4 ms·

The way it currently works is: 1. You make a post that includes example.com/cats 2. Your post is federated to the instances your followers are on. 3. Those i

by jefftk 2y ago

The way it currently works is: 1. You make a post that includes example.com/cats 2. Your post is federated to the instances your followers are on. 3. Those instances fetch example.com/cats in a fully automated way, and observe its preview image is example.com/tabby.jpg and fetch that as well. They save this locally. 4. When your followers view your federated post they see a short text extract from example.com/cats and a thumbnail of example.com/tabby.jpg Step 3 is where the 'DDOS' is happening, and it's not a request issued by an agent of the original poster.

willcipriano 2y ago
A single user action can result in more than one http request to a service. The idea of the rule you are referring to is more about things that don't have any user input at all, like crawlers. A user asked for that, they said "I want all my pals to know about this page", even if it's a dumb thing that they asked for, they asked for it.
- jefftk 2y ago
  In step 3 the servers asking for the image are acting as agents of the followers, not of the original poster, no?
  - willcipriano 2y ago
    Why did the original poster post it if not to have the image downloaded to be displayed in his friends feeds?
    - jefftk 2y ago
      The image isn't actually the issue: it's the html for the web page. The image is static and quick to serve, the html is often dynamically generated for each visitor. Thinking about other similar distributed systems, if I put a link to an html page in an RSS feed or a mailing list message, it's not normal for subscribers to be using clients that fetch linked pages. But if they did it's clearly as an agent of that user, and not as an agent of the poster?
      - willcipriano 2y ago
        If I was the web service getting hit I'd be glad that somebody is even interested enough that I'm having this problem. I also have the wisdom to know complaining is unlikely to solve my issue. I get paid to basically solve this sort of scaling problems so I'm not a great barometer but it isn't that hard to handle a traffic spike like this.

by jefftk 2y ago

willcipriano 2y ago

A single user action can result in more than one http request to a service. The idea of the rule you are referring to is more about things that don't have any user input at all, like crawlers. A user asked for that, they said "I want all my pals to know about this page", even if it's a dumb thing that they asked for, they asked for it.

jefftk 2y ago
In step 3 the servers asking for the image are acting as agents of the followers, not of the original poster, no?
- willcipriano 2y ago
  Why did the original poster post it if not to have the image downloaded to be displayed in his friends feeds?
  - jefftk 2y ago
    The image isn't actually the issue: it's the html for the web page. The image is static and quick to serve, the html is often dynamically generated for each visitor. Thinking about other similar distributed systems, if I put a link to an html page in an RSS feed or a mailing list message, it's not normal for subscribers to be using clients that fetch linked pages. But if they did it's clearly as an agent of that user, and not as an agent of the poster?
    - willcipriano 2y ago
      If I was the web service getting hit I'd be glad that somebody is even interested enough that I'm having this problem. I also have the wisdom to know complaining is unlikely to solve my issue. I get paid to basically solve this sort of scaling problems so I'm not a great barometer but it isn't that hard to handle a traffic spike like this.