8 ms·

How the FSF sysadmins block botnets with reaction

168 points by pseudolus 3mo ago

cyanydeez 3mo ago
are scrapers attackers? I get they're DDoS; but take the mask off, and arn't they just the AI monied interests that fund the FSF? and a lot of them are just active inference, eg, the user is trying to ask about something and the AI monied interests setup a web scraper to go and get that data. Just seems like no one wants to call out the hand that feeds them in a human centipede that's best described as the torment nexus.
- kaladin-jasnah 3mo ago
  > AI monied interests that fund the FSF Can you elaborate on who these interests are precisely?
  - cyanydeez 3mo ago
    I tried: https://www.fsf.org/patrons https://www.fsf.org/patrons; the last FY listed is 2020.
    - kaladin-jasnah 3mo ago
      I'm not entirely sure how those companies are related to "AI-monied" after clicking on their websites.
      - cyanydeez 3mo ago
        the point is i tried to answer and the page is 6 years out of date....
        socratic_weeb 3mo ago
        The point is that it is presumed that you must've gotten the info somewhere in order to back up your claims. If not this outdated website, where then?
        tokai 3mo ago
        So you made shit up.
    - thomzane 3mo ago
      The patrons page is updated regularly.
- nemomarx 3mo ago
  instead of scraping then, they could pay the fsf for a dump of the site or some API access or something, right? why overload the servers normally.
  - GoblinSlayer 3mo ago
    That's what commoncrawl does.
    - nemomarx 3mo ago
      common crawl pays the sites they crawl?
- m3047 3mo ago
  Anything which fills my logs with garbage is unwanted. Your cat could have fallen asleep on the keyboard, I don't care. If you want to use the internet as a giant petri dish, that's on you; but the cat box is elsewhere. I can feed you garbage or block you because your code is shit, or I don't like your style.
nubinetwork 3mo ago
> We placed our regular expressions in fail2ban, and found that we were hitting the maximum rules that could be added to UFW firewall rules on our systems which showed degradation around 65,000 rules Firewalld had a similar issue up until recently as well.
- jruohonen 3mo ago
  https://man.netbsd.org/blocklistd.8 https://man.netbsd.org/blocklistd.8
Magicrafter13 3mo ago
> This software is gay, trans and anticolonialist. If you're uncomfortable with that, please don't use it Weird message to include in AGPLv3 licensed software (which explicitly allows people to use software however they like, regardless of their beliefs or feelings).
- Groxx 3mo ago
  You can have preferences while not restricting legal rights.
  - graemep 3mo ago
    You can, but if the exact quote in the GP is correct the claim is claiming the software is "gay, trans and anti-colonialist" and asks you not to use it. Why use a license that is designed to be politically neutral and then ask some people not to use it? What I can see is a fairly clear indication that they do not want contributions from people whose politics differ from theirs. I would also question whether government funding of a project with political policies about who can participate is appropriate. The political stance is also rooted in a particular culture so is unwelcoming to people from other cultures. Of course people can political views and preferences, but they presumably have some aim in mind when making that statement in the README. What is that aim?
    - LoganDark 3mo ago
      You can always ask anyone not to use anything. Doesn't mean they have to listen, but you can still ask.
    - stonogo 3mo ago
      The aim is to reduce the number of users of the software who are uncomfortable with those who are gay, trans, and/or anticolonial, probably because dealing with such people is a heavier burden than the other kind.
      - graemep 3mo ago
Bender 3mo ago
My personal preference is to 'ip route add blackhole ${net}' as it has the lowest CPU overhead and I can add hundreds of thousands of CIDR blocks with no noticeable impact. The only downside is that it won't stop UDP packets from getting to a UDP listener. There will not be a response but the application will still see it. For my TCP daemons it's great. grep -m1 -E ^Tot /proc/net/fib_triestat ;ip route | grep -Fc blackhole Total size: 56735 kB 426951 Those 426951 blackhole routes include data-centers, VPS providers, botnets, AI datacenters that ignore robots.txt, search engines, abused CDN's, known bad residential nodes and much more. I still see a few residential proxy bots that do a halfway decent job of pretending to be real people at times but the feds are playing whack-a-mole with them. The bots self report to my silly blog so I can block them elsewhere on systems I might care a little bit about. Happy to share them if anyone is remotely interested. I also use a couple generalized rules in nftables raw table that keeps a lot of beyond poorly written bots away including hping3 tcp floods and masscan. My rules to port 443 are stateless. One must not taunt the state table.
- seki285 3mo ago
  I would like to learn more how you maintain your table of IP ranges (or CIDR block). How do you decide when to add/remove a range? I'm most concerned about blocking innocent users, currently I use Cloudflare to block known bad ASNs using a list I found on GitHub.
  - Bender 3mo ago
    How do you decide when to add/remove a range? The only IP's that come and go are the Tor 30 day blocklist and a couple FireHOL attackers from a repo though I will sometimes leave the last entries live until reboot. I do not really need to block tor but I use this silly blog as a testing ground. Tor and some known abusers come from a git repo I refresh periodically. The data-centers, VPS providers, CDNs, known botnets are perma-banned. For my hobby nodes I personally find this acceptable. I would not do this in a professionally managed data-center. There are better methods for those cases especially for B2B corporate arrangements. Regardless of what daemons I run I never have external dependencies that need to be accessed from my node or from the client with exception of stratum-1 time servers. I do have to periodically update the CIDR blocks for given ASN's. I have not automated this but I probably should some day. It's not hard to automate, I am just excessively "efficient". I was told to stop calling myself lazy, but I am. Methods 2, 3 and 5 are the ones I talk about here. [1] [1] - https://nochan.net/b/Internet-Crap/20260606-How-To-Block-Some-Of-The-Bots/?cacheb_20260714#Method-02 https://nochan.net/b/Internet-Crap/20260606-How-To-Block-Som...
wasmperson 3mo ago
It's somewhat interesting to see the FSF's approach to this. From what I understand they can't really use something like anubis since they want their websites to be accessible without javascript: https://www.gnu.org/philosophy/javascript-trap.html https://www.gnu.org/philosophy/javascript-trap.html Users can't consent to running a page's javascript the way they can consent to running a program they've intentionally downloaded, so it's effectively "non-free" regardless of license.
- superkuh 3mo ago
  Anubis does support the no-JS HTTP meta-redirect proof of work but few know about it and fewer enable it. And it may not block everything.
  - wasmperson 3mo ago
    I indeed did not know about this. There seem to be some caveats: https://anubis.techaro.lol/docs/admin/configuration/challenges/metarefresh https://anubis.techaro.lol/docs/admin/configuration/challeng... I guess for the meta refresh challenge it's less "proof of work" and more "proof of patience".
    - xena 3mo ago
      The meta refresh challenge actually uses time as the proof! It makes sure you wait for at least 75% of the time the administrator configured and adds client side smear to ensure that browser temporal randomization doesn't trigger a false failure.
  - perching_aix 3mo ago
    Does it still need a cookie though? Another thing I have disabled by default.
- xena 3mo ago
  For what it's worth, Anubis supports LibreJS: https://github.com/TecharoHQ/anubis/blob/main/web/build.sh#L7-L36 https://github.com/TecharoHQ/anubis/blob/main/web/build.sh#L...
idoubtit 3mo ago
That's interesting. I haven't used fail2ban for a long time, but reaction is worth evaluating. Unfortunately, that post does not describe their full configuration. Maybe it's on purpose, so that attackers can't adjust to fit. My experience is that modern web scraping had no obvious pattern, since it is proxied through many IPs. The last time a server was failing to handle the pressure, we decided to temporarily ban IPs from some Asian regions. How does the FSF decide to ban an IP? Why do they use iptables + ipset instead of nftables? Is there a technical reason or is it just legacy? AFAIK, Nftables is more performant, and IMO simpler. And it has native sets, see https://wiki.nftables.org/wiki-nftables/index.php/Sets https://wiki.nftables.org/wiki-nftables/index.php/Sets
- itintheory 3mo ago
  > The last time a server was failing to handle the pressure, we decided to temporarily ban IPs from some Asian regions. This is something we've been forced to do at work, a LOT. Some weeks it's Huawei Cloud, Tencent, and Alibaba. Other weeks it's all China Telecom. We're using Anubis where possible, but a lot of it is just whack-a-mole with residential proxies. I looked at Datadome and HUMAN, but they would be hundreds of thousands a year at our traffic scale, and I suspect may also have false positives. We abandoned CrowdSec for that reason as well. I'd love to find a decent k8s native solution to this problem.
  - Hackbraten 3mo ago
    > I looked at Datadome and HUMAN, but they would be hundreds of thousands a year at our traffic scale, and I suspect may also have false positives. I can confirm. DataDome has been making my life a living hell. It thinks my phone is a bot, so I can no longer use PayPal and other quasi-monopoly services while on the go. DataDome will reliably block me on the first request. Fuck DataDome.
  - arbol 3mo ago
    Prosopo could cut out a lot of the residential proxy nonsense for you. We integrate with lambda@Edge / cloudfront workers / server side and perform analytics to detect residential proxy networks - at far less cost than DD or HUMAN.
m3047 3mo ago
"Many sysadmins know about fail2ban..." and many will now know about reaction. But why will the result be any different than fail2ban? It won't. I identify features (which can be expressed as firewall rules) from log data; I write totals to a temporary store (Redis). I have periodic tasks which scan the temp store for patterns which exceed thresholds. When that occurs, fail2ban creates the appropriate rules. This occurs in depth and in concentric rings. Et tu?
- thomzane 3mo ago
  The difference between fail2ban and reaction is performance. If you are not hitting the ceiling of fail2ban, then you may not need reaction. Do you have a blog post about your automated fail2ban rule generation?
  - m3047 3mo ago
    Why should I have a blog post? I get amazing "performance" out of fail2ban, it does what it's supposed to do and I don't ask it to do more. I've given it "super powers". Last year I blocked basically all of Brazil. No problems. Who knew?
charcircuit 3mo ago
>Popa botnet It's no more of a botnet than ProtonVPN for example. Apps intentionally added the Popa SDK to their apps as a monetization method. This allows apps without ads and tracking to be financially viable. I would expect FSF to support apps being able to move off of monetization schemes that depend on tracking people so it is disappointing for them to put such alternative monetization technologies in a negative light.
- thomzane 3mo ago
  This monetization scheme benefits the botnet controller and the developer who added the SDK and not the user who likely did not realize they signed up to become an exit node.
  - charcircuit 3mo ago
    It allows as free versions of apps to be economically viable and compete with others. It helps users because they don't need to be spied on and shown ads to fund the development of the app. The existence of an app brings users value, else they wouldn't use it.
    - nemomarx 3mo ago
      the fsf has never really been concerned with commercial viability. They're the worst audience for this sort of argument. and I doubt these apps are really Free versions - do they support user modifications and access to the code? If they did support the four freedoms maybe the fsf would have something positive to say to balance it out?
      - charcircuit 3mo ago
        You are not wrong. The FSF often takes an absolute stance on these things where they don't properly support partial steps towards more free computing.
    - ryandrake 3mo ago
      Recruiting your users' systems into a botnet is not an acceptable way to make an app "economically viable" any more than, say, installing a rootkit on their systems.
deleted 3mo ago
[deleted]
deleted 3mo ago
[deleted]

168 points by pseudolus 3mo ago

are scrapers attackers? I get they're DDoS; but take the mask off, and arn't they just the AI monied interests that fund the FSF? and a lot of them are just active inference, eg, the user is trying to ask about something and the AI monied interests setup a web scraper to go and get that data. Just seems like no one wants to call out the hand that feeds them in a human centipede that's best described as the torment nexus.

kaladin-jasnah 3mo ago
> AI monied interests that fund the FSF Can you elaborate on who these interests are precisely?
- cyanydeez 3mo ago
  I tried: https://www.fsf.org/patrons https://www.fsf.org/patrons; the last FY listed is 2020.
  - kaladin-jasnah 3mo ago
    I'm not entirely sure how those companies are related to "AI-monied" after clicking on their websites.
    - cyanydeez 3mo ago
      the point is i tried to answer and the page is 6 years out of date....
      - socratic_weeb 3mo ago
        The point is that it is presumed that you must've gotten the info somewhere in order to back up your claims. If not this outdated website, where then?
      - tokai 3mo ago
        So you made shit up.
  - thomzane 3mo ago
    The patrons page is updated regularly.
nemomarx 3mo ago
instead of scraping then, they could pay the fsf for a dump of the site or some API access or something, right? why overload the servers normally.
- GoblinSlayer 3mo ago
  That's what commoncrawl does.
  - nemomarx 3mo ago
    common crawl pays the sites they crawl?
m3047 3mo ago
Anything which fills my logs with garbage is unwanted. Your cat could have fallen asleep on the keyboard, I don't care. If you want to use the internet as a giant petri dish, that's on you; but the cat box is elsewhere. I can feed you garbage or block you because your code is shit, or I don't like your style.

nubinetwork 3mo ago

> We placed our regular expressions in fail2ban, and found that we were hitting the maximum rules that could be added to UFW firewall rules on our systems which showed degradation around 65,000 rules Firewalld had a similar issue up until recently as well.

jruohonen 3mo ago
https://man.netbsd.org/blocklistd.8 https://man.netbsd.org/blocklistd.8

Magicrafter13 3mo ago

> This software is gay, trans and anticolonialist. If you're uncomfortable with that, please don't use it Weird message to include in AGPLv3 licensed software (which explicitly allows people to use software however they like, regardless of their beliefs or feelings).

Groxx 3mo ago
You can have preferences while not restricting legal rights.
- graemep 3mo ago
  You can, but if the exact quote in the GP is correct the claim is claiming the software is "gay, trans and anti-colonialist" and asks you not to use it. Why use a license that is designed to be politically neutral and then ask some people not to use it? What I can see is a fairly clear indication that they do not want contributions from people whose politics differ from theirs. I would also question whether government funding of a project with political policies about who can participate is appropriate. The political stance is also rooted in a particular culture so is unwelcoming to people from other cultures. Of course people can political views and preferences, but they presumably have some aim in mind when making that statement in the README. What is that aim?
  - LoganDark 3mo ago
    You can always ask anyone not to use anything. Doesn't mean they have to listen, but you can still ask.
  - stonogo 3mo ago
    The aim is to reduce the number of users of the software who are uncomfortable with those who are gay, trans, and/or anticolonial, probably because dealing with such people is a heavier burden than the other kind.
    - graemep 3mo ago

Bender 3mo ago

My personal preference is to 'ip route add blackhole ${net}' as it has the lowest CPU overhead and I can add hundreds of thousands of CIDR blocks with no noticeable impact. The only downside is that it won't stop UDP packets from getting to a UDP listener. There will not be a response but the application will still see it. For my TCP daemons it's great. grep -m1 -E ^Tot /proc/net/fib_triestat ;ip route | grep -Fc blackhole Total size: 56735 kB 426951 Those 426951 blackhole routes include data-centers, VPS providers, botnets, AI datacenters that ignore robots.txt, search engines, abused CDN's, known bad residential nodes and much more. I still see a few residential proxy bots that do a halfway decent job of pretending to be real people at times but the feds are playing whack-a-mole with them. The bots self report to my silly blog so I can block them elsewhere on systems I might care a little bit about. Happy to share them if anyone is remotely interested. I also use a couple generalized rules in nftables raw table that keeps a lot of beyond poorly written bots away including hping3 tcp floods and masscan. My rules to port 443 are stateless. One must not taunt the state table.

seki285 3mo ago
I would like to learn more how you maintain your table of IP ranges (or CIDR block). How do you decide when to add/remove a range? I'm most concerned about blocking innocent users, currently I use Cloudflare to block known bad ASNs using a list I found on GitHub.
- Bender 3mo ago
  How do you decide when to add/remove a range? The only IP's that come and go are the Tor 30 day blocklist and a couple FireHOL attackers from a repo though I will sometimes leave the last entries live until reboot. I do not really need to block tor but I use this silly blog as a testing ground. Tor and some known abusers come from a git repo I refresh periodically. The data-centers, VPS providers, CDNs, known botnets are perma-banned. For my hobby nodes I personally find this acceptable. I would not do this in a professionally managed data-center. There are better methods for those cases especially for B2B corporate arrangements. Regardless of what daemons I run I never have external dependencies that need to be accessed from my node or from the client with exception of stratum-1 time servers. I do have to periodically update the CIDR blocks for given ASN's. I have not automated this but I probably should some day. It's not hard to automate, I am just excessively "efficient". I was told to stop calling myself lazy, but I am. Methods 2, 3 and 5 are the ones I talk about here. [1] [1] - https://nochan.net/b/Internet-Crap/20260606-How-To-Block-Some-Of-The-Bots/?cacheb_20260714#Method-02 https://nochan.net/b/Internet-Crap/20260606-How-To-Block-Som...

wasmperson 3mo ago

It's somewhat interesting to see the FSF's approach to this. From what I understand they can't really use something like anubis since they want their websites to be accessible without javascript: https://www.gnu.org/philosophy/javascript-trap.html https://www.gnu.org/philosophy/javascript-trap.html Users can't consent to running a page's javascript the way they can consent to running a program they've intentionally downloaded, so it's effectively "non-free" regardless of license.

superkuh 3mo ago
Anubis does support the no-JS HTTP meta-redirect proof of work but few know about it and fewer enable it. And it may not block everything.
- wasmperson 3mo ago
  I indeed did not know about this. There seem to be some caveats: https://anubis.techaro.lol/docs/admin/configuration/challenges/metarefresh https://anubis.techaro.lol/docs/admin/configuration/challeng... I guess for the meta refresh challenge it's less "proof of work" and more "proof of patience".
  - xena 3mo ago
    The meta refresh challenge actually uses time as the proof! It makes sure you wait for at least 75% of the time the administrator configured and adds client side smear to ensure that browser temporal randomization doesn't trigger a false failure.
- perching_aix 3mo ago
  Does it still need a cookie though? Another thing I have disabled by default.
xena 3mo ago
For what it's worth, Anubis supports LibreJS: https://github.com/TecharoHQ/anubis/blob/main/web/build.sh#L7-L36 https://github.com/TecharoHQ/anubis/blob/main/web/build.sh#L...

idoubtit 3mo ago

That's interesting. I haven't used fail2ban for a long time, but reaction is worth evaluating. Unfortunately, that post does not describe their full configuration. Maybe it's on purpose, so that attackers can't adjust to fit. My experience is that modern web scraping had no obvious pattern, since it is proxied through many IPs. The last time a server was failing to handle the pressure, we decided to temporarily ban IPs from some Asian regions. How does the FSF decide to ban an IP? Why do they use iptables + ipset instead of nftables? Is there a technical reason or is it just legacy? AFAIK, Nftables is more performant, and IMO simpler. And it has native sets, see https://wiki.nftables.org/wiki-nftables/index.php/Sets https://wiki.nftables.org/wiki-nftables/index.php/Sets

itintheory 3mo ago
> The last time a server was failing to handle the pressure, we decided to temporarily ban IPs from some Asian regions. This is something we've been forced to do at work, a LOT. Some weeks it's Huawei Cloud, Tencent, and Alibaba. Other weeks it's all China Telecom. We're using Anubis where possible, but a lot of it is just whack-a-mole with residential proxies. I looked at Datadome and HUMAN, but they would be hundreds of thousands a year at our traffic scale, and I suspect may also have false positives. We abandoned CrowdSec for that reason as well. I'd love to find a decent k8s native solution to this problem.
- Hackbraten 3mo ago
  > I looked at Datadome and HUMAN, but they would be hundreds of thousands a year at our traffic scale, and I suspect may also have false positives. I can confirm. DataDome has been making my life a living hell. It thinks my phone is a bot, so I can no longer use PayPal and other quasi-monopoly services while on the go. DataDome will reliably block me on the first request. Fuck DataDome.
- arbol 3mo ago
  Prosopo could cut out a lot of the residential proxy nonsense for you. We integrate with lambda@Edge / cloudfront workers / server side and perform analytics to detect residential proxy networks - at far less cost than DD or HUMAN.

m3047 3mo ago

"Many sysadmins know about fail2ban..." and many will now know about reaction. But why will the result be any different than fail2ban? It won't. I identify features (which can be expressed as firewall rules) from log data; I write totals to a temporary store (Redis). I have periodic tasks which scan the temp store for patterns which exceed thresholds. When that occurs, fail2ban creates the appropriate rules. This occurs in depth and in concentric rings. Et tu?

thomzane 3mo ago
The difference between fail2ban and reaction is performance. If you are not hitting the ceiling of fail2ban, then you may not need reaction. Do you have a blog post about your automated fail2ban rule generation?
- m3047 3mo ago
  Why should I have a blog post? I get amazing "performance" out of fail2ban, it does what it's supposed to do and I don't ask it to do more. I've given it "super powers". Last year I blocked basically all of Brazil. No problems. Who knew?

charcircuit 3mo ago

>Popa botnet It's no more of a botnet than ProtonVPN for example. Apps intentionally added the Popa SDK to their apps as a monetization method. This allows apps without ads and tracking to be financially viable. I would expect FSF to support apps being able to move off of monetization schemes that depend on tracking people so it is disappointing for them to put such alternative monetization technologies in a negative light.

thomzane 3mo ago
This monetization scheme benefits the botnet controller and the developer who added the SDK and not the user who likely did not realize they signed up to become an exit node.
- charcircuit 3mo ago
  It allows as free versions of apps to be economically viable and compete with others. It helps users because they don't need to be spied on and shown ads to fund the development of the app. The existence of an app brings users value, else they wouldn't use it.
  - nemomarx 3mo ago
    the fsf has never really been concerned with commercial viability. They're the worst audience for this sort of argument. and I doubt these apps are really Free versions - do they support user modifications and access to the code? If they did support the four freedoms maybe the fsf would have something positive to say to balance it out?
    - charcircuit 3mo ago
      You are not wrong. The FSF often takes an absolute stance on these things where they don't properly support partial steps towards more free computing.
  - ryandrake 3mo ago
    Recruiting your users' systems into a botnet is not an acceptable way to make an app "economically viable" any more than, say, installing a rootkit on their systems.

deleted 3mo ago

[deleted]

deleted 3mo ago

[deleted]