So this past week has been a weird one if you push code for a living. GitHub got hit with what they're calling the biggest DDoS attack in the site's history, and depending on when you tried to git push on any given afternoon, you either didn't notice a thing or you sat there watching a spinner for four minutes wondering if your internet had just quietly died.
I noticed. I noticed a lot, actually.
Last Thursday I was trying to push a small fix to a side project (nothing important, just a script that scrapes RSS feeds for a personal reading list thing I've been tinkering with since Christmas) and the push just hung. Not an error, not a timeout message, just... nothing. I did what everyone does in that situation, which is refresh github.com about six times like that's going to fix anything, and then finally went and checked status.github.com, which was lit up like a Christmas tree with incident updates going back days.
GitHub's own writeup said the attack was aimed at forcing them to take down specific content: repos connected to GreatFire, the group that mirrors censored sites and tools so people in China can get around the Great Firewall, plus a mirror of the Chinese-language New York Times. The traffic was apparently getting routed through ad networks and analytics scripts on totally unrelated sites, so regular visitors browsing something completely normal ended up unknowingly sending requests at GitHub's servers. That part's the bit that sticks with me. You didn't have to be doing anything wrong, or even know GitHub existed, to be part of the problem.
I don't have anything smart to say about the geopolitics of it. What I keep coming back to instead is how much I, personally, have let one company become load-bearing infrastructure for basically everything I do. Not just code. My dotfiles live there. My notes-to-self repo lives there. A truly embarrassing number of half-finished projects live there, judging me quietly. When GitHub gets slow, my whole workflow gets slow, and I don't have a real backup plan beyond "wait." I've been meaning to set up a local bare repo I push to as well, just so pushing isn't a single point of failure, and this week finally pushed me (pun regrettably intended) to actually do it. Took about ten minutes. Should've done it two years ago.
The other thing worth saying is that GitHub handled the communication part of this pretty well. They were posting updates through the whole thing instead of going quiet, which is the opposite of what a lot of companies do when something's actively on fire. I complain plenty about status pages that say "investigating" for six hours straight and tell you nothing, but this wasn't that — the updates had actual detail in them, timestamps, what they thought was happening. Small thing, but it matters when you're trying to decide whether to keep retrying a push or just go make coffee and come back in twenty minutes.
By this weekend things seemed mostly back to normal for me — pushes going through fast again, no more hanging spinners. I don't know if the attack is fully over on their end or if they've just gotten better at absorbing it, but either way my repos are behaving.
One dumb side effect: I now have a new tiny paranoia where any time a git push takes more than about five seconds, my brain immediately goes "is it happening again" before landing on the much more boring explanation that my wifi is just bad, which, let's be honest, it usually is. My router is from 2012 and I keep saying I'll replace it and I keep not replacing it.
Anyway. Local backups now exist for the things I actually care about, which is a small, boring, overdue fix, but it's the kind of thing you only do after a week like this one instead of before it, the same way nobody backs up their laptop until the week after the one where they really should have.