On 2026-08-17 09:58, Jonathan Wakely via Gcc wrote:
On Sun, 16 Aug 2026, 23:12 Mark Wielaard, <[email protected]> wrote:
Hi Jonathan,
On Fri, Aug 14, 2026 at 09:29:43PM +0100, Jonathan Wakely wrote:
On Thu, 6 Aug 2026, 20:13 Mark Wielaard, <[email protected]> wrote:
I assume you are seeing this with gitweb because it is making too many
requests. Have you tried cgit? https://sourceware.org/cgit/ That
should be more efficient and hopefully doesn't get you rate limited
that quickly.
I've been unable to access any cgit links for at least a week, I get the
429 error every single time.
That is not good. There are regular attacks now, but there should be
some time to get through. The issue is that we are now regularly see
scrapers that do 1K+ hits/sec all from different ip addresses. Often
these addresses do only one hit ever. This makes rate-limiting (what
the 429 from the nginx frontend is) a bit challenging. What Frank came
up with was an allow list of ips that are never rate-limited. If you
logged in from an ip into bugzilla, or through a git clone over ssh,
or just doing an ssh gcc.gnu.org alive in the last 90 days it would
authenticate the ip address (there is a small delay, the list is only
updated once an hour) and you should go right through.
I can't login to bugzilla, because I get the nginx 429 error.
We should add
authentication through patchwork and wiki. And add some way to
manually authenticate an ip address. If nothing works please email
admin-requests@ to get yours added.
I forgot to say that the problems I was having were on my mobile phone,
because I was in holiday until yesterday. I don't have a fixed IP on my
phone (especially not when using data roaming abroad). I couldn't ssh to
the server, because I was just trying to browse web pages on my phone (and
didn't have any ssh keys with me on holiday).
Now that I'm back home it works fine from my usual static IP.
I have sort of the same issue.
On my computer at work, we are using a proxy solution that prevents me from
knowing what endpoint IP that is going to be used. As a result, I think
I end up coming for different IPs for most of my accesses and either hit
the Anubis check and/or the 429 error.
After a few refreshes, I usually get access, but it gets really frustrating
when you try to post comments on bugzilla etc. Keep in mind that this when
I am logged in!
As the 429 error is suppose to lower the amount of traffic to the services,
it's somewhat counterproductive when users will have to send, not 1
request, but maybe 10-20 to get the resource they seek. Maybe this is
still a gain overall, but, to me, it feels like we are heading on the
wrong path if we want to help our users.
In a parallel thread, it was mentioned that devs could use VPN to by-pass
the restriction. While this might work for a home computer, I doubt that
most big corporations will allow you to add a VPN that they do not control.
For me, this is something I simply cannot do.
Just my 2 cents in the discussion.
Kind regards,
Torbjörn
