4 ms·

He's surprised that essentially a while loop was all it took to skew his results? Of course that is all it takes to hammer an unprotected API. I would almost b

He's surprised that essentially a while loop was all it took to skew his results? Of course that is all it takes to hammer an unprotected API. I would almost blame whoever abuses the API rather than him for not protecting something made purely for others enjoyment. It getting messed with is almost part of the experience.

dylan604 1y ago
If you have never had the pleasure of being raided by bots, it is always a life experience when it first happens. It's only natural to think some personal side project would not be something to attract someone's attention to bother in this way. It's also a learning experience to finally realize that there are people that absolutely are willing to do this just because they can and/or just to see if it can be messed with. Also, never underestimate that your side project might land just right with someone that has a bone to pick and your project gives them the avenue to do it. If you've never experienced any of that, it is very easily dismissed or flat out never even considered.
0xTJ 1y ago
No, you can admit that making the API simple was a mistake, but you always blame the person abusing the API (it's not like this is a critical system with valuable information). If everyone was acting in good faith, it wouldn't be a problem. (Though if someone is negligent with an important API, they should also be blamed.)
- ericmcer 1y ago
  that is what i said....
Wowfunhappy 1y ago
How do you even really protect against bots? You can throw up a CAPTCHA but (A) that won't actually stop all the bots and (B) it's going to lock out some legitimate users who did nothing wrong.
- bombcar 1y ago
  State of the art is basically a modified crypto miner that runs in javascript - the client says "processing" for awhile until it solves the math problem, then lets you in. Still bottable but takes tons more CPU power than the server needs.
- ericmcer 1y ago
  Just add rate limiting, a single line in nginx and most server libraries would cover this. More sophisticated attackers (using multiple IP, hiding fingerprints) aren't going to bother with a site like this (probably lol) The code that got him wasn't a "bot" it was just a script that spawned a couple children and had them all hit the API on loop.
skillseeddev 1y ago
This was my first time dealing with APIs at scale, so I didn't do a whole lot of protection. I'm glad the site got botted though, I learned a lot about rate-limits, and the botter (from MIT) was kind enough to help me protect the API from future botters. It was a great learning experience, and I'd gladly do it again

dylan604 1y ago

If you have never had the pleasure of being raided by bots, it is always a life experience when it first happens. It's only natural to think some personal side project would not be something to attract someone's attention to bother in this way. It's also a learning experience to finally realize that there are people that absolutely are willing to do this just because they can and/or just to see if it can be messed with. Also, never underestimate that your side project might land just right with someone that has a bone to pick and your project gives them the avenue to do it. If you've never experienced any of that, it is very easily dismissed or flat out never even considered.

0xTJ 1y ago

No, you can admit that making the API simple was a mistake, but you always blame the person abusing the API (it's not like this is a critical system with valuable information). If everyone was acting in good faith, it wouldn't be a problem. (Though if someone is negligent with an important API, they should also be blamed.)

ericmcer 1y ago
that is what i said....

Wowfunhappy 1y ago

How do you even really protect against bots? You can throw up a CAPTCHA but (A) that won't actually stop all the bots and (B) it's going to lock out some legitimate users who did nothing wrong.

bombcar 1y ago
State of the art is basically a modified crypto miner that runs in javascript - the client says "processing" for awhile until it solves the math problem, then lets you in. Still bottable but takes tons more CPU power than the server needs.
ericmcer 1y ago
Just add rate limiting, a single line in nginx and most server libraries would cover this. More sophisticated attackers (using multiple IP, hiding fingerprints) aren't going to bother with a site like this (probably lol) The code that got him wasn't a "bot" it was just a script that spawned a couple children and had them all hit the API on loop.

skillseeddev 1y ago

This was my first time dealing with APIs at scale, so I didn't do a whole lot of protection. I'm glad the site got botted though, I learned a lot about rate-limits, and the botter (from MIT) was kind enough to help me protect the API from future botters. It was a great learning experience, and I'd gladly do it again