I'm curious to know whether the objects were stored with Cache-Control: or Expires: headers. Does having such headers make a difference?
Clearly the client's not presenting If-Modified-Since: pragmas as I believe S3 honors those.
How I attacked myself using Google and I ramped up a $1000 bandwidth bill
111–120 of 152 posts
Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill
#112>"But how come did Google download the images again and again?" "But how come did" indeed.
Communication skills matter, sorry.
Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill
#113Earlier quoted context omitted.
About an hour is the standard time for external data in Google Spreadsheet to be refreshed. I've come across this with JSON data.
Even if noone has it open in a browser? Or they do have it open, but haven't interacted with it? In either case, this seems odd, unless the URL is especially noted as 'volatile', and/or there are other parts of the spreadsheet that might trigger conditional calculations/notifications based on that URL's contents. (And don't S3 resources have last-modified-dates or etags for conditional GETs?)
I don't remember, but it wouldn't surprise me, that way it updates correctly for offline mode and if you have conditional logic it can work on changed data. It also improves page load time, which is very important for Google in general but doubly so for an online office suite (Excel opens quickly, so should a Google spreadsheet).
Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill
#114I cannot help notice that Hetzner offers 5000 GB/month AND a full dedicated server, for 39 EUR (51 USD) [1], so his traffic would have cost him at that rate a total of 100 USD if he were to use a dedicated server instead of Amazon. (before mentioning Amazon's scalability, consider that Hacker News is ran on a single dedicated server, and the moral of the story seems to be how not to scale especially when you don't wa…
For me biggest reason to use AWS is ease of use and APIs. I have used dedicated servers before but with AWS I don't even think about servers. Application is somewhere sitting in the cloud and it will scale, if required or I will get alert if something is not right.
Also, majority of people will not be needing more than a single EC2 instance which costs ~$20 a month, lesser for Linux. Amazon reviews and lowers prices periodically.
Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill
#115Amusing thing about that page - it's full of '\$100', and uses Javascript to strip the \'s out, replacing them with empty elements. Not sure I really want to know why...
Mathjax :-)
Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill
#116Earlier quoted context omitted.
Like the author notes, I don't think the problem was with Google. It was no fault of theirs. The reason: It's a fine line between maintaining privacy policies and managing such events. If google were storing/caching these links, there would have been an outcry from those worried about user privacy and stuff. About the by-the-hour downloads, well there again is a trade-off between providing data quickly and doing a la…
I don't understand the privacy concern - a publicly accessible URL doesn't offer any privacy. It's the same as a transparent proxy.
A password works by there is a piece of text that only you know, and thus, when you give that password to a server, that server knows who you are.
can't you also view a url as a password? (If only I know the url, then only I can download the file).
I am able to give out a url to someone else, so they can access the file, likewise, I can give out my file server's username and password, and whoever has it can also access my files.
Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill
#117If I wanted to launch an attack on something like Instagram all I would need to do is put a bunch of images (hosted on instagram) into a Google Spreadsheet? Then the google crawler will come through and download them all once an hour?
That's what I'm wondering too, I don't see how this would work on a normal website since a normal website probably wouldn't be whitelisted by Google like AWS is... What am I missing here?
Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill
#118This is the same kind of attack. I've demonstrated here. But for users of a popular analytic service.
http://news.ycombinator.com/item?id=3873774
Re: How I attacked myself using Google and I ramped up a $1000 bandwidth bill
#119This is the same kind of attack. I've demonstrated here. But for users of a popular analytic service.
http://news.ycombinator.com/item?id=3873774