Didn’t know this:

Shallow clones are awful. Run your own damn mirror if you’re going to do something nasty like that.

Shallow is the default/recommended in a lot of places though apparently:

Shallow wins the clone, every time, by 4-6x. Which is exactly why actions/checkout defaults to depth=1, why GitLab CI ships GIT_DEPTH=20, and why Vercel hard-codes --depth=2 with no way to change it.

https://bex.co/blog/2026/08/08/git-push-paas-shallow-vs-partial-clone-build-checkout

Separately, one source of the scraping:

welcome to the wonderful world of “proxy SDK monetization.” It’s big business, and your TV is probably doing it.

The link in the article is useful, https://spur.us/blog/smart-tv-apps-residential-proxy-sdks

Amazon makes it explicit: its Device and System Abuse Policy prohibits apps that facilitate proxy services for third parties. Roku has reportedly shut the door too: Lowpass, syndicated at The Verge, reported that Roku bars developers from using Bright SDK and similar proxy services, and that Roku apps using the SDK disappeared after the company was contacted.

LG and Samsung have not drawn an equivalent public line. That is the gap these apps are living in. The same business model that Amazon bans and Roku reportedly blocks is still showing up at scale on webOS and Tizen.

It concludes:

A TV app should not be able to quietly turn a living-room device into residential proxy infrastructure. Screensavers, games, clocks, and novelty apps can be boring, cheap, or ad-supported. If an app is going to monetize a household’s internet connection, the user should be clearly informed about what that means, how the connection will be used, and what risks and tradeoffs they are accepting.

We need to help everyone in the world block their TVs from doing this, this is such an abuse of trust.

The part that got me is a single fork turning into billions of valid URLs, because every commit, diff and plain render is its own page. I run a small Gitea behind Nginx Proxy Manager, and a forge is exactly the kind of app where that math applies even at hobby scale. This has me checking whether anonymous visitors need the commit and diff views at all, or whether putting the web UI behind a login would cost me anything. Clones over git would still work for anyone who actually wants the code.

Once the VC money runs out it will be less of an issue

In the meantime we are screwed

Should be cross-posted to fuck_ai@lemmy.world too!