6 ms·

Indeed. As an end user who browses behind Tor frequently Just Because, this is actually welcome news. Solving captchas to access sci-hub was a frequent pain poi

Indeed. As an end user who browses behind Tor frequently Just Because, this is actually welcome news. Solving captchas to access sci-hub was a frequent pain point. As a developer, I'm willing to try and help sci-hub secure their network against DDoS or other malicious traffic, assuming this was their reason for using Cloudflare services, and assuming sci-hub were to open source some of this effort publicly.

jerheinze 9y ago
> As an end user who browses behind Tor frequently Just Because, this is actually welcome news. Solving captchas to access sci-hub was a frequent pain point. When using Tor you had the possibility of using captcha-free SciHub with their own onion service: http://scihub22266oqcxt.onion/ http://scihub22266oqcxt.onion/ (it's down for now)
- drvdevd 9y ago
  Yes it appears, AFAICT, that has been down for quite a while. In fact I’ve never gotten the onion service to load. I’m assuming malicious traffic at some point.
- thecodeboy 9y ago
  You can access Sci-Hub at https://5ly.me/scihub https://5ly.me/scihub .
Kalium 9y ago
Your heart is in the right place. Freedom of information, and access to it, is a critical human right. There is, however, a possible catch. As a developer, there's a sharp limit to what can be done purely in server-side software to mitigate a DDoS attack. Some classes of attack rely on particular kinds of server-side vulnerabilities, and against these your skills are very valuable! I'm sure your contributions of skill would be most welcome. But against pure bandwidth-flooding attacks, it's more likely that writing more code is of at best marginal benefit. The state of the art for responding to these requires a big network, a lot of bandwith, and active management. Things difficult to deliver as a lone developer who cares deeply.
- drvdevd 9y ago
  Oh I absolutely agree. Which is why I specified that it should be an open source project. And I wasn’t thinking so much server side code to protect against DDoS but orchestration scripts and test suites to help create some form of redundancy offering some level of resilience.
  - richardwhiuk 9y ago
    The source code is relatively uninteresting. The power of cloudflare is in having the servers.....
  - Kalium 9y ago
    richardwhiuk completely nailed it. Orchestration scripts and test suites are of minimal value here. They already exist for pretty much every configuration you might need, and already in open source ways. Open sourcing the tools is of very little value in meeting the needs of a site like SciHub in protecting itself from DDoS attacks. What's actually needed is servers and bandwidth. Which is to say your heart is in the right place. You have the right ideas, and it's wonderful how much you care! It's just possible that the need at hand might be other than a maximal fit for your skills. I hope this conversation has been as educational for you as it has for me, and thank you for the opportunity to engage!
- softawre 9y ago
  Just want to say that your style of argument has me in awe. It's feels close to the patronizing line, but it's obviously not. I think you just assume the best from people and I really like that.
  - Kalium 9y ago
    Thank you. I appreciate that. Mostly I assume people mean well but suggest silly things because they're ignorant. Reading Dale Carnegie taught me that you have to tell people they're right and stroke their egos a bit before you can imply that they might have the wonderful opportunity to become more right. It's honestly exhausting to implement. It's a lot of hoops to jump through to tell someone that they don't actually understand what they're talking about. However... most people do not typically respond well to being flatly told they're wrong. Explaining how and why they are wrong does not generally improve matters, as people usually stop honestly listening as soon as they hear "You're wrong". As you say, it does run the risk of coming off as patronizing. It's hard to avoid that entirely, as different people sometimes have drastically different standards.

jerheinze 9y ago

> As an end user who browses behind Tor frequently Just Because, this is actually welcome news. Solving captchas to access sci-hub was a frequent pain point. When using Tor you had the possibility of using captcha-free SciHub with their own onion service: http://scihub22266oqcxt.onion/ http://scihub22266oqcxt.onion/ (it's down for now)

drvdevd 9y ago
Yes it appears, AFAICT, that has been down for quite a while. In fact I’ve never gotten the onion service to load. I’m assuming malicious traffic at some point.
thecodeboy 9y ago
You can access Sci-Hub at https://5ly.me/scihub https://5ly.me/scihub .

Kalium 9y ago

Your heart is in the right place. Freedom of information, and access to it, is a critical human right. There is, however, a possible catch. As a developer, there's a sharp limit to what can be done purely in server-side software to mitigate a DDoS attack. Some classes of attack rely on particular kinds of server-side vulnerabilities, and against these your skills are very valuable! I'm sure your contributions of skill would be most welcome. But against pure bandwidth-flooding attacks, it's more likely that writing more code is of at best marginal benefit. The state of the art for responding to these requires a big network, a lot of bandwith, and active management. Things difficult to deliver as a lone developer who cares deeply.

drvdevd 9y ago
Oh I absolutely agree. Which is why I specified that it should be an open source project. And I wasn’t thinking so much server side code to protect against DDoS but orchestration scripts and test suites to help create some form of redundancy offering some level of resilience.
- richardwhiuk 9y ago
  The source code is relatively uninteresting. The power of cloudflare is in having the servers.....
- Kalium 9y ago
  richardwhiuk completely nailed it. Orchestration scripts and test suites are of minimal value here. They already exist for pretty much every configuration you might need, and already in open source ways. Open sourcing the tools is of very little value in meeting the needs of a site like SciHub in protecting itself from DDoS attacks. What's actually needed is servers and bandwidth. Which is to say your heart is in the right place. You have the right ideas, and it's wonderful how much you care! It's just possible that the need at hand might be other than a maximal fit for your skills. I hope this conversation has been as educational for you as it has for me, and thank you for the opportunity to engage!
softawre 9y ago
Just want to say that your style of argument has me in awe. It's feels close to the patronizing line, but it's obviously not. I think you just assume the best from people and I really like that.
- Kalium 9y ago
  Thank you. I appreciate that. Mostly I assume people mean well but suggest silly things because they're ignorant. Reading Dale Carnegie taught me that you have to tell people they're right and stroke their egos a bit before you can imply that they might have the wonderful opportunity to become more right. It's honestly exhausting to implement. It's a lot of hoops to jump through to tell someone that they don't actually understand what they're talking about. However... most people do not typically respond well to being flatly told they're wrong. Explaining how and why they are wrong does not generally improve matters, as people usually stop honestly listening as soon as they hear "You're wrong". As you say, it does run the risk of coming off as patronizing. It's hard to avoid that entirely, as different people sometimes have drastically different standards.