Didn’t know this:
Shallow clones are awful. Run your own damn mirror if you’re going to do something nasty like that.
Shallow is the default/recommended in a lot of places though apparently:
Shallow wins the clone, every time, by 4-6x. Which is exactly why
actions/checkoutdefaults todepth=1, why GitLab CI shipsGIT_DEPTH=20, and why Vercel hard-codes--depth=2with no way to change it.https://bex.co/blog/2026/08/08/git-push-paas-shallow-vs-partial-clone-build-checkout
Separately, one source of the scraping:
welcome to the wonderful world of “proxy SDK monetization.” It’s big business, and your TV is probably doing it.
The link in the article is useful, https://spur.us/blog/smart-tv-apps-residential-proxy-sdks
Amazon makes it explicit: its Device and System Abuse Policy prohibits apps that facilitate proxy services for third parties. Roku has reportedly shut the door too: Lowpass, syndicated at The Verge, reported that Roku bars developers from using Bright SDK and similar proxy services, and that Roku apps using the SDK disappeared after the company was contacted.
LG and Samsung have not drawn an equivalent public line. That is the gap these apps are living in. The same business model that Amazon bans and Roku reportedly blocks is still showing up at scale on webOS and Tizen.
It concludes:
A TV app should not be able to quietly turn a living-room device into residential proxy infrastructure. Screensavers, games, clocks, and novelty apps can be boring, cheap, or ad-supported. If an app is going to monetize a household’s internet connection, the user should be clearly informed about what that means, how the connection will be used, and what risks and tradeoffs they are accepting.
We need to help everyone in the world block their TVs from doing this, this is such an abuse of trust.
The part that got me is a single fork turning into billions of valid URLs, because every commit, diff and plain render is its own page. I run a small Gitea behind Nginx Proxy Manager, and a forge is exactly the kind of app where that math applies even at hobby scale. This has me checking whether anonymous visitors need the commit and diff views at all, or whether putting the web UI behind a login would cost me anything. Clones over git would still work for anyone who actually wants the code.
Once the VC money runs out it will be less of an issue
In the meantime we are screwed
Should be cross-posted to fuck_ai@lemmy.world too!
I’d prefer a new post there over a cross-post from here, personally.
Where do you see the difference?
Client dependent as to whether it shows the community its cross posted from.
Mostly because that crowd likes to come in and downvote anything they notice ai-related in any way, shape, or form, or they post comments I’ll need to remove. Despite tags being added so they could choose to filter those posts out instead.
Its less about the post and more about the general behavior of some people in that comm.
