131–140 of 146 posts
Ah Major Hayden. Great guy. I remember getting a crash course on system administration in Slicehost’s IRC channel because some idiot ran an ancient Java application server on an open port. We got hacked and I got volun-told to clean up the mess because I was the only person running Linux on my laptop. Everyone was so nice and I learned so much. I owe them all a lot of drinks. :)
Earlier quoted context omitted.
Really interesting. I never heard of this website and was surprised to hear this volume of traffic it's getting. (I always used curlmyip.org or whatsmyip.net|.com). I wonder what is the rationale for providing a non-rate limited service that can be easily abused like this. The volume almost suggests some stuff like IoT devices or other software use this to test internet connectivity. Or botnets?
>Seeing that over 90% of my traffic load was malicious and abusive was frustrating. Dealing with the abuse emails and complaints was worse. My take. I suspect Cloudflare benefited allowing that traffic. It's another data point/tool in their toolbox against the baddies.
what an amazing letter, thank you for your service! icanhazip is part of internet lore, and passing it on to Cloudflare is a very noble thing to do! Cloudflare, please stay true to the idealistic principles of simplicity and availability for the service.
For ridiculously easy things like this, I think it's smarter for you to just host it yourself. This way you are not forcing other people to carry your burden. nginx config example: location /ip { add_header Content-Type "application/json"; return 200 '{"host":"$server_name","ip":"$remote_addr","port":"$remote_port","server_ip":"$server_addr","server_port":"$server_port "}\n'; } Which will return something like this i…
Ok, I'll bite... What kind of machine do you host this on that can handle 400,000 of these requests (with TLS mind you) per second? That was the load he mentions it handling in 2021, he stopped mentioning requests per day metrics after that.
If your use case calls for 400k/reqs a second on what your IP is and you haven't yet figured out how to build out your infrastructure(or pay someone to do it for you), you have bigger problems than figuring our what your public IP is.
For ridiculously easy things like this, I think it's smarter for you to just host it yourself. This way you are not forcing other people to carry your burden. nginx config example: location /ip { add_header Content-Type "application/json"; return 200 '{"host":"$server_name","ip":"$remote_addr","port":"$remote_port","server_ip":"$server_addr","server_port":"$server_port "}\n'; } Which will return something like this i…
My favorite: https://cloudflare.com/cdn-cgi/trace
I made a site like this to mess with a guy at work. Everyone knew of IPChicken, and his last name is Herring, so I created IPHerring. I'd put Photoshopped images of him on the site for different holidays and coworkers always thought it was hilarious. They would even send me ideas of what to put next. Now I sometimes use AI image generation tools to really make it stand out. It's been a lot of fun. A lot of the tech f…
Earlier quoted context omitted.
There's a whole list of such resolvers: Akamai: dig +short whoami.akamai.net @ns1-1.akamaitech.net Google: dig +short o-o.myaddr.l.google.com txt @ns1.google.com Cloudflare: dig +short whoami.cloudflare ch txt @1.1.1.1 OpenDNS: dig -4 +short myip.opendns.com @resolver1.opendns.com Note that if you leave off the `@service.authoritative.nameserver` portion of all of the above, you get the IP address of the recursive re…
Cudos: Akamai also doesn't put the returned IP address in quotes, unlike Google and Cloudflare.
Earlier quoted context omitted.
sni=plaintext There was a great trial CF ran for a long period with a previous version of encrypted SNI (now ECH). One could get encrypted SNI with any site using CF via modified OpenSSL. But they stopped this experiment. Meanwhile ECH was still not ready. If anyone is getting something other than "sni=plaintext" for a CF domain besides crypto.cloudflare.com, then please let us know how.
Isn't ECH still off by default in most browsers? The latest info I could find has it implemented but opt-in behind experimental flag in both Firefox and Chrome, and not supported at all in Safari.
Earlier quoted context omitted.
I can't say a thing about efficiency, but for maintainability, I have to disagree. This seems to be a rust library, and for maintaining that, you'd need to write a program, compile it every time some updates come by, rerun the recompiled program, ... With the parent comment example, all you need is nginx, available as a package on all distros, and a single static config file. With an auto-updating package manager and…
I would trust the rust compile/rerun process a lot more than an auto-updating linux distribution, personally. Sooner or later that auto-updating package manager will break your config file, itself, or both.
Earlier quoted context omitted.
I would trust the rust compile/rerun process a lot more than an auto-updating linux distribution, personally. Sooner or later that auto-updating package manager will break your config file, itself, or both.
That is true, yeah. But the library in question will also eventually break the existing API / stop supporting compatible releases with security patches. I assume this nginx config will still work for many releases in the future.
Maybe. I have more faith in a Rust library to maintain API backward compatibility than a Linux distro, is what I'm saying.