2015 @05:18AM (#9275296)

Committing downloaded packages is not a bad practice. Yes, it can be a bit big, but otherwise I don't see much problem with it. You will be always sure that the installed packages are compatible with each other.

[ Parent | on HN ]

Re:GitHub hit by DDoS attack by astrodust on Friday March 27, 2015 @11:08AM (#9276705)

That works great until you have compiled extensions. Then it's misery.

[ Parent | on HN ]

Re:GitHub hit by DDoS attack by tsheeeep on Friday March 27, 2015 @05:20AM (#9275301)

To be sure everything that we know works together we use things like npm-shrinkwrap files. We don't like it because it makes the git changelogs a lot bigger and almost unreadable if you want to compare a pull request.

[ Parent | on HN ]

Re:GitHub hit by DDoS attack by __david__ on Friday March 27, 2015 @07:08AM (#9275575)

You could commit them to their own repository so they don't taint your main repo. Then use a submodule to pull that repo in to the main repo...

[ Parent | on HN ]

Re:GitHub hit by DDoS attack by Already__Taken on Friday March 27, 2015 @06:05AM (#9275396)

Yes the way you should do it is with shrinwrap to ensure the consistency of your dependencies. As for the actual files if you depend on it you should have your own npm repo caching them that you deploy from and have that mirror the public one.

but for small projects or quick deploys absolutely just go ahead and commit the modules.

[ Parent | on HN ]

Re:GitHub hit by DDoS attack by STRML on Sunday March 29, 2015 @06:15AM (#9284378)

Try https://github.com/uber/npm-shrinkwrap, it produces deterministic shrinkwrap files that actually diff properly.

[ Parent | on HN ]

Re:GitHub hit by DDoS attack by s_kilk on Friday March 27, 2015 @07:52AM (#9275716)

> We don't like the idea of commiting the node_modules or bower_components folder

The bower documentation actually advises checking bower_components into source control.

http://stackoverflow.com/a/22328067

[ Parent | on HN ]

Re:GitHub hit by DDoS attack by realityking on Friday March 27, 2015 @07:45AM (#9275687)

We currently only use it for private modules, but [private bower](https://www.npmjs.com/package/private-bower) also allows caching bower packages.

[ Parent | on HN ]

Re:GitHub hit by DDoS attack by ef4 on Friday March 27, 2015 @03:35PM (#9278533)

It's much more robust to have a dedicated build step that is separate from your deploy step.

The build step is where you install deps, do compilation, etc. Then it saves the output. The deploy step can just copy all the files from the last known good build to the new/updated servers.

This way you can always deploy a last-known-good release quickly and without external dependencies.

It also lets you take advantage of package caching on the build server so that as long as your deps don't change, you can deploy new releases to old or new servers without hitting any external services.

[ Parent | on HN ]

Re:GitHub hit by DDoS attack by ssube on Friday March 27, 2015 @12:54PM (#9277443)

I recently rolled out a Sonatype Nexus server at work to handle both NPM and Maven artifacts. Allows us to publish internally, and a combined internal/proxy repo group allows us to serve both our packages and cache global registry stuff. Took ~3 minutes off some of our CI builds.

[ Parent | on HN ]

Re:GitHub hit by DDoS attack by darkarmani on Friday March 27, 2015 @11:33AM (#9276863)

Don't use npm for deployment. that's even the recommendation by joyent.

[ Parent | on HN ]

Re:GitHub hit by DDoS attack by lilred on Friday March 27, 2015 @04:34PM (#9278811)

Git submodules are designed for your use case, but I don't know how well they handle it.

[ Parent | on HN ]