Package Management Nerd, working on mapping the world of open source software https://ecosyste.ms and blogging about package managers at https://nesbitt.io
Unexpected use case for https://github.com/git-pkgs/proxy - putting it in front of their Artifactory.
I suspect people are using it for edge fan-out without actually paying for Artifactory Edge nodes.
github.com/git-pkgs/proxy
GitHubGitHub - git-pkgs/proxy: A lightweight caching proxy for package registries.A lightweight caching proxy for package registries. - git-pkgs/proxyReplying to @voxpelli.com@bsky.brid.gy
@voxpelli.com ugh the ai language throughout that page, did the author even read it before publishing? looks like a level 4 to me, not a level 3
https://github.com/chaoss/disclosure is proving to be a very useful tool in analysing disclosure of ai contributions to oss projects.
GitHubGitHub - chaoss/disclosure: Github Action to gather signals of disclosed AI contribution to aid community health monitoring tools and open source maintainersGithub Action to gather signals of disclosed AI contribution to aid community health monitoring tools and open source maintainers - chaoss/disclosurebrew install actions/checkout - Using Homebrew's tap machinery as a curated distribution layer for GitHub Actions.
https://nesbitt.io/2026/08/04/brew-install-actions-checkout.html
Andrew Nesbittbrew install actions/checkoutUsing Homebrew’s tap machinery as a curated distribution layer for GitHub Actions.@petko it's protecting the database and rails apps a bit, doesn't seem to actually stop the scrapers trying though.
Replying to @andrewnez@mastodon.social
Also if you're adding cache busting url parameters to api requests to try and get fresher results, I'm just going to block you, don't do that.
Replying to @omkar_foss@mastodon.social
@omkar_foss can you give https://repos.ecosyste.ms/hosts/GitHub another try?
repos.ecosyste.ms/hosts/GitHubReplying to @omkar_foss@mastodon.social
@omkar_foss that one seems unreliable, i will investigate
Replying to @omkar_foss@mastodon.social
@omkar_foss yeah that page is just broken, it tries to paginate through 292m repo records
Curl had it's summer of bliss, @ecosystems is having it's Summer of Piss (taking) by security companies hammering the public api and ignoring the data license.
Replying to @bagder@mastodon.social
@bagder nope, i just have a free cloudflare account.
Replying to @andrewnez@mastodon.social
Anubis upgraded to 1.26.2 and difficulty level increased.
Also found some new security companies heavily scraping, I look forward to seeing whatever they produce with this CC-BY-SA data that I'm sure they will follow the license of and republish their findings under the same license.
RE: https://mastodon.social/@andrewnez/117032582823441702
Investigating this today, looks like there's a new residential proxy scraping the html of the various ecosyste.ms services, not the json api.
Useragent is all last years chrome on desktop mac, all executing js and passing anubis, see if I can make some tweaks to that config to shut it down.
Andrew Nesbitt@andrewnez@mastodon.social92m requests to @ecosystems so far today, the biggest single day I've ever seen 🫠
Replying to @muan@mastodon.social
@muan battery life is really bad
Replying to @andrewnez@mastodon.social
It’s now up to 101m 🫣
92m requests to @ecosystems so far today, the biggest single day I've ever seen 🫠
Paraphrasing an email from a security company : We copied one of your blog posts and turned into an advert for one of our products. Please add a link to our blog post to the end of yours. 🥉
This Week in Package Management: 1 August 2026
https://nesbitt.io/2026/08/01/this-week-in-package-management.html
Andrew NesbittThis Week in Package Management: 1 August 2026Releases, advisories, and articles from across the package management worldReplying to @wolf480pl@mstdn.io
@wolf480pl yep!