3 ms·
It's powered by ElasticSearch, is it? So I can use all of its query parameters?
by kiettv 5y ago
It's powered by ElasticSearch, is it? So I can use all of its query parameters?
- alangibson 5y agoIndeed it is. You can you use simple query strings for the q parameter. See https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-simple-query-string-query.html https://www.elastic.co/guide/en/elasticsearch/reference/curr... I'm considering opening up full ES query support for paying customers, but it's too dangerous to expose it to the Internet unrestricted.
- rmbyrro 5y agoI think it's dangerous to expect a malicious actor would not pay $10 to screw your service.
- cj 5y ago"Risk management" is often not the same as "risk elimination"
- alangibson 5y agoIndeed it is. Presumably I would have had time to build up some safeguards and run beefier servers by then though.
- marginalia_nu 5y agoAs a word of warning, when HN discovered my search engine, I was hit hard by a botnet within a few days. Saw about 30-40k queries/hour from some 10k IP addresses. I'm self hosted so the worst that happened is my search engine was a bit slow, but if I was cloud hosted I'd have a very sizable bill to pay. If you do not already have a global rate limit, implement one ASAP. Better to have one and not need it, than to need it and not have it.
- alangibson 5y agoI can't wait for the bots to show up. Setting a rate limit was one of the first things I did :)
- kiettv 5y agoDo you have reversed proxy in front of your API like HA Proxy or Nginx, most of bots will hit you by IP only, so filter and reject request without domain will be eliminate most of them.
- marginalia_nu 5y agoThis was a directed attack, not some random drive-by.