10 ms·
Yeah I know. That is a legit critique. What's been happening is your essential black swan event. I've been running the service for 12 years and have never had t
by geuis 3y ago
Yeah I know. That is a legit critique. What's been happening is your essential black swan event. I've been running the service for 12 years and have never had this problem. There are hundreds of websites and independent users that have never abused the api like this until March. I have always been able to absorb the traffic impact.
This is different. Someone wasn't thinking and randomly added the domain to a lazy piece of code somewhere that got deployed to millions of devices pretty much over night. The only way I've been able to keep jsonip active is by incorporating Cloudflare. But they don't actually solve the problem. As a corporation, they treat ipv4 addresses like 3rd class citizens.
Anyway yeah I've been evaluating changing the TOS, requiring registered signins, etc. But NONE of those fixes a 300% level of traffic that's been hitting the service for months now. I can change the verbiage all I want. But it does absolutely nothing to stop the a-hole dev from China or wherever that rolled out an update to hundreds of thousands of millions of devices with simply emailing me if that's ok.
I've literally, and successfully, run the service for free to the public because no one has done this before.
And to the nginx people. No, returning 444 doesn't seem to fix the problem. I've tried. It doesn't work.
- bierjunge 3y agoUnethical tip: start returning the content of this article [0] to these devices. The Chinese government will "fix" the devs for you or simply block all traffic to your site. [0] https://en.wikipedia.org/wiki/1989_Tiananmen_Square_protests_and_massacre https://en.wikipedia.org/wiki/1989_Tiananmen_Square_protests...
- pabs3 3y agoOr geolocate Chinese IPs to Taiwan.
- moffkalast 3y agoWhat a big brain move, that might actually work. Unless of course the devices are being sold abroad.
- wiseowise 3y agoHow’s that unethical? Love it.
- bierjunge 3y agoUnethical because it can get the devs into legal trouble and the Chinese government is known to be aggressive in their choice of "solutions".
- nitrammm 3y agoExplicitly telling some junior software developer in China that he can call an API for free an unlimited number of times, then afterwards calling it abuse and him and a-hole dev is definitively a bit of an a-hole thing to do in my view.
- wiseowise 3y agoIt says that you can call it unlimited number of times, not millions of devices that you’re selling.
- nitrammm 3y agoIt says: > Supports unlimited requests and is free. Typically "unlimited" is more than a million.
- wiseowise 3y agoWater in a lake is also technically free (depending on local laws), do I have to make it clear that inviting millions to take a cup out of it is not a good idea?
- nitrammm 3y agoThis is the internet? If there are a million people around the lake fond of tea then of course you need to tell them that they can't consume all the water. Offering a free service and being upset when people use it is just naive.
- KomoD 3y agoLast I checked unlimited is more than millions
- junon 3y agoThis mindset is why we need "do not use while sleeping" warning labels on toasters and hair dryers.
- CPLX 3y agoDo you have a way to donate?
- maccard 3y ago> The only way I've been able to keep jsonip active is by incorporating Cloudflare. But they don't actually solve the problem. As a corporation, they treat ipv4 addresses like 3rd class citizens. Don't get me wrong, you're doing the world a service with your service, but why should cloudflare have to handle your problem for free? If you want to resolve your problem, it sounds like it's in your hands - block traffic, or us something like cloudflare/waf. It's not fair that you have to eat the cost, but it's not fair that someone else does either.
- geuis 3y agoOh, I never expected Cloudflare to handle the problem for free. I would happily have at least a pro level account with them if they treated ipv4 traffic properly. But they don't expose a request's actual v4 address to the backend. The WAF works amazingly well, but it otherwise breaks a critical part of the service.
- ransackdev 3y ago> rolled out an update to hundreds of thousands of millions of devices with simply emailing me if that's ok. If it's malware, they don't care if it's ok, they are malware authors. Contact your hosting provider which 100% has the ability to offload traffic from malware and ddos. They are responsible for the network and will not want malicious traffic anywhere on it, esp if it's tying up bandwidth for paying customers or premium bandwidth. If it was a large amount of bandwidth they would have contacted you long before you contacted them. I'd still reach out, they will move on it quick if it's an issue, and at the least can examine the traffic to determine if it's bad or not. Cloudflare won't do much good here no? The requests still have to proxy back to your origin servers to spit back the ip. You can't utilize any caching on cloudflare due to the unique ip of each client. Their ddos prevention might not help because these are clients each with their own unique ip address, which is probably a cellular provider's ip space and not bad traffic. If it's the volume of clients hitting you, and not the volume of requests they make, it wouldn't trip cloudflare, or they'd be blocking major cellular address space across their entire network (which is a large portion of the internet these days)