4 ms·
A million password resets is shockingly low for a DDOS, could this have been an university assignment gone wrong? I can imagine some clueless dean ordering all
by KRAKRISMOTT 3y ago
A million password resets is shockingly low for a DDOS, could this have been an university assignment gone wrong? I can imagine some clueless dean ordering all their engineering grads to submit research to arXiv. If they have 100-200K students, a single poorly written script to link the institution's SSO with automatically created arXiv accounts could easily overwhelm the system.
- bagels 3y agoWhat school has 200k engineering students?
- regularfry 3y ago"poorly written" could easily remove the "engineering" qualifier.
- mousetree 3y agoThey would also have to be in the same class and all running their code at the same time.
- cbf66 3y agoIt was from about 10 accounts. Which we suspended. But it appears that they created new accounts overnight (daytime in China). arXiv is not well-equipped to play whack-a-mole. And 10 accounts using 100 different IP addresses, would seem unlikely for an innocent project. And creating new accounts ...
- deathlock 3y agoCan you set a restriction so that each user cannot change the email if it has already been changed during the last hour/day? In this way you won't need to ban IPs while still allowing legitimate users to change their emails or to create new accounts.
- skoocda 3y agoIndira Gandhi National Open University has over 4 million students, and in China about 40% of university students are in STEM. It's certainly not impossible that this is coming from a single institution.
- bArray 3y agoThe question to ask yourself is: After seeing the service clearly degrade, why wouldn't you stop? Also there may be a good reason why arXiv call it a DDoS attack - they can probably see the same emails being flipped multiple times, which would not be inline with an accidental script issue.