Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

418 I'm a teapot

developer.mozilla.org

Post reply on HN
Print view View original

121–130 of 195 posts

Re: 418 I'm a teapot

#121

Post by GuB-42 »

ricardobayes wrote: post #77
geuis wrote: post #59

Many years ago, some person misconfigured their squid proxy and was hitting https://jsonip.com to the point my server at the time was turning green in the gills. I started responding with 418 "You are a tea kettle" or something like that to those specific requests. The originating dev actually paid attention to their error messages and quickly resolved their config issue. Fast forward to March this year. Some fucking…

No, sorry this is 100% on you. You should have implemented throttling, and daily query limits. Once you put something on the internet for free, you can't complain then if people are using it.

I would have agreed if it was a piece of source code. For example if you put a bit of code on the internet using a permissive license and it is good, don't complain that some tech giant took all your work for themselves without giving you anything in return. By choosing that licence you explicitly told the world that doing this is fine. Also, using someone else source code doesn't incur recurring costs on the author's part.

But here, you are actually taking resources from the author. That's something that is not only rude, but also puts the user at risk. The author is really nice for maintaining service, he could have just stopped it, or even served malicious payloads. After all, there is no contract saying that he should be nice. Here, despite the strong language, he is trying to stay nice instead of just cutting a service that many people rely on, which he has all right to do.

Throttling and daily query limits would make the service unreliable and not so different from cutting it off completely. Keep in mind that it is not a single user abusing the service, it is many users who got redirected there by an abusive app. He could have used the "API key" that is suggested here, but it is a hurdle that will affect usability.

Re: 418 I'm a teapot

#122

Post by nitrammm »

wiseowise wrote: post #120
nitrammm wrote: post #109

Earlier quoted context omitted.

It says: > Supports unlimited requests and is free. Typically "unlimited" is more than a million.

Water in a lake is also technically free (depending on local laws), do I have to make it clear that inviting millions to take a cup out of it is not a good idea?

This is the internet? If there are a million people around the lake fond of tea then of course you need to tell them that they can't consume all the water. Offering a free service and being upset when people use it is just naive.

Re: 418 I'm a teapot

#123

Post by nitrammm »

Dudeman112 wrote: post #116
nitrammm wrote: post #95

Earlier quoted context omitted.

Explicitly telling some junior software developer in China that he can call an API for free an unlimited number of times, then afterwards calling it abuse and him and a-hole dev is definitively a bit of an a-hole thing to do in my view.

There's always an individual with autism-level consideration for what one says, isn't there? No, effectively DDOS-ing a service just because it says it's free and unlimited is a dick move People like those are a big reason for why we can't have nice things

To me it just screams naivety to put up a free service, advertise it as unlimited and then calling people asshole when they make too many requests.

Personally I would never rely on a service like this since it's 100% obvious it would be sudpectible to junior developers misunderstanding what is reasonable usage.

If you're putting up an API assuming all consumers will consume it in some limited and reasonable way, then you need to rethink things a bit.

Re: 418 I'm a teapot

#124

Post by corobo »

Dudeman112 wrote: post #116
nitrammm wrote: post #95

Earlier quoted context omitted.

Explicitly telling some junior software developer in China that he can call an API for free an unlimited number of times, then afterwards calling it abuse and him and a-hole dev is definitively a bit of an a-hole thing to do in my view.

There's always an individual with autism-level consideration for what one says, isn't there? No, effectively DDOS-ing a service just because it says it's free and unlimited is a dick move People like those are a big reason for why we can't have nice things

> There's always an individual with autism-level consideration for what one says, isn't there?

What does this sentence even mean lmao

Autism-level consideration for what one says or not, if you say something is unlimited I'm going to take your word for it. If it's limited, tell me the limits. If it's free to a point, tell me the point. If I need to bust out the CC, tell me I need to bust out the CC.

Don't say your thing is free and unlimited if you can't handle unlimited traffic for free..

Hacker News would be on the complete opposite end of the anger scale if this was an ISP telling their users they can't actually use the "unlimited" they promised, haha

Re: 418 I'm a teapot

#125

Post by ransackdev »

geuis wrote: post #59

Many years ago, some person misconfigured their squid proxy and was hitting https://jsonip.com to the point my server at the time was turning green in the gills. I started responding with 418 "You are a tea kettle" or something like that to those specific requests. The originating dev actually paid attention to their error messages and quickly resolved their config issue. Fast forward to March this year. Some fucking…

> That kind of increase in traffic costs me money I've never had to plan for.

https://getjsonip.com/#plus

  Going further with jsonip Plus
  With the upcoming Plus service, you get special features and 
  even more information about your users.

    - All of the free service features
    - IP geo location - Country and city to within best available accuracy
    - ISP Info
    - Time zone data
    - Full referer data
    - Browser and OS info
https://web.archive.org/web/20200811215649/https://getjsonip...

A paid service has been "upcoming" since at least August 2020, which would subsidize the free tier usage you allow on your site. Aside from the ISP and geo data, everything else is given to you in the request headers or can be determined with the ip address (geo can get tz).

If it's costing you money, shipping the Plus features might offset your out of pocket expenses.

This is a failure of growth/capacity planning and lack of a proper TOS that clarifies "unlimited within reason and at our sole discretion with no SLA or warranty of any kind for non-paying users", as well as failure to ship any monetizing features 3 years after announcing it.

Contacting them to have them stop wouldn't solve your problems. What happens when the next million devices get random updates from literally anybody that starts doing it again? Try to implement rate limiting, optimize your hot code paths, watch out for slow clients (buffered reverse proxies), needless header parsing, slow template rendering, etc. Any language capable of concurrency should be able to handle 100s of thousands of requests on a cheap vm. The client ip is coming to you in the request headers and all you do is print it back to them... A go handler would be a few lines of code to do this and that's including dealing with reverse proxy real-ip type stuff. You don't need to allocate an actual struct and serialize into a json object, just printf a hardcoded string with a replacement for the ip from the header, or better yet benchmark the fastest solution.

I'll do it for you, I'm looking for a job ;)

Re: 418 I'm a teapot

#126

Post by sva_ »

aledalgrande wrote: post #38

There was a movement to protect this HTTP code from boring committees: https://en.wikipedia.org/wiki/Hyper_Text_Coffee_Pot_Control_... Protect the code!

I like it when people come together for something so silly.

Re: 418 I'm a teapot

#127

Post by timbuchwaldt »

geuis wrote: post #59

Many years ago, some person misconfigured their squid proxy and was hitting https://jsonip.com to the point my server at the time was turning green in the gills. I started responding with 418 "You are a tea kettle" or something like that to those specific requests. The originating dev actually paid attention to their error messages and quickly resolved their config issue. Fast forward to March this year. Some fucking…

We see your exact Dalvik problem on deepl.com as well. We get a constant flood of those requests, sometimes subsiding. They are globally distributed, preliminary in lower-income countries. We have tried lots of things, like letting them just time out, returning different errors, redirecting of many sorts including Android intents, no solution. They now made it to our permanent blocklist and we just deal with the useless additional traffic. We are still hyper curious what on earth is loading us and for what reason though. AFAIK we couldn't see translation requests from them, just loading our website.

Re: 418 I'm a teapot

#129

Post by ransackdev »

lloeki wrote: post #102
ozr wrote: post #62

Earlier quoted context omitted.

You're a better person than me. I'd start returning nonsense like `999.9` to see if I could trigger a ton of bug reports for someone.

other evil ideas: - return a 200 with broken JSON, possibly triggering parse errors or exceptions in the caller - return a payload that generates catastrophic resource consumption on the other end, e.g Content-Encoding: gzip and feed it a deflate bomb - hack TCP and/or TLS to leave the other end waiting/stalling in an attempt to rate limit (timeout) or starve resources (ulimit) on the other end (e.g abuse 3 way hands…

The site advertises itself as free for all and unlimited usage. To suddenly return malicious responses to intentionally break these apps might very well be illegal in many countries, or maybe would make them liable for damages claims. These clients are not violating any TOS or doing anything not allowed, after all.

Re: 418 I'm a teapot

#130

Post by [deleted] »

ransackdev wrote: post #125
geuis wrote: post #59

Many years ago, some person misconfigured their squid proxy and was hitting https://jsonip.com to the point my server at the time was turning green in the gills. I started responding with 418 "You are a tea kettle" or something like that to those specific requests. The originating dev actually paid attention to their error messages and quickly resolved their config issue. Fast forward to March this year. Some fucking…

> That kind of increase in traffic costs me money I've never had to plan for. https://getjsonip.com/#plus Going further with jsonip Plus With the upcoming Plus service, you get special features and even more information about your users. - All of the free service features - IP geo location - Country and city to within best available accuracy - ISP Info - Time zone data - Full referer data - Browser and OS info https:…

[deleted]
Post reply on HN