3 ms·

I'm not sure that "hundreds of requests per hour" meets the criteria for a DDOS. Assuming 999 requests per hour, that's about one request every four seconds, wh

by grardb 4y ago

I'm not sure that "hundreds of requests per hour" meets the criteria for a DDOS. Assuming 999 requests per hour, that's about one request every four seconds, which the vast majority of websites should be able to handle with no trouble at all.

simiones 4y ago
DoS is different from DDoS. A DoS attack is any kind of attack in which the attacker seeks not to gain access to a system, but to simply deny others access. This can include sending large payloads, maintaining idle connections, causing crashes, logging out other users etc. A DDoS is a particular kind of DoS attack - one in which the attack is conducted using a distributed set of machines, usually helping to (a) hide the attack from monitoring tools and (b) make it hard to block using IPs. Obviously this was not a DDoS, but could have looked like a plain DoS. The definition of a DoS attack depends on the system being attacked, there is no hard and fast limit to how much traffic a system is supposed to handle. For a badly written system like the one described here, the actions of the scraper were indistinguishable from the point of view of the library from the actions of a malicious actor. Hopefully, since the intent was not malicious in this case, thing may have been cleared up - though of course it's also possible that, unfortunately, they haven't.
- philipov 4y ago
  > A DoS attack is any kind of attack in which the attacker seeks not to gain access to a system, but to simply deny others access. By your own definition, it was not a DoS attack, because the subject was not seeking to deny others access. And without the intent to do harm, one may not genuinely identify the incident as an attack. Requiring intent is an important part of your definition, as it protects innocent users of a buggy system from being classified as attackers whenever any downtime incident occurs.
  - simiones 4y ago
    Sure, but that's something that needs to be investigated by a court of law, it's not something you can automatically know as a system operator. The ideal thing in this case may have been for the police to investigate, to conclude that the DoS was not done with malicious intent; but also to instruct the scraper that any further attempts to scrape the system in a this way will be considered malicious.

by grardb 4y ago

simiones 4y ago

DoS is different from DDoS. A DoS attack is any kind of attack in which the attacker seeks not to gain access to a system, but to simply deny others access. This can include sending large payloads, maintaining idle connections, causing crashes, logging out other users etc. A DDoS is a particular kind of DoS attack - one in which the attack is conducted using a distributed set of machines, usually helping to (a) hide the attack from monitoring tools and (b) make it hard to block using IPs. Obviously this was not a DDoS, but could have looked like a plain DoS. The definition of a DoS attack depends on the system being attacked, there is no hard and fast limit to how much traffic a system is supposed to handle. For a badly written system like the one described here, the actions of the scraper were indistinguishable from the point of view of the library from the actions of a malicious actor. Hopefully, since the intent was not malicious in this case, thing may have been cleared up - though of course it's also possible that, unfortunately, they haven't.

philipov 4y ago
> A DoS attack is any kind of attack in which the attacker seeks not to gain access to a system, but to simply deny others access. By your own definition, it was not a DoS attack, because the subject was not seeking to deny others access. And without the intent to do harm, one may not genuinely identify the incident as an attack. Requiring intent is an important part of your definition, as it protects innocent users of a buggy system from being classified as attackers whenever any downtime incident occurs.
- simiones 4y ago
  Sure, but that's something that needs to be investigated by a court of law, it's not something you can automatically know as a system operator. The ideal thing in this case may have been for the police to investigate, to conclude that the DoS was not done with malicious intent; but also to instruct the scraper that any further attempts to scrape the system in a this way will be considered malicious.