> I would assume they primarily serve static files that can be on a cdn

And someone gotta pay that CDN bill too.

On top of that come all the requests from CI pipelines that don't have a repository proxy at all or have it misconfigured, the AI scrapers and other bots, or DDoS skiddies wanting to take responsibility for taking down a major hoster.

▲

stickfigure 4 hours ago | parent [-]

I don't know what Cloudflare's economics are like, but R2 egress is free. You pay for storage and $0.36/million for cache misses, which should be a fairly small percentage.

If I had to build a public artifact repository today, that's what I would use. Apparently Maven Central is built on S3 and Fastly. We don't know the terms, but I'm guessing that is more expensive.

	▲	eastbound 3 hours ago \| parent [-]
		Hey, what if we had a Maven tax if our repo was in Java, and an NPM tax for repos in NPM, for a centrally-managed repo with vulnerability checks?