4 ms·

Isn't that literally a DOS attack?

grardb 5y ago
I'm not sure that "hundreds of requests per hour" meets the criteria for a DDOS. Assuming 999 requests per hour, that's about one request every four seconds, which the vast majority of websites should be able to handle with no trouble at all.
- simiones 5y ago
  DoS is different from DDoS. A DoS attack is any kind of attack in which the attacker seeks not to gain access to a system, but to simply deny others access. This can include sending large payloads, maintaining idle connections, causing crashes, logging out other users etc. A DDoS is a particular kind of DoS attack - one in which the attack is conducted using a distributed set of machines, usually helping to (a) hide the attack from monitoring tools and (b) make it hard to block using IPs. Obviously this was not a DDoS, but could have looked like a plain DoS. The definition of a DoS attack depends on the system being attacked, there is no hard and fast limit to how much traffic a system is supposed to handle. For a badly written system like the one described here, the actions of the scraper were indistinguishable from the point of view of the library from the actions of a malicious actor. Hopefully, since the intent was not malicious in this case, thing may have been cleared up - though of course it's also possible that, unfortunately, they haven't.
  - philipov 5y ago
    > A DoS attack is any kind of attack in which the attacker seeks not to gain access to a system, but to simply deny others access. By your own definition, it was not a DoS attack, because the subject was not seeking to deny others access. And without the intent to do harm, one may not genuinely identify the incident as an attack. Requiring intent is an important part of your definition, as it protects innocent users of a buggy system from being classified as attackers whenever any downtime incident occurs.
    - simiones 5y ago
      Sure, but that's something that needs to be investigated by a court of law, it's not something you can automatically know as a system operator. The ideal thing in this case may have been for the police to investigate, to conclude that the DoS was not done with malicious intent; but also to instruct the scraper that any further attempts to scrape the system in a this way will be considered malicious.
theshrike79 5y ago
"Hundreds per hour" is hardly a denial of service. If we assume the very high end of "hundreds", 900, it's still 15 requests per minute. Your system is a disgrace if it can't handle that kind of traffic. This incident was in 2010 so even that is not an excuse.
- simiones 5y ago
  Both things can be true: the system probably was a disgrace, but also the scraper did, by definition, deny service - so it was a kind of accidental Denial of Service attack. Hopefully, given the intention and so on, in a good legal system this wouldn't be treated the same as a malicious DoS; but also the scraper shouldn't be used, as it denies service to other potential clients.
- dahfizz 5y ago
  If the request load is high enough to bring down the system, it is literally a Denial Of Service. Website admins don't owe you anything. If their website sucks, it sucks. That doesn't give you the right to take down their system.
oauea 5y ago
My website crashes as soon as it is visited. Don't visit it, or you will be arrested for DoSing my site.
hamasho 5y ago
I understand that some websites are poorly implemented and can't handle hundreds of requests. IANAL, but AFAIK whether it's a DOS attack or not partially depends on the scraper's intent. In this case, after volunteer engineers invested in their system, it turned out that they created a DB connection after each request, maintained it for 10 mins, and didn't reuse it or close it. So the number of DB connections quickly reached its limitation and couldn't handle the following requests. Similar problems happened with other library systems developed by the same company. The prosecutors dropped the charge citing his scraping was reasonable, and he didn't have any malicious intent.

I'm not sure that "hundreds of requests per hour" meets the criteria for a DDOS. Assuming 999 requests per hour, that's about one request every four seconds, which the vast majority of websites should be able to handle with no trouble at all.

simiones 5y ago
DoS is different from DDoS. A DoS attack is any kind of attack in which the attacker seeks not to gain access to a system, but to simply deny others access. This can include sending large payloads, maintaining idle connections, causing crashes, logging out other users etc. A DDoS is a particular kind of DoS attack - one in which the attack is conducted using a distributed set of machines, usually helping to (a) hide the attack from monitoring tools and (b) make it hard to block using IPs. Obviously this was not a DDoS, but could have looked like a plain DoS. The definition of a DoS attack depends on the system being attacked, there is no hard and fast limit to how much traffic a system is supposed to handle. For a badly written system like the one described here, the actions of the scraper were indistinguishable from the point of view of the library from the actions of a malicious actor. Hopefully, since the intent was not malicious in this case, thing may have been cleared up - though of course it's also possible that, unfortunately, they haven't.
- philipov 5y ago
  > A DoS attack is any kind of attack in which the attacker seeks not to gain access to a system, but to simply deny others access. By your own definition, it was not a DoS attack, because the subject was not seeking to deny others access. And without the intent to do harm, one may not genuinely identify the incident as an attack. Requiring intent is an important part of your definition, as it protects innocent users of a buggy system from being classified as attackers whenever any downtime incident occurs.
  - simiones 5y ago
    Sure, but that's something that needs to be investigated by a court of law, it's not something you can automatically know as a system operator. The ideal thing in this case may have been for the police to investigate, to conclude that the DoS was not done with malicious intent; but also to instruct the scraper that any further attempts to scrape the system in a this way will be considered malicious.

theshrike79 5y ago

"Hundreds per hour" is hardly a denial of service. If we assume the very high end of "hundreds", 900, it's still 15 requests per minute. Your system is a disgrace if it can't handle that kind of traffic. This incident was in 2010 so even that is not an excuse.

simiones 5y ago
Both things can be true: the system probably was a disgrace, but also the scraper did, by definition, deny service - so it was a kind of accidental Denial of Service attack. Hopefully, given the intention and so on, in a good legal system this wouldn't be treated the same as a malicious DoS; but also the scraper shouldn't be used, as it denies service to other potential clients.
dahfizz 5y ago
If the request load is high enough to bring down the system, it is literally a Denial Of Service. Website admins don't owe you anything. If their website sucks, it sucks. That doesn't give you the right to take down their system.

oauea 5y ago

My website crashes as soon as it is visited. Don't visit it, or you will be arrested for DoSing my site.

hamasho 5y ago

I understand that some websites are poorly implemented and can't handle hundreds of requests. IANAL, but AFAIK whether it's a DOS attack or not partially depends on the scraper's intent. In this case, after volunteer engineers invested in their system, it turned out that they created a DB connection after each request, maintained it for 10 mins, and didn't reuse it or close it. So the number of DB connections quickly reached its limitation and couldn't handle the following requests. Similar problems happened with other library systems developed by the same company. The prosecutors dropped the charge citing his scraping was reasonable, and he didn't have any malicious intent.