Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How the FSF sysadmins block botnets with reaction

fsf.org

Post reply on HN
Print view View original

31–40 of 87 posts

Re: How the FSF sysadmins block botnets with reaction

#31

Post by itintheory »

idoubtit wrote: post #17

That's interesting. I haven't used fail2ban for a long time, but reaction is worth evaluating. Unfortunately, that post does not describe their full configuration. Maybe it's on purpose, so that attackers can't adjust to fit. My experience is that modern web scraping had no obvious pattern, since it is proxied through many IPs. The last time a server was failing to handle the pressure, we decided to temporarily ban I…

> The last time a server was failing to handle the pressure, we decided to temporarily ban IPs from some Asian regions.

This is something we've been forced to do at work, a LOT. Some weeks it's Huawei Cloud, Tencent, and Alibaba. Other weeks it's all China Telecom. We're using Anubis where possible, but a lot of it is just whack-a-mole with residential proxies. I looked at Datadome and HUMAN, but they would be hundreds of thousands a year at our traffic scale, and I suspect may also have false positives. We abandoned CrowdSec for that reason as well.

I'd love to find a decent k8s native solution to this problem.

Re: How the FSF sysadmins block botnets with reaction

#32

Post by m3047 »

"Many sysadmins know about fail2ban..." and many will now know about reaction. But why will the result be any different than fail2ban? It won't.

I identify features (which can be expressed as firewall rules) from log data; I write totals to a temporary store (Redis). I have periodic tasks which scan the temp store for patterns which exceed thresholds. When that occurs, fail2ban creates the appropriate rules. This occurs in depth and in concentric rings.

Et tu?

Re: How the FSF sysadmins block botnets with reaction

#33

Post by charcircuit »

>Popa botnet

It's no more of a botnet than ProtonVPN for example. Apps intentionally added the Popa SDK to their apps as a monetization method. This allows apps without ads and tracking to be financially viable. I would expect FSF to support apps being able to move off of monetization schemes that depend on tracking people so it is disappointing for them to put such alternative monetization technologies in a negative light.

Re: How the FSF sysadmins block botnets with reaction

#34

Post by Groxx »

graemep wrote: post #20
Groxx wrote: post #14

Earlier quoted context omitted.

You can have preferences while not restricting legal rights.

You can, but if the exact quote in the GP is correct the claim is claiming the software is "gay, trans and anti-colonialist" and asks you not to use it. Why use a license that is designed to be politically neutral and then ask some people not to use it? What I can see is a fairly clear indication that they do not want contributions from people whose politics differ from theirs. I would also question whether governmen…

>Why use a license that is designed to be politically neutral and then ask some people not to use it?

Because you can have preferences while not restricting legal rights.

Re: How the FSF sysadmins block botnets with reaction

#35

Post by Groxx »

graemep wrote: post #30
stonogo wrote: post #24

Earlier quoted context omitted.

The aim is to reduce the number of users of the software who are uncomfortable with those who are gay, trans, and/or anticolonial, probably because dealing with such people is a heavier burden than the other kind.

How would a you even know whether a user was uncomfortable with any of those things? Why would someone with a particular political stance be a heavier burden on maintainers? How would you even know how someone felt - if someone reports a bug it is highly unlikely they are going to add something like "I am uncomfortable with gays" are they? Nor is it going to be in the comments in contributed code. It sounds more like…

You seem to be drastically overcomplicating this. They are asking people who are uncomfortable with it to not use it. The people who are uncomfortable with it are the ones deciding, nothing at all in there implies that they are deciding who is uncomfortable.

Re: How the FSF sysadmins block botnets with reaction

#36

Post by McGlockenshire »

graemep wrote: post #30
stonogo wrote: post #24

Earlier quoted context omitted.

The aim is to reduce the number of users of the software who are uncomfortable with those who are gay, trans, and/or anticolonial, probably because dealing with such people is a heavier burden than the other kind.

How would a you even know whether a user was uncomfortable with any of those things? Why would someone with a particular political stance be a heavier burden on maintainers? How would you even know how someone felt - if someone reports a bug it is highly unlikely they are going to add something like "I am uncomfortable with gays" are they? Nor is it going to be in the comments in contributed code. It sounds more like…

[flagged]

Re: How the FSF sysadmins block botnets with reaction

#37

Post by naturalmovement »

Groxx wrote: post #34
graemep wrote: post #20

Earlier quoted context omitted.

You can, but if the exact quote in the GP is correct the claim is claiming the software is "gay, trans and anti-colonialist" and asks you not to use it. Why use a license that is designed to be politically neutral and then ask some people not to use it? What I can see is a fairly clear indication that they do not want contributions from people whose politics differ from theirs. I would also question whether governmen…

> Why use a license that is designed to be politically neutral and then ask some people not to use it? Because you can have preferences while not restricting legal rights.

[flagged]

Re: How the FSF sysadmins block botnets with reaction

#39

Post by thomzane »

cyanydeez wrote: post #5
kaladin-jasnah wrote: post #3

Earlier quoted context omitted.

> AI monied interests that fund the FSF Can you elaborate on who these interests are precisely?

I tried: https://www.fsf.org/patrons ; the last FY listed is 2020.

The patrons page is updated regularly.

Re: How the FSF sysadmins block botnets with reaction

#40

Post by thomzane »

idoubtit wrote: post #17

That's interesting. I haven't used fail2ban for a long time, but reaction is worth evaluating. Unfortunately, that post does not describe their full configuration. Maybe it's on purpose, so that attackers can't adjust to fit. My experience is that modern web scraping had no obvious pattern, since it is proxied through many IPs. The last time a server was failing to handle the pressure, we decided to temporarily ban I…

iptables has been mostly a wrapper for nftables for some time now. The choice of iptables + ipset with reaction is the difference in their configuration. Compare restart performance between the ipset and nftables example configurations with lists of greater than 1 million IPs.
Post reply on HN