4 ms·

I'm not a web developer, but I've picked up some bits of knowledge here and there, mostly from troubleshooting issues I encounter while using websites. I know

I'm not a web developer, but I've picked up some bits of knowledge here and there, mostly from troubleshooting issues I encounter while using websites. I know there are a number of headers used to control cross-site access to websites, and the linked blog post shows archive.today's denial-of-service script sending random queries to the site's search function. Shouldn't there be a way to prevent those from running when they're requested from within a third-party site?

deleted 7mo ago
[deleted]
JasonADrury 7mo ago
[flagged]
- throwingcookies 7mo ago
  > The blog is still online and only exists as a part of a harassment campaign targeting archive.today The blog has a lot of more posts on random topics. Why do you imply that the owner of the bloh is part of a harassment campaign and "only" that is the reason for this years old blog to exist?
  - JasonADrury 7mo ago
    Because all the content in the past 4+ years is about archive.today?
    - winkelmann 7mo ago
      > all the content in the past 4+ years is about archive.today But it's not? This was published between the two posts about archive.today: https://gyrovague.com/2025/02/23/anatomy-of-a-boarding-pass-how-to-detect-fake-flight-tickets-by-scammers/ https://gyrovague.com/2025/02/23/anatomy-of-a-boarding-pass-...
      - JasonADrury 7mo ago
        Okay, there's one filler post I missed. I'm sure it took a lot of time to write the 16739382nd post explaining what the various things on a boarding pass mean.
        ahhhhnoooo 7mo ago
        They have posted twice in four years. Once doing some digging into who runs archive today, and a second time to respond to a ddos attack. Writing about being ddos'd seems eminently reasonable. So if you elide that, you are talking about a single article in four years. It's genuinely nothing.
        deleted 7mo ago
        [deleted]
        JasonADrury 7mo ago
        The purpose of a thing is what it does.
        throwingcookies 7mo ago
        > The purpose of a thing is what it does. What is the purpose of the DDoS JS in the archive website then? Not DDoS?
        JasonADrury 7mo ago
        I'm sure it's DDoS, just like the purpose of gyrovague.com is to attack archive.today Easy stuff, no?
        ahhhhnoooo 7mo ago
        Attack? Did we read the same one article? One article is clearly defensive. The other is a piece of investigative journalism about who and how the site is run. Neither of those is an attack.
    - Mogzol 7mo ago
      Not true: https://gyrovague.com/2025/02/23/anatomy-of-a-boarding-pass-how-to-detect-fake-flight-tickets-by-scammers/ https://gyrovague.com/2025/02/23/anatomy-of-a-boarding-pass-... There are only two posts about archive.today on the blog, and one of them only exists because archive.today started DDoSing them. I fail to see how you could consider the entire blog to be a "harassment campaign", especially considering that the original blog post isn't even negative, it ends with a compliment towards archive.today's creator.
    - deleted 7mo ago
      [deleted]
    - jrflowers 7mo ago
      This is a weird way of saying that you wish gyrovague updated more frequently. You could just say “Big fan of his writing, I’d love it if he posted more” if your only complaint is that there aren’t enough recent blog posts on that website
- 47282847 7mo ago
  One side publishes words, the other DDoSes. One side could just ignore the other and go about their business, the other cannot. One is using force, which naturally leads to resistance and additional attention, the other is not. Both sides look like they have been bullied in the past and not found their way out of reproducing the pattern yet.
  - croes 7mo ago
    Words can have bad consequences. We‘ll see what will happen to Banksy after Reuters published words.
  - JasonADrury 7mo ago
    [flagged]
    - 47282847 7mo ago
      Words can have influence and can come from a place of authority, which does carry responsibility. Words of a president are very different from words published on a random blog by some random person, and different yet again from words published by a newspaper. Some presidents words are opinion, the same words in different context are commands and not acting on them comes at a price. Context matters. Which is why also different rules apply, and laws exist to guard these rules. DDoS is not an acceptable response in any jurisdiction, no matter what triggered them. We’re not in the Middle Ages, even if some behave like we are. Violence does not justify violence. Unjust action does not justify unjust responses.
      - _osud 6mo ago
        >DDoS is not an acceptable response in any jurisdiction Who the fuck cares about what the law says? Seriously. The service archive.today offers is illegal in any case. This is just a fundamentally bizarre context to be bringing up the law in.
        47282847 6mo ago
- longislandguido 7mo ago
  You think DDoS (which is illegal btw) is okay as long as you don't like the target?
  - RobotToaster 7mo ago
    Harassment an doxing are both illegal.
    - hrimfaxi 7mo ago
      Doxxing is illegal? I am against it but if it's republishing public info I don't think it can be illegal in the US unless there is an intent element.
      - RobotToaster 7mo ago
        The blog author is in Finland, so it's covered by the Article 8 right to privacy of the ECHR. The exact implementation is country dependent, I don't know how it works in Finland but in the UK we just extended the common law tort of "Breach of confidence" to it.
        hrimfaxi 6mo ago
        That is very surprising to me. As far as I know, in Finland details of your income are publicly available, but someone reposting publicly available information is illegal.
  - JasonADrury 7mo ago
    [flagged]
  - DaSHacka 7mo ago
    Considering the site itself is an illegal archive of websites, I think its obvious most of us don't treat what's 'legal' as a guide to whats 'moral'.
- riedel 7mo ago
  While I would it also better to a bit redact names and details mentioned in the original article in hindsight, I hardly find real defamation. I guess you want to provide random unproven evidence if someone is target of various foreign law enforcement and commercial sites. In the article they even call for donations to archive.today . As far as I read the tone of the post is full of admiration. Funny thing is that IMHO the rather childish JavaScript attack gives credibility to the post after all. In all this I somehow hope that we see a legal solution to all this major global copyright crisis that has been reinforced by LLM training. (If you want conspiracy theory: that I guess would be easy monetization for archive these days selling their snapshots)
  - JasonADrury 7mo ago
    Defamation? No. Doxing? Yes. It's clear that the person running archive.today does not actively publicize their identity. > As far as I read the tone of the post is full of admiration Exactly like an unhinged fan stalking a celebrity.
    - riedel 7mo ago
      Totally agreed. Thanks for raising awareness. Thinking about it, I think we might need better platform rules, maybe even regulations on this. There seems to be pretty much no line of defense, which might explain the rather desperate DoS. If you take anonymity as a right, discussion like ours here on HN are dangerous as well, as they easily make otherwise difficult to find knowledge easily visible. So while a single fan page might go unnoticed, in case of doxing amplification is also a problem. Just my spontaneous thought. Edit: one afterthought. The story about hacking together a response to the GDPR takedown request quoting press rights and freedom of speech using an LLM shows actually the deeper problem. Actually rights come with obligations (at least ethical ones). At least in Europe press standards are typically rather aware of doxing risks. While actually celebraties also successfully use legal defenses, i still think the defenses for activist are weak balancing interest here (at least if you made something of public interest)
sheept 7mo ago
You can't completely prevent the browser from sending the request—after all, it needs to figure out whether to block the website from reading the response. However, browsers will first send a preflight request for non-simple requests before sending the actual request. If the DDOS were effective because the search operation was expensive, then the blog could put search behind a non-simple request, or require a valid CSRF token before performing the search.
bawolff 7mo ago
> I know there are a number of headers used to control cross-site access to websites Mostly these headers are designed around preventing reading content. Sending content generally does not require anything. (As a kind of random tidbit, this is why csrf tokens are a thing, you can't prevent sending so websites test to see if you were able to read the token in a previous request) This is partially historical. The rough rule is if it was possible to make the request without javascript then it doesn't need any special headers (preflight)

deleted 7mo ago

[deleted]

JasonADrury 7mo ago

[flagged]

throwingcookies 7mo ago
> The blog is still online and only exists as a part of a harassment campaign targeting archive.today The blog has a lot of more posts on random topics. Why do you imply that the owner of the bloh is part of a harassment campaign and "only" that is the reason for this years old blog to exist?
- JasonADrury 7mo ago
  Because all the content in the past 4+ years is about archive.today?
  - winkelmann 7mo ago
    > all the content in the past 4+ years is about archive.today But it's not? This was published between the two posts about archive.today: https://gyrovague.com/2025/02/23/anatomy-of-a-boarding-pass-how-to-detect-fake-flight-tickets-by-scammers/ https://gyrovague.com/2025/02/23/anatomy-of-a-boarding-pass-...
    - JasonADrury 7mo ago
      Okay, there's one filler post I missed. I'm sure it took a lot of time to write the 16739382nd post explaining what the various things on a boarding pass mean.
      - ahhhhnoooo 7mo ago
        They have posted twice in four years. Once doing some digging into who runs archive today, and a second time to respond to a ddos attack. Writing about being ddos'd seems eminently reasonable. So if you elide that, you are talking about a single article in four years. It's genuinely nothing.
        deleted 7mo ago
        [deleted]
        JasonADrury 7mo ago
        The purpose of a thing is what it does.
        throwingcookies 7mo ago
        > The purpose of a thing is what it does. What is the purpose of the DDoS JS in the archive website then? Not DDoS?
        JasonADrury 7mo ago
        I'm sure it's DDoS, just like the purpose of gyrovague.com is to attack archive.today Easy stuff, no?
        ahhhhnoooo 7mo ago
        Attack? Did we read the same one article? One article is clearly defensive. The other is a piece of investigative journalism about who and how the site is run. Neither of those is an attack.
  - Mogzol 7mo ago
    Not true: https://gyrovague.com/2025/02/23/anatomy-of-a-boarding-pass-how-to-detect-fake-flight-tickets-by-scammers/ https://gyrovague.com/2025/02/23/anatomy-of-a-boarding-pass-... There are only two posts about archive.today on the blog, and one of them only exists because archive.today started DDoSing them. I fail to see how you could consider the entire blog to be a "harassment campaign", especially considering that the original blog post isn't even negative, it ends with a compliment towards archive.today's creator.
  - deleted 7mo ago
    [deleted]
  - jrflowers 7mo ago
    This is a weird way of saying that you wish gyrovague updated more frequently. You could just say “Big fan of his writing, I’d love it if he posted more” if your only complaint is that there aren’t enough recent blog posts on that website
47282847 7mo ago
One side publishes words, the other DDoSes. One side could just ignore the other and go about their business, the other cannot. One is using force, which naturally leads to resistance and additional attention, the other is not. Both sides look like they have been bullied in the past and not found their way out of reproducing the pattern yet.
- croes 7mo ago
  Words can have bad consequences. We‘ll see what will happen to Banksy after Reuters published words.
- JasonADrury 7mo ago
  [flagged]
  - 47282847 7mo ago
    Words can have influence and can come from a place of authority, which does carry responsibility. Words of a president are very different from words published on a random blog by some random person, and different yet again from words published by a newspaper. Some presidents words are opinion, the same words in different context are commands and not acting on them comes at a price. Context matters. Which is why also different rules apply, and laws exist to guard these rules. DDoS is not an acceptable response in any jurisdiction, no matter what triggered them. We’re not in the Middle Ages, even if some behave like we are. Violence does not justify violence. Unjust action does not justify unjust responses.
    - _osud 6mo ago
      >DDoS is not an acceptable response in any jurisdiction Who the fuck cares about what the law says? Seriously. The service archive.today offers is illegal in any case. This is just a fundamentally bizarre context to be bringing up the law in.
      - 47282847 6mo ago
longislandguido 7mo ago
You think DDoS (which is illegal btw) is okay as long as you don't like the target?
- RobotToaster 7mo ago
  Harassment an doxing are both illegal.
  - hrimfaxi 7mo ago
    Doxxing is illegal? I am against it but if it's republishing public info I don't think it can be illegal in the US unless there is an intent element.
    - RobotToaster 7mo ago
      The blog author is in Finland, so it's covered by the Article 8 right to privacy of the ECHR. The exact implementation is country dependent, I don't know how it works in Finland but in the UK we just extended the common law tort of "Breach of confidence" to it.
      - hrimfaxi 6mo ago
        That is very surprising to me. As far as I know, in Finland details of your income are publicly available, but someone reposting publicly available information is illegal.
- JasonADrury 7mo ago
  [flagged]
- DaSHacka 7mo ago
  Considering the site itself is an illegal archive of websites, I think its obvious most of us don't treat what's 'legal' as a guide to whats 'moral'.
riedel 7mo ago
While I would it also better to a bit redact names and details mentioned in the original article in hindsight, I hardly find real defamation. I guess you want to provide random unproven evidence if someone is target of various foreign law enforcement and commercial sites. In the article they even call for donations to archive.today . As far as I read the tone of the post is full of admiration. Funny thing is that IMHO the rather childish JavaScript attack gives credibility to the post after all. In all this I somehow hope that we see a legal solution to all this major global copyright crisis that has been reinforced by LLM training. (If you want conspiracy theory: that I guess would be easy monetization for archive these days selling their snapshots)
- JasonADrury 7mo ago
  Defamation? No. Doxing? Yes. It's clear that the person running archive.today does not actively publicize their identity. > As far as I read the tone of the post is full of admiration Exactly like an unhinged fan stalking a celebrity.
  - riedel 7mo ago
    Totally agreed. Thanks for raising awareness. Thinking about it, I think we might need better platform rules, maybe even regulations on this. There seems to be pretty much no line of defense, which might explain the rather desperate DoS. If you take anonymity as a right, discussion like ours here on HN are dangerous as well, as they easily make otherwise difficult to find knowledge easily visible. So while a single fan page might go unnoticed, in case of doxing amplification is also a problem. Just my spontaneous thought. Edit: one afterthought. The story about hacking together a response to the GDPR takedown request quoting press rights and freedom of speech using an LLM shows actually the deeper problem. Actually rights come with obligations (at least ethical ones). At least in Europe press standards are typically rather aware of doxing risks. While actually celebraties also successfully use legal defenses, i still think the defenses for activist are weak balancing interest here (at least if you made something of public interest)

sheept 7mo ago

You can't completely prevent the browser from sending the request—after all, it needs to figure out whether to block the website from reading the response. However, browsers will first send a preflight request for non-simple requests before sending the actual request. If the DDOS were effective because the search operation was expensive, then the blog could put search behind a non-simple request, or require a valid CSRF token before performing the search.

bawolff 7mo ago

> I know there are a number of headers used to control cross-site access to websites Mostly these headers are designed around preventing reading content. Sending content generally does not require anything. (As a kind of random tidbit, this is why csrf tokens are a thing, you can't prevent sending so websites test to see if you were able to read the token in a previous request) This is partially historical. The rough rule is if it was possible to make the request without javascript then it doesn't need any special headers (preflight)