Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Kvak.io – Online Notepad

kvak.io

Post reply on HN
Print view View original

41–50 of 62 posts

Re: Show HN: Kvak.io – Online Notepad

#46

Post by stevekemp »

Jaruzel wrote: post #40
stevekemp wrote: post #8

Earlier quoted context omitted.

I created https://markdownshare.com/ to allow anybody to create/share/render markdown. Unfortunately these kind of sites are an abuse magnet, so it is in the process of being retired. I think any sustainable site/service like this has to be self-hosted, or come with a subscription. Because otherwise dealing with all the bots, spam-submissions, and other abuse is just too depressing.

Can you expand on the types of abuse you saw? Was it all just spam, or was some of it legitimately 'dodgy' ?

A combination of (bot) IP addresses making 20+ requests a second, to post SPAM. Half the abuse was people just making lots of requests in short spaces of time, the other half was just people submitting spam, more slowly. I added rate-limiting to deal with the worst offenders, but mostly they'd keep POSTing away, ignoring the error-codes I was sending.

All submissions would get a random ID, something like this example chosen at random:

https://markdownshare.com/view/b5abadcc-c0fb-473e-a34d-f27c0...

There were numerous bots who'd try to spider/probe the site collecting all the links. Handling millions of 404s a month wasn't much of a pain, because the service was pretty efficient, but it was just another source of annoyance.

Finally, and God only knows how, I'd get a ton of DCMA takedown notices for alleged copyright infringement. That's what pushed me over the edge into first of all making it read only, and secondly planning to kill it at the end of the year.

Re: Show HN: Kvak.io – Online Notepad

#47

Post by andrewla »

natpalmer1776 wrote: post #43
andrewla wrote: post #39

A possible security concern is that this can store arbitrary HTML, including script. http://kvak.io/?n=f9f2o1r2pd64

Ironic how you posted a note without a password so anyone immature enough (me) could just tamper with your example.

That breaks the visitor counter, since it relied on updating the underlying document to update the counts!

I was going to go ahead and hide the lock button entirely to avoid this attack, but decided I would get some work done today instead.

EDIT: after a bit more hacking, I removed the password and hid the lock button. Nothing that would stop a determined adversary :) (Also, I kept the Khajit change in your honor)

Re: Show HN: Kvak.io – Online Notepad

#48

Post by Jaruzel »

stevekemp wrote: post #46
Jaruzel wrote: post #40

Earlier quoted context omitted.

Can you expand on the types of abuse you saw? Was it all just spam, or was some of it legitimately 'dodgy' ?

A combination of (bot) IP addresses making 20+ requests a second, to post SPAM. Half the abuse was people just making lots of requests in short spaces of time, the other half was just people submitting spam, more slowly. I added rate-limiting to deal with the worst offenders, but mostly they'd keep POSTing away, ignoring the error-codes I was sending. All submissions would get a random ID, something like this example…

Wow thanks for that. Makes one stop and think before coding anything similar. :(

Re: Show HN: Kvak.io – Online Notepad

#50

Post by levmiseri »

baxtr wrote: post #42

Very interesting tool. I wonder what the business model behind this might be. How do you intend to make money? Do you even want to make money with this?

I don't intend to make money out of this. A happy little side project that's easy to maintain and improve over time.
Post reply on HN