3 ms·
Seems like rate-limiting expensive pages would be much easier and less invasive. Also caching... And I would argue Anubis does nothing to stop real DDoS attack
by ranger_danger 2y ago
Seems like rate-limiting expensive pages would be much easier and less invasive. Also caching...
And I would argue Anubis does nothing to stop real DDoS attacks that just indiscriminately blast sites with tens of gbps of traffic at once from many different IPs.
- bastawhiz 2y agoRate limiting does nothing when your adversary has hundreds or even thousands of IPs. It's trivial to pay for residential proxies.
- supportengineer 2y agoWhy aren't there any authorities going after this problem?
- eikenberry 2y agoThey could be doing it legally.
- deleted 2y ago[deleted]
- danielheath 2y agoMost of the "free" analytics tools for android/iOS are "funded" by running residential / "real user" proxies. They wait until your phone is on wifi / battery, then make requests on behalf of whoever has paid the analytics firm for access to 'their' residential IP pool.
- marginalia_nu 2y agoThese residential botnets are pretty difficult to shut down, and often operated out of countries with poor diplomatic relations with the west.
- GoblinSlayer 2y agohttps://infatica-sdk.io/ https://infatica-sdk.io/ INFATICA LTD Reg. No.: 14863491 Unit A, 82 James Carter Road, Mildenhall, Suffolk, IP28 7DE, United Kingdom
- o11c 2y agoBecause in a "free" nation, that means "free to run malware" not "free from malware". By far most malware is legal and a portion of its income is used to fund election campaigns.
- okanat 2y ago1. Which authorities? 2. The US is currently broken and they are not going to punish only, albeit unsustainable, growth in their economy. 3. Internet is global. Even EU wants to regulate, will they charge big tech leaders and companies with information tech crimes which will pierce the corporate veil? It will ensure that nobody will invest in unsustainable AI growth in the EU. However fucking up economy and the planet is how the world operates now, and without infinite growth you lose buying power for everything. So everybody else will continue to do fuckery. 4. What can a regulating body do? Force disconnects for large swaths of internet? Then Internet is no more.
- folmar 2y agoI would go for making the AI companies pay. Identifying end users for other abuse works but there are problems on state borders, for monetary solutions it should be easier.
- Ocha 2y agoRate limit according to what? It was 35k residential IPs. Rate limit would end up keeping real users out.
- linsomniac 2y agoRate limit according to destination URL (the expensive ones), not source IP. If you have expensive URLs that you can't serve more than, say 3 of at a time, or 100 of per minute, NOT rate limiting them will end up keeping real users out simply because of the lack of resources.
- pluto_modadic 2y agothis feels like something /you can do on your servers/, and that other folks with resource constraints (like time, budget, or the hardware they have) find anubis valuable.
- linsomniac 2y agoSure, didn't mean to imply Anubis wasn't an alternative, just was clearing up that there are options beyond source IP rate limiting, which several people seemed to be thinking was the only option because of comments about rate limiting not working because it was coming from 35K IP addresses.
- danielheath 2y agoRight - but if you have, say, 1000 real user requests for those endpoints daily, and thirty million bot requests for those endpoints, the practical upshot of this approach is that none of the real users get to access that endpoint.
- Groxx 2y agoYeah, at that point to might as well just turn off the servers. It's even cheaper at cutting off requests, and it'll serve just as many legitimate users.
- PaulDavisThe1st 2y agoIn the last two months, ardour.org's instance of fail2ban has blocked more than 1.2M distinct IP addresses that were trawling our git repo using http instead of just fetching the goddam repository. We shut down the website/http frontend to our git repo. There are still 20k distinct IP addresses per day hitting up a site that issues NOTHING but 404 errors.
- lousken 2y agoYes, have everything static (if you can't, use caching), optimize images, rate limit anything you have to generate dynamically
- felsqualle 2y agoHi, author here. Caching is already enabled, but this doesn’t work for the highly dynamic parts of the site like version history and looking for recent changes. And yes, it doesn’t work for volumetric attacks with tens of gbps. At this point I don’t think it is a targeted attack, probably a crawler gone really wild. But for this pattern, it simply works.
- GoblinSlayer 2y agoThere's a theory they didn't get through, because it's a new protection method and the bots don't run javascript. It could be as simple as <script>setCookie("letmein=1");reload();</script>
- toast0 2y ago> And I would argue Anubis does nothing to stop real DDoS attacks that just indiscriminately blast sites with tens of gbps of traffic at once from many different IPs. Volumetric DDoS and application layer DDoS are both real, but volumetric DDoS doesn't have an opportunity for cute pictures. You really just need a big enough inbound connection and then typically drop inbound UDP and/or IP fragments and turn off http/3. If you're lucky, you can convince your upstream to filter out UDP for you, which gives you more effective bandwidth.