Bug#1134366: www.debian.org: packages.debian.org requires javascript

Helge Kreutzmann <[email protected]> Tue, 21 Apr 2026 14:45:19 +0000

Newsgroups	gmane.linux.debian.devel.www
Message-ID	<aeeNf-nOdpjIpf2E__8748.65582897968$1776782852$gmane$org@meinfjell.helgefjelltest.de>

Hello Holger,
Am Mon, Apr 20, 2026 at 10:15:31PM +0200 schrieb Holger Wansing:
> Am 20. April 2026 18:23:28 MESZ schrieb Helge Kreutzmann <[email protected]>:
> >
> >Do you have some anti-DDOS or rate-limiting in place for debian.org?
> 
> I noticed that packages.d.o is somewhat unstable sometimes (I remember error messages like "no healthy backend available" or similar).
> Not sure what to do against this though (or if this has already been addressed?).
> 
> Since several weeks (months?) Debian uses some mechanism to deal with issues like
> <https://thelibre.news/foss-infrastructure-is-under-attack-by-ai-companies/>
> Maybe this is your problem?
> I was unable to find the name of the tool, though...

Yes, I'm assuming we are running into such kind of tools[1]. Maybe you can
forward to a person running / operating this tool from the Debian
side, maybe some kind of "cookie" or such could allow access for
legitimate users.

> >> Are you sure, these scripts are accessing packages.debian.org? I guess not.
> >
> >You are guessing wrong.
> >If you look at the script, the core call is:
> >wget --quiet -O - "http://packages.debian.org/sid/amd64/$package/download"
> >
> >where $package stores the Debian package in question (the script
> >iterates over all supported packages).
> 
> Hmm, I wonder if packages.d.o is the best service to use for such script runs.
> Wouldn't it be more reasonable to pull the packages from a mirror?

We pull the actual packages from a mirror, this call just is the
beginning of the extraction of the package version, then the script
automatically builds the download link from a mirror, and that part
(the actual download) did not show any problems so far.

(And before you ask - I'm upstream in this role, my co-maintainer does
not use Debian and runs these scripts as well, so local data is not
possible).

> That way, you would not rely on a single service/machine; using deb.debian.org would allow to use the CDN (content delivery network) service with its built-in capabilities, to use the best available mirror, or skip a mirror if it's down and choose another one automatically...
> And load-balancing (on the mirror side) would also be included.

Currently the mirror is hard coded, as this did not cause any
problems yet. If so, we could make it dynamic, but since the sript
only runs maybe once or twice a month, this did not cause any concerns
on our side yet.

Thanks

Greetings

               Helge

[1] Actually, for some sites I see a short "verified" when reloading,
    but I'm not sure I saw this on p.d.o.

-- 
      Dr. Helge Kreutzmann                     [email protected]
           Dipl.-Phys.                   http://www.helgefjell.de/debian.php
        64bit GNU powered                     gpg signed mail preferred
           Help keep free software "libre": http://www.ffii.de/

signature.asc (application/pgp-signature, 833 B)