Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

999 Request Denied

http.dev

Post reply on HN
Print view View original

31–40 of 74 posts

Re: 999 Request Denied

#31

Post by verandaguy »

soxocx wrote: post #8

> When sending an HTTP GET or HEAD request to LinkedIn for a specific profile [...] > It will also be returned if there are too many HTTP requests in a single day. This is similar to the HTTP 429 Too Many Requests error message. Similar? That is excatly what 429 was made for, or not? This is weird or just lazy.

Either a 429 in the latter case or a method not allowed (iirc 405) in the former. 429 I kinda get not having since it’s less than a decade old which seems to be the cutoff point for some larger companies, but 405’s been around for a long while.

Re: 999 Request Denied

#32

Post by capableweb »

gostsamo wrote: post #17

This is super unprofessional. 999 means nothing, therefore it cannot be acted upon, therefore it is totally useless. Best description which I can come up with is "I don't like you and I won't say why, because I don't like you". The expected client behavior is sending in return an empty http post request with wtf header and value "I feel this server is passive aggressive towards me."

> therefore it cannot be acted upon, therefore it is totally useless

From the examples, this seem to be the point. If you receive a 429, you know you can just backoff a bit and it'll work at a later point, but if you receive 999, you're not sure how to proceed, which seems to be what they (the service) wants.

Re: 999 Request Denied

#33

Post by _cenw »

afavour wrote: post #29
soxocx wrote: post #8

> When sending an HTTP GET or HEAD request to LinkedIn for a specific profile [...] > It will also be returned if there are too many HTTP requests in a single day. This is similar to the HTTP 429 Too Many Requests error message. Similar? That is excatly what 429 was made for, or not? This is weird or just lazy.

I’m assuming the logic is that LinkedIn uses 999 in combatting crawler bots so they don’t want to give reasons why the request is denied. That would help the bot overcome the restriction. e.g. it might be because you’ve sent too many requests but it also might be that your user agent is blocklisted. Obviously it’s bad practise to do this but I don’t think it’s a mystery why they’d want their denial to be opaque. I’m…

The correct status code for that is 400, the generic "something you did is wrong" or 403, the generic "go away".

Re: 999 Request Denied

#35

Post by kvdveer »

gostsamo wrote: post #17

This is super unprofessional. 999 means nothing, therefore it cannot be acted upon, therefore it is totally useless. Best description which I can come up with is "I don't like you and I won't say why, because I don't like you". The expected client behavior is sending in return an empty http post request with wtf header and value "I feel this server is passive aggressive towards me."

> This is super unprofessional. 999 means nothing, therefore it cannot be acted upon

Given that this seems to be bot-protection, that might actually be the point. It's basically saying; "I don't want you here, don't try to resolve this". Or in other words "F*ck off"

Re: 999 Request Denied

#36

Post by dcminter »

janfoeh wrote: post #23

I am wondering if it might have been chosen as a joke... 999 is a homonym for the German "nein, nein, nein" (no, no, no), which is rather fitting for a "go away" status code.

Or in the UK it's the telephone number for the emergency services, so suggesting "I'll call the police on you!" to unwelcome traffic.

More likely they just used it because it's one end of the 3 digit range and a "proper" code would leak information to the unwelcome traffic about what they did to get blocked (making it easier to avoid). Apparently some services already use 000 for other purposes (TIL).

Re: 999 Request Denied

#37

Post by AnimalMuppet »

Y_Y wrote: post #25
gostsamo wrote: post #17

This is super unprofessional. 999 means nothing, therefore it cannot be acted upon, therefore it is totally useless. Best description which I can come up with is "I don't like you and I won't say why, because I don't like you". The expected client behavior is sending in return an empty http post request with wtf header and value "I feel this server is passive aggressive towards me."

Time to draft a pass-ag RFC

No, see, if you draft a pass-ag RFC, then the response codes in there are in some sense standard ones. So if we're going to go pass-ag on you, we're going to use some other codes.

And there's really no limit. If I'm going to be nonstandard, I could use more than three digits in the error code. I could use hex. I could use full text. The possibilities are limitless.

Re: 999 Request Denied

#38

Post by afavour »

_cenw wrote: post #33
afavour wrote: post #29

Earlier quoted context omitted.

I’m assuming the logic is that LinkedIn uses 999 in combatting crawler bots so they don’t want to give reasons why the request is denied. That would help the bot overcome the restriction. e.g. it might be because you’ve sent too many requests but it also might be that your user agent is blocklisted. Obviously it’s bad practise to do this but I don’t think it’s a mystery why they’d want their denial to be opaque. I’m…

The correct status code for that is 400, the generic "something you did is wrong" or 403, the generic "go away".

Sure but I imagine you’d want to track real 400 errors (e.g. your POST request contains the wrong parameters) in analytics to ensure you haven’t introduced a bug in your code. Categorising bot repellant responses along with that would likely be very noisy.

Again I’m not really defending the practise, I think it’s bad, I can just clearly see how they ended up where they ended up.

Re: 999 Request Denied

#39

Post by arp242 »

afavour wrote: post #29
soxocx wrote: post #8

> When sending an HTTP GET or HEAD request to LinkedIn for a specific profile [...] > It will also be returned if there are too many HTTP requests in a single day. This is similar to the HTTP 429 Too Many Requests error message. Similar? That is excatly what 429 was made for, or not? This is weird or just lazy.

I’m assuming the logic is that LinkedIn uses 999 in combatting crawler bots so they don’t want to give reasons why the request is denied. That would help the bot overcome the restriction. e.g. it might be because you’ve sent too many requests but it also might be that your user agent is blocklisted. Obviously it’s bad practise to do this but I don’t think it’s a mystery why they’d want their denial to be opaque. I’m…

I suspect they intentionally break the HTTP spec for a similar reason: it will break some standard crawlers/bots, stop automatic retries, and things like that. This is trivial to account for of course, but it'll stop some script kiddies.

Re: 999 Request Denied

#40

Post by richbell »

chrismorgan wrote: post #11

This is just wrong and bad . The uses described should very clearly be 403 Forbidden where it’s refusing to respond based on user-agent, and 429 Too Many Requests where it’s rate limiting. The spec says https://www.rfc-editor.org/rfc/rfc9110#section-15-6 >: > Values outside the range 100..599 are invalid. Implementations often use three-digit integer values outside of that range (i.e., 600..999) for internal communic…

> The uses described should very clearly be 403 Forbidden where it’s refusing to respond based on user-agent, and 429 Too Many Requests where it’s rate limiting.

That's precisely why LinkedIn returns 999, they're telling you to bugger off. Nobody thinks this is a good idea.

Post reply on HN