Re: /repos/ mirror

<<On Wed, 15 Jul 2026 15:36:53 -0400, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> said:

> Garrett Wollman <wollman(at)csail(dot)mit(dot)edu> writes:
>> Over the past few months, our mirror server has been the subject of an
>> apparent DDoS. Today I tracked it down to millions of attempted
>> downloads from `http://postgres.csail.mit.edu/repos/` and I have
>> configured the server to return a 403 error for that part of the site;
>> we are happy to provide a mirror service for humans to use but we did
>> not sign up for 720,000 (and counting) random Linux machines around
>> the world to abuse our server and interfere with our own local access
>> to the archives.

> That is very strange. What did you have stored there --- was it a
> mirror of our source code, or executables, or ???

It is -- or I guess was, I had not realized that the rsync was
commented out -- a mirror of rsync.postgresql.org::pgsql-ftp. Now
that I've learned that the mirror hasn't been updated in at least a
year, I'm going to completely unconfigure it.

We're up to 930,000 unique IPs banging on this so far today.

> I can assure you that the Postgres project didn't do that nor
> encourage anyone else to do so. I'm kind of mystified why anyone
> would have chosen csail as a source for our stuff, though.

Thanks for that.

-GAWollman