Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

418 I'm a teapot

developer.mozilla.org

Post reply on HN
Print view View original

131–140 of 195 posts

Re: 418 I'm a teapot

#131

Post by revolvingocelot »

ranguna wrote: post #89
usrbinbash wrote: post #88

Earlier quoted context omitted.

> you can't complain then if people are using it. Yes he can complain, and bombarding a free service for unlimited requests isn't okay. For starters because the people doing that, will usually be among the first to cry when the free service stops being free, blocks their requests or suddenly requires an API key.

> bombarding a free service for unlimited requests isn't okay Hummmm.... OP's website on https://getjsonip.com/ says: > Supports unlimited requests and is free. Seems like we have a bit of a contradiction here.

Back in highschool, my friends and I got kicked out of a buffet restaurant. Every movie I've ever seen a poster for suggests that it's "Only in Theatres", yet I've held many a DVD release in my hands.

There's something about reasonability and fair-use and use over time going on here, but I just can't put my finger on it.

Re: 418 I'm a teapot

#132

Post by maccard »

geuis wrote: post #70
dannyw wrote: post #64

Earlier quoted context omitted.

Your website on https://getjsonip.com/ says: > Supports unlimited requests and is free. Maybe update that text? There is no guidance on acceptable thresholds, rate limits, etc.

Yeah I know. That is a legit critique. What's been happening is your essential black swan event. I've been running the service for 12 years and have never had this problem. There are hundreds of websites and independent users that have never abused the api like this until March. I have always been able to absorb the traffic impact. This is different. Someone wasn't thinking and randomly added the domain to a lazy pie…

> The only way I've been able to keep jsonip active is by incorporating Cloudflare. But they don't actually solve the problem. As a corporation, they treat ipv4 addresses like 3rd class citizens.

Don't get me wrong, you're doing the world a service with your service, but why should cloudflare have to handle your problem for free? If you want to resolve your problem, it sounds like it's in your hands - block traffic, or us something like cloudflare/waf. It's not fair that you have to eat the cost, but it's not fair that someone else does either.

Re: 418 I'm a teapot

#133

Post by endominus »

Dudeman112 wrote: post #116
nitrammm wrote: post #95

Earlier quoted context omitted.

Explicitly telling some junior software developer in China that he can call an API for free an unlimited number of times, then afterwards calling it abuse and him and a-hole dev is definitively a bit of an a-hole thing to do in my view.

There's always an individual with autism-level consideration for what one says, isn't there? No, effectively DDOS-ing a service just because it says it's free and unlimited is a dick move People like those are a big reason for why we can't have nice things

Relevant SMBC (especially to the sibling comments, holy shit): https://www.smbc-comics.com/?id=2095

Re: 418 I'm a teapot

#134

Post by duxup »

wyldfire wrote: post #49
duxup wrote: post #31

Earlier quoted context omitted.

It’s still in my production code, usually in places where i don’t expect code to ever lead to. It’s just my general “something particularly odd has happened” response.

I've never worked on a webserver but doesn't 500 seem better suited for that condition?

500 is correct.

But nobody enjoys a 500 so I occasionally use 418 for extra unexpected situations.

Re: 418 I'm a teapot

#135

Post by christiangenco »

geuis wrote: post #59

Many years ago, some person misconfigured their squid proxy and was hitting https://jsonip.com to the point my server at the time was turning green in the gills. I started responding with 418 "You are a tea kettle" or something like that to those specific requests. The originating dev actually paid attention to their error messages and quickly resolved their config issue. Fast forward to March this year. Some fucking…

Sounds like you’ve built a valuable service that large companies are using in production! Why not start charging for it?

Re: 418 I'm a teapot

#136

Post by nitrammm »

junon wrote: post #117
KomoD wrote: post #112

Earlier quoted context omitted.

Last I checked unlimited is more than millions

This mindset is why we need "do not use while sleeping" warning labels on toasters and hair dryers.

This would be very valid comment if toasters had manuals telling that they are perfectly safe to use while sleeping.

If you lie in your marketing material then you may put yourself in a mess. Big surprise.

Re: 418 I'm a teapot

#137

Post by [deleted] »

lloeki wrote: post #102
ozr wrote: post #62

Earlier quoted context omitted.

You're a better person than me. I'd start returning nonsense like `999.9` to see if I could trigger a ton of bug reports for someone.

other evil ideas: - return a 200 with broken JSON, possibly triggering parse errors or exceptions in the caller - return a payload that generates catastrophic resource consumption on the other end, e.g Content-Encoding: gzip and feed it a deflate bomb - hack TCP and/or TLS to leave the other end waiting/stalling in an attempt to rate limit (timeout) or starve resources (ulimit) on the other end (e.g abuse 3 way hands…

[deleted]

Re: 418 I'm a teapot

#138

Post by nitrammm »

wiseowise wrote: post #119
KomoD wrote: post #112

Earlier quoted context omitted.

Last I checked unlimited is more than millions

Sure, you specifically can use it million times, or even more (given your span of life). If your audience is millions of users it’s millions * millions, not cool.

So if someone doesn't undeestand this assumption, then they are an asshole?

That's pretty crazy viewpoint.

Re: 418 I'm a teapot

#139

Post by manfre »

ransackdev wrote: post #125
geuis wrote: post #59

Many years ago, some person misconfigured their squid proxy and was hitting https://jsonip.com to the point my server at the time was turning green in the gills. I started responding with 418 "You are a tea kettle" or something like that to those specific requests. The originating dev actually paid attention to their error messages and quickly resolved their config issue. Fast forward to March this year. Some fucking…

> That kind of increase in traffic costs me money I've never had to plan for. https://getjsonip.com/#plus Going further with jsonip Plus With the upcoming Plus service, you get special features and even more information about your users. - All of the free service features - IP geo location - Country and city to within best available accuracy - ISP Info - Time zone data - Full referer data - Browser and OS info https:…

You assumed the issue relates only to compute costs. Even with a small payload, bandwidth fees can add up quickly when millions of clients are polling.

Re: 418 I'm a teapot

#140

Post by ransackdev »

timbuchwaldt wrote: post #127
geuis wrote: post #59

Many years ago, some person misconfigured their squid proxy and was hitting https://jsonip.com to the point my server at the time was turning green in the gills. I started responding with 418 "You are a tea kettle" or something like that to those specific requests. The originating dev actually paid attention to their error messages and quickly resolved their config issue. Fast forward to March this year. Some fucking…

We see your exact Dalvik problem on deepl.com as well. We get a constant flood of those requests, sometimes subsiding. They are globally distributed, preliminary in lower-income countries. We have tried lots of things, like letting them just time out, returning different errors, redirecting of many sorts including Android intents, no solution. They now made it to our permanent blocklist and we just deal with the usel…

Welcome to the internet. Install pfsense/opnsense and run your own firewall at home and you'll be shocked at the flood of non-stop portscans hitting your ip getting blocked. This is par for the course and there is nothing you can do to prevent it, you have to build systems able to mitigate, offload, block bad actors. This will always be the case.

Any free service that has utility will be quickly scripted against and used to make someone else money. Build accordingly

Post reply on HN