Re: thoughts on a Merge Request based development workflow

[Han-Wen Nienhuys <hanwen@google.com>]

On Tue, Oct 15, 2019 at 9:41 PM Konstantin Ryabitsev
<konstantin@linuxfoundation.org> wrote:
> >> 1. A gerrit instance would introduce a single source of failure, which
> >>    is something many see as undesirable. If there's a DoS attack, Google
> >>    can restrict access to their Gerrit server to limit the requests to
> >>    only come from their corporate IP ranges, but kernel.org cannot do
> >>    the same, so anyone relying on gerrit.kernel.org cannot do any work
> >>    while it is unavailable.
> >
> >I don't understand your scenario. Are you concerned that Google would
> >protect DoS attacks by limiting traffic to the corp network?
> >
> >Or are you concerned that kernel.org has no DoS protection?
>
> Kernel.org operates on a pretty small budget, largely using
> infrastructure donated by kind entities. If it suddenly becomes a
> liability, I'm sure those entities will kick us out. A large, sustained
> DoS attack would be one such liability, and due to the nature of git, we
> can't really hide behind cloudfront or any other DoS-mitigation
> platforms.
>
> If a DoS attack is waged against Google's gerrit server, they can drop
> the packets at the perimeter and still keep the service available to
> Google engineers coming from internally routed traffic. This is not an
> option for kernel.org, so a DoS attack against a central resource would
> be super effective in stopping all work on Linux.

This isn't how DOS mitigation works. Gerrit uses the same DOS
mitigation as www.google.com, and we don't drop external search
traffic when things get bad.

If we can be behind a DOS protection service, kernel.org could also
be, but I think it would require using the HTTPS protocol rather than
SSH or anonymous git.

> >How does DoS protection for kernel.org work today? If someone DoSes
> >git.kernel.org with its 1000s of git trees, how do people get work
> >done?
>
> The git trees on kernel.org are just convenient copies. Most kernel
> development is done via mailing patches, which is a distributed and
> DoS-resistant process. The only time git.kernel.org enters into the
> picture is when people need to send a pull request to Linus (via email).
> If kernel.org is out for an extended period of time, they would just
> push their repo elsewhere and send a pull request referencing the new
> URL. Since Linus checks PGP signatures when pulling remotes, the
> repository can be hosted anywhere at all without needing to trust the
> infrastructure.
>
> With gerrit, if gerrit.kernel.org is down, then everything grinds to a
> halt. If it's down for an extended period of time, then in theory people
> can push their git trees elsewhere, but then they would have to
> force-push back to gerrit once it's back up.

We ourselves are not worried about downtime because our deployment was
designed to be 24x7 from the start. Our corporate overlords (large
projects such as Chrome and Android) do not accept any downtime. I
would be happy and proud to host the Linux kernel development on the
same infrastructure, which would give you hosting without downtime.
However, if there is consensus that there can't be a centralized
infrastructure of any sort, then that isn't going to work, obviously.

> >> 3. There is no email bridge, only notifications. Switching to gerrit
> >>    would require a flag-day when everyone must start using it (or stop
> >>    participating in kernel development).
> >
> >Gerrit sends out email for comments. If you reply to that email,
> >Gerrit ingests the comment and puts it in the review.
>
> Ah, okay, I guess we've never configured it that way. But you can't
> +1/+2/Merge anything using this mechanism, right? Otherwise that would
> be a backchannel around authentication. :)

it doesn't allow voting exactly for the reason you mention.

-- 
Han-Wen Nienhuys - Google Munich
I work 80%. Don't expect answers from me on Fridays.
--

Google Germany GmbH, Erika-Mann-Strasse 33, 80636 Munich

Registergericht und -nummer: Hamburg, HRB 86891

Sitz der Gesellschaft: Hamburg

Geschäftsführer: Paul Manicle, Halimah DeLaine Prado