3 ms·

This is a great trick for a lot of things. For example, if a web server is getting lots of attacks against a particular URL, one could block that URL or otherwi

This is a great trick for a lot of things. For example, if a web server is getting lots of attacks against a particular URL, one could block that URL or otherwise make it inaccessible. That'll turn it into a 404 or 500, or whatever. But it turns out that a 200 is much faster, and so replacing the target with a blank file is faster than denying it. This is particularly true with xml-rpc.php. Instead of just removing it, empty it. Problem solved.

yabones 5y ago
204 is the fastest, since it is exactly zero bytes of content. For most webservers you don't even need to point it at a specific file, just say "return 204" and that's enough. I've done this numerous times to "whitehole" bad scanners or bots with great success :)
ketralnis 5y ago
What does it mean for a 200 to be faster? I guess I can see some framework or CDN reasons that might be so but it doesn’t feel like an inherent thing
- CaliforniaKarl 5y ago
  Imagine if you have a site that displays some sort of custom content when a client is hitting a 404 error. Even if it’s just a static page, the web browser still has to follow the code path and open it. Even if it caches the page internally, it still has to regularly check if the file updated on disk. The amount of time spent by the web browser is fairly small, but the parent comment mentioned it in context of an attack, so that small per-page effort multiplied by many connections makes for more of a substantial load.
  - Karellen 5y ago
    But why can't you just return a 404 with no content instead of a 200 with no content?
    - geocrasher 5y ago
      You can, but many CMSs (WordPress specifically) do not. They serve a dynamic page.
      - deleted 5y ago
        [deleted]
  - jameshart 5y ago
    In the case of an attack, you don’t care about how much effort the web browser would have to make, only the web server. In fact, instead of serving a malicious client a 200 empty file, you might want to serve up <script>while(1){}</script> .

yabones 5y ago

204 is the fastest, since it is exactly zero bytes of content. For most webservers you don't even need to point it at a specific file, just say "return 204" and that's enough. I've done this numerous times to "whitehole" bad scanners or bots with great success :)

ketralnis 5y ago

What does it mean for a 200 to be faster? I guess I can see some framework or CDN reasons that might be so but it doesn’t feel like an inherent thing

CaliforniaKarl 5y ago
Imagine if you have a site that displays some sort of custom content when a client is hitting a 404 error. Even if it’s just a static page, the web browser still has to follow the code path and open it. Even if it caches the page internally, it still has to regularly check if the file updated on disk. The amount of time spent by the web browser is fairly small, but the parent comment mentioned it in context of an attack, so that small per-page effort multiplied by many connections makes for more of a substantial load.
- Karellen 5y ago
  But why can't you just return a 404 with no content instead of a 200 with no content?
  - geocrasher 5y ago
    You can, but many CMSs (WordPress specifically) do not. They serve a dynamic page.
    - deleted 5y ago
      [deleted]
- jameshart 5y ago
  In the case of an attack, you don’t care about how much effort the web browser would have to make, only the web server. In fact, instead of serving a malicious client a 200 empty file, you might want to serve up <script>while(1){}</script> .