Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How the FSF sysadmins block botnets with reaction

fsf.org

Post reply on HN
Print view View original

21–30 of 87 posts

Re: How the FSF sysadmins block botnets with reaction

#21

Post by xena »

wasmperson wrote: post #19
superkuh wrote: post #18

Earlier quoted context omitted.

Anubis does support the no-JS HTTP meta-redirect proof of work but few know about it and fewer enable it. And it may not block everything .

I indeed did not know about this. There seem to be some caveats: https://anubis.techaro.lol/docs/admin/configuration/challeng... I guess for the meta refresh challenge it's less "proof of work" and more "proof of patience".

The meta refresh challenge actually uses time as the proof! It makes sure you wait for at least 75% of the time the administrator configured and adds client side smear to ensure that browser temporal randomization doesn't trigger a false failure.

Re: How the FSF sysadmins block botnets with reaction

#22

Post by xena »

wasmperson wrote: post #16

It's somewhat interesting to see the FSF's approach to this. From what I understand they can't really use something like anubis since they want their websites to be accessible without javascript: https://www.gnu.org/philosophy/javascript-trap.html Users can't consent to running a page's javascript the way they can consent to running a program they've intentionally downloaded, so it's effectively "non-free" regardless…

For what it's worth, Anubis supports LibreJS: https://github.com/TecharoHQ/anubis/blob/main/web/build.sh#L...

Re: How the FSF sysadmins block botnets with reaction

#23

Post by BigTTYGothGF »

wasmperson wrote: post #16

It's somewhat interesting to see the FSF's approach to this. From what I understand they can't really use something like anubis since they want their websites to be accessible without javascript: https://www.gnu.org/philosophy/javascript-trap.html Users can't consent to running a page's javascript the way they can consent to running a program they've intentionally downloaded, so it's effectively "non-free" regardless…

> can't

Won't, they call it malware: https://www.fsf.org/blogs/sysadmin/our-small-team-vs-million...

Re: How the FSF sysadmins block botnets with reaction

#24

Post by stonogo »

graemep wrote: post #20
Groxx wrote: post #14

Earlier quoted context omitted.

You can have preferences while not restricting legal rights.

You can, but if the exact quote in the GP is correct the claim is claiming the software is "gay, trans and anti-colonialist" and asks you not to use it. Why use a license that is designed to be politically neutral and then ask some people not to use it? What I can see is a fairly clear indication that they do not want contributions from people whose politics differ from theirs. I would also question whether governmen…

The aim is to reduce the number of users of the software who are uncomfortable with those who are gay, trans, and/or anticolonial, probably because dealing with such people is a heavier burden than the other kind.

Re: How the FSF sysadmins block botnets with reaction

#25

Post by BigTTYGothGF »

graemep wrote: post #20
Groxx wrote: post #14

Earlier quoted context omitted.

You can have preferences while not restricting legal rights.

You can, but if the exact quote in the GP is correct the claim is claiming the software is "gay, trans and anti-colonialist" and asks you not to use it. Why use a license that is designed to be politically neutral and then ask some people not to use it? What I can see is a fairly clear indication that they do not want contributions from people whose politics differ from theirs. I would also question whether governmen…

> What I can see is a fairly clear indication that they do not want contributions from people whose politics differ from theirs

This is the same FSF that in the past has refused contributions from people whose politics include "I would like this software to run on my windows/apple/other proprietary platform". They're extremely political.

Re: How the FSF sysadmins block botnets with reaction

#26

Post by seki285 »

Bender wrote: post #15

My personal preference is to 'ip route add blackhole ${net}' as it has the lowest CPU overhead and I can add hundreds of thousands of CIDR blocks with no noticeable impact. The only downside is that it won't stop UDP packets from getting to a UDP listener. There will not be a response but the application will still see it. For my TCP daemons it's great. grep -m1 -E ^Tot /proc/net/fib_triestat ;ip route | grep -Fc bla…

I would like to learn more how you maintain your table of IP ranges (or CIDR block). How do you decide when to add/remove a range?

I'm most concerned about blocking innocent users, currently I use Cloudflare to block known bad ASNs using a list I found on GitHub.

Re: How the FSF sysadmins block botnets with reaction

#27

Post by collinfunk »

BigTTYGothGF wrote: post #25
graemep wrote: post #20

Earlier quoted context omitted.

You can, but if the exact quote in the GP is correct the claim is claiming the software is "gay, trans and anti-colonialist" and asks you not to use it. Why use a license that is designed to be politically neutral and then ask some people not to use it? What I can see is a fairly clear indication that they do not want contributions from people whose politics differ from theirs. I would also question whether governmen…

> What I can see is a fairly clear indication that they do not want contributions from people whose politics differ from theirs This is the same FSF that in the past has refused contributions from people whose politics include "I would like this software to run on my windows/apple/other proprietary platform". They're extremely political.

When did this occur? I am a GNU maintainer, and have never heard such a thing from the FSF. The GNU Coding Standards and other similar texts leave the decision to support non-free platforms up to the maintainer.

Re: How the FSF sysadmins block botnets with reaction

#28

Post by Bender »

seki285 wrote: post #26
Bender wrote: post #15

My personal preference is to 'ip route add blackhole ${net}' as it has the lowest CPU overhead and I can add hundreds of thousands of CIDR blocks with no noticeable impact. The only downside is that it won't stop UDP packets from getting to a UDP listener. There will not be a response but the application will still see it. For my TCP daemons it's great. grep -m1 -E ^Tot /proc/net/fib_triestat ;ip route | grep -Fc bla…

I would like to learn more how you maintain your table of IP ranges (or CIDR block). How do you decide when to add/remove a range? I'm most concerned about blocking innocent users, currently I use Cloudflare to block known bad ASNs using a list I found on GitHub.

How do you decide when to add/remove a range?

The only IP's that come and go are the Tor 30 day blocklist and a couple FireHOL attackers from a repo though I will sometimes leave the last entries live until reboot. I do not really need to block tor but I use this silly blog as a testing ground. Tor and some known abusers come from a git repo I refresh periodically.

The data-centers, VPS providers, CDNs, known botnets are perma-banned. For my hobby nodes I personally find this acceptable. I would not do this in a professionally managed data-center. There are better methods for those cases especially for B2B corporate arrangements. Regardless of what daemons I run I never have external dependencies that need to be accessed from my node or from the client with exception of stratum-1 time servers.

I do have to periodically update the CIDR blocks for given ASN's. I have not automated this but I probably should some day. It's not hard to automate, I am just excessively "efficient". I was told to stop calling myself lazy, but I am.

Methods 2, 3 and 5 are the ones I talk about here. [1]

[1] - https://nochan.net/b/Internet-Crap/20260606-How-To-Block-Som...

Re: How the FSF sysadmins block botnets with reaction

#29

Post by m3047 »

cyanydeez wrote: post #2

are scrapers attackers? I get they're DDoS; but take the mask off, and arn't they just the AI monied interests that fund the FSF? and a lot of them are just active inference, eg, the user is trying to ask about something and the AI monied interests setup a web scraper to go and get that data. Just seems like no one wants to call out the hand that feeds them in a human centipede that's best described as the torment ne…

Anything which fills my logs with garbage is unwanted. Your cat could have fallen asleep on the keyboard, I don't care. If you want to use the internet as a giant petri dish, that's on you; but the cat box is elsewhere. I can feed you garbage or block you because your code is shit, or I don't like your style.

Re: How the FSF sysadmins block botnets with reaction

#30

Post by graemep »

stonogo wrote: post #24
graemep wrote: post #20

Earlier quoted context omitted.

You can, but if the exact quote in the GP is correct the claim is claiming the software is "gay, trans and anti-colonialist" and asks you not to use it. Why use a license that is designed to be politically neutral and then ask some people not to use it? What I can see is a fairly clear indication that they do not want contributions from people whose politics differ from theirs. I would also question whether governmen…

The aim is to reduce the number of users of the software who are uncomfortable with those who are gay, trans, and/or anticolonial, probably because dealing with such people is a heavier burden than the other kind.

How would a you even know whether a user was uncomfortable with any of those things? Why would someone with a particular political stance be a heavier burden on maintainers? How would you even know how someone felt - if someone reports a bug it is highly unlikely they are going to add something like "I am uncomfortable with gays" are they? Nor is it going to be in the comments in contributed code. It sounds more like that the maintainers are uncomfortable with people who are not like themselves.
Post reply on HN