Garrett Wollman <wollman@csail.mit.edu> writes:
> On Wed, 15 Jul 2026 15:36:53 -0400, Tom Lane <tgl@sss.pgh.pa.us> said:
>> That is very strange. What did you have stored there --- was it a
>> mirror of our source code, or executables, or ???
> It is -- or I guess was, I had not realized that the rsync was
> commented out -- a mirror of rsync.postgresql.org::pgsql-ftp.
Yeah, we shut down rsync support last year [1]. Sounds like somebody
disabled the rsync at your end as a band-aid, and never went back
to fix it properly.
> Now that I've learned that the mirror hasn't been updated in at least a
> year, I'm going to completely unconfigure it.
Agreed; evidently nobody legitimate was using it, or they'd have
complained about it being out of date.
> We're up to 930,000 unique IPs banging on this so far today.
Wow. I'd have to agree that that's a DDoS attempt, hard to see
a legitimate reason for pulling so many copies of PG source code.
regards, tom lane
[1] https://www.postgresql.org/message-id/CA+OCxoz3p4LqyE4aNb3M8gs2GND25ET=EMQ-KSrZ+B1WRSdT4Q@mail.gmail.com
