418 I'm a teapot • Hacker News Board

Re: 418 I'm a teapot

#141

Post by ransackdev » Sat, May 27, 2023, 1:43 PM UTC

manfre wrote: post #139

ransackdev wrote: post #125

Earlier quoted context omitted.

> That kind of increase in traffic costs me money I've never had to plan for. https://getjsonip.com/#plus Going further with jsonip Plus With the upcoming Plus service, you get special features and even more information about your users. - All of the free service features - IP geo location - Country and city to within best available accuracy - ISP Info - Time zone data - Full referer data - Browser and OS info https:…

You assumed the issue relates only to compute costs. Even with a small payload, bandwidth fees can add up quickly when millions of clients are polling.

Building the paid features announced 3 years ago would pay for compute as well as bandwidth. If the service runs at a loss after that, shut it down or start reaching out to these companies that have integrated it into their products and ask them to sponsor the service, which will certainly be cheaper for the company compared to the cost of dev time to change to some other service that can shutdown just as quick, QA the updates, iterate, approve, ship, wait for adoption, triage bugs, manage all the people doing those things, etc.

Or better yet update the TOS to be free and unlimited for non-commercial use, and to contact sales for commercial use with an estimate of request volume, then sign a phat enterprise contract and rest easy

Re: 418 I'm a teapot

#142

Post by ransackdev » Sat, May 27, 2023, 1:55 PM UTC

usrbinbash wrote: post #86

Mandatum wrote: post #83

Earlier quoted context omitted.

That’s typically why it’s a good idea to include a crappy “generate API” key button so you can block traffic like this, you don’t even need a registration process - someone can just email with reference to their API key to discuss their issues.

> you don’t even need a registration process You should put it behind a CAPTCHA of some sort however, otherwise, some smartass will just write a "library" auto-fetching an api key as soon as the one it has currently cached stops working. And yes, that is an annoyance to users, but so what? Please direct all complaints to the comparatively small number of people responsible for the fact that the rest of us cannot have…

CAPTCHA is for humans while this json service is for machines

Re: 418 I'm a teapot

#143

Post by Dudeman112 » Sat, May 27, 2023, 1:58 PM UTC

corobo wrote: post #124

Dudeman112 wrote: post #116

Earlier quoted context omitted.

There's always an individual with autism-level consideration for what one says, isn't there? No, effectively DDOS-ing a service just because it says it's free and unlimited is a dick move People like those are a big reason for why we can't have nice things

> There's always an individual with autism-level consideration for what one says, isn't there? What does this sentence even mean lmao Autism-level consideration for what one says or not, if you say something is unlimited I'm going to take your word for it. If it's limited, tell me the limits. If it's free to a point, tell me the point. If I need to bust out the CC, tell me I need to bust out the CC. Don't say your th…

>What does this sentence even mean lmao

>if you say something is unlimited I'm going to take your word for it

The sentence refers to people like you. It doesn't make you incredibly clever to consider those sentences literally, like small children or those with under-developed empathy and theory of mind often do

It just makes you an inconsiderate numpty

>Hacker News would be on the complete opposite

Yes, there are lots of people on the tech scene that just don't get ideas like "don't abuse it", or "considering the consequences for other people"

Re: 418 I'm a teapot

#144

Post by ransackdev » Sat, May 27, 2023, 2:06 PM UTC

Dudeman112 wrote: post #116

nitrammm wrote: post #95

Earlier quoted context omitted.

Explicitly telling some junior software developer in China that he can call an API for free an unlimited number of times, then afterwards calling it abuse and him and a-hole dev is definitively a bit of an a-hole thing to do in my view.

There's always an individual with autism-level consideration for what one says, isn't there? No, effectively DDOS-ing a service just because it says it's free and unlimited is a dick move People like those are a big reason for why we can't have nice things

Think of your average engineer doing mobile development. "Here, hit this url to get the device ip". They write the code, it makes 1 request. The average backend engineer isn't performance focused, why would the average mobile engineer be thinking about a distributed denial of service against some third party api? Most mobile engineers have to be guided to not slam their own backend servers, and do not approach problems in their sphere with the mindset to prevent this type of issue. Not knocking mobile devs, it's just literally not something they have to care about most of the time, and imo only the ones who go out of their way to have a solid understanding of the backend systems would even understand what's in play here

Besides that, odds are that this is malware of some sort hitting this service to get the infected device's public ip to phone it home for use in a command and control situation, and if so, they don't care that they are slamming this service.

Mobile devs who care about this type of thing will not need to make any sort of outbound connection anywhere to get the device ip address, it's right on the device already. These what's my ip sites are used by script kiddies and malicious software running on anything

"There's always an individual with autism-level consideration for what one says, isn't there?" isn't needed and I'd advise you to be more professional, or at least more human.

Re: 418 I'm a teapot

#145

Post by nitrammm » Sat, May 27, 2023, 2:09 PM UTC

Dudeman112 wrote: post #143

corobo wrote: post #124

Earlier quoted context omitted.

> There's always an individual with autism-level consideration for what one says, isn't there? What does this sentence even mean lmao Autism-level consideration for what one says or not, if you say something is unlimited I'm going to take your word for it. If it's limited, tell me the limits. If it's free to a point, tell me the point. If I need to bust out the CC, tell me I need to bust out the CC. Don't say your th…

>What does this sentence even mean lmao >if you say something is unlimited I'm going to take your word for it The sentence refers to people like you. It doesn't make you incredibly clever to consider those sentences literally, like small children or those with under-developed empathy and theory of mind often do It just makes you an inconsiderate numpty >Hacker News would be on the complete opposite Yes, there are lot…

> Yes, there are lots of people on the tech scene that just don't get ideas like "don't abuse it", or "considering the consequences for other people"

Got to love the cleverness with the people who design services with the assumption that there are no such people and then goes on to hackernews and cries when a kid in China breaks their site. Lol.

Insanely incompetent.

Re: 418 I'm a teapot

#146

Post by lloeki » Sat, May 27, 2023, 2:16 PM UTC

ransackdev wrote: post #129

lloeki wrote: post #102

Earlier quoted context omitted.

other evil ideas: - return a 200 with broken JSON, possibly triggering parse errors or exceptions in the caller - return a payload that generates catastrophic resource consumption on the other end, e.g Content-Encoding: gzip and feed it a deflate bomb - hack TCP and/or TLS to leave the other end waiting/stalling in an attempt to rate limit (timeout) or starve resources (ulimit) on the other end (e.g abuse 3 way hands…

The site advertises itself as free for all and unlimited usage. To suddenly return malicious responses to intentionally break these apps might very well be illegal in many countries, or maybe would make them liable for damages claims. These clients are not violating any TOS or doing anything not allowed, after all.

I said "evil" for a reason.

That said, it seems like a _single_ actor is causing 300% cost increase compared to _every other actor combined_. Even if advertised as free, there's decency to be had.

If I lend someone my home without TOS and say "make yourself at home" there's a reasonable common sense expectation from both parties that visitors should not turn on every water tap and electric device full blast 24/7, because that would be damaging to me in the first place.

Given the scale of the purported app causing this it's very much abuse in its own right, whether intentional, misengineering, or an oversight. The author of jsonip.com seems to have taken every precautionary measure to limit damage and identify perpetrators to reach out, and these failed. Ethically I feel it would be only fair to displace damage from their infra to the app in order to protect themselves. The only alternative is to shutter the service as it's essentially experiencing a financial DDoS.

Re: 418 I'm a teapot

#147

Post by leobg » Sat, May 27, 2023, 2:18 PM UTC

ransackdev wrote: post #129

lloeki wrote: post #102

Earlier quoted context omitted.

other evil ideas: - return a 200 with broken JSON, possibly triggering parse errors or exceptions in the caller - return a payload that generates catastrophic resource consumption on the other end, e.g Content-Encoding: gzip and feed it a deflate bomb - hack TCP and/or TLS to leave the other end waiting/stalling in an attempt to rate limit (timeout) or starve resources (ulimit) on the other end (e.g abuse 3 way hands…

The site advertises itself as free for all and unlimited usage. To suddenly return malicious responses to intentionally break these apps might very well be illegal in many countries, or maybe would make them liable for damages claims. These clients are not violating any TOS or doing anything not allowed, after all.

Why? There is no guarantee give to victimize that service for free forever.

Re: 418 I'm a teapot

#148

Post by ransackdev » Sat, May 27, 2023, 2:20 PM UTC

geuis wrote: post #70

dannyw wrote: post #64

Earlier quoted context omitted.

Your website on https://getjsonip.com/ says: > Supports unlimited requests and is free. Maybe update that text? There is no guidance on acceptable thresholds, rate limits, etc.

Yeah I know. That is a legit critique. What's been happening is your essential black swan event. I've been running the service for 12 years and have never had this problem. There are hundreds of websites and independent users that have never abused the api like this until March. I have always been able to absorb the traffic impact. This is different. Someone wasn't thinking and randomly added the domain to a lazy pie…

> rolled out an update to hundreds of thousands of millions of devices with simply emailing me if that's ok.

If it's malware, they don't care if it's ok, they are malware authors. Contact your hosting provider which 100% has the ability to offload traffic from malware and ddos. They are responsible for the network and will not want malicious traffic anywhere on it, esp if it's tying up bandwidth for paying customers or premium bandwidth. If it was a large amount of bandwidth they would have contacted you long before you contacted them. I'd still reach out, they will move on it quick if it's an issue, and at the least can examine the traffic to determine if it's bad or not.

Cloudflare won't do much good here no? The requests still have to proxy back to your origin servers to spit back the ip. You can't utilize any caching on cloudflare due to the unique ip of each client. Their ddos prevention might not help because these are clients each with their own unique ip address, which is probably a cellular provider's ip space and not bad traffic. If it's the volume of clients hitting you, and not the volume of requests they make, it wouldn't trip cloudflare, or they'd be blocking major cellular address space across their entire network (which is a large portion of the internet these days)

Re: 418 I'm a teapot

#149

Post by RobotToaster » Sat, May 27, 2023, 2:28 PM UTC

geuis wrote: post #59

Many years ago, some person misconfigured their squid proxy and was hitting https://jsonip.com to the point my server at the time was turning green in the gills. I started responding with 418 "You are a tea kettle" or something like that to those specific requests. The originating dev actually paid attention to their error messages and quickly resolved their config issue. Fast forward to March this year. Some fucking…

I hate to add to your headache, but multiple pihole ad blacklists contain your domain. It looks like https://winhelp2002.mvps.org/ may be the original source of the blacklisting.

Re: 418 I'm a teapot

#150

Post by ransackdev » Sat, May 27, 2023, 2:33 PM UTC

lloeki wrote: post #146

ransackdev wrote: post #129

Earlier quoted context omitted.

The site advertises itself as free for all and unlimited usage. To suddenly return malicious responses to intentionally break these apps might very well be illegal in many countries, or maybe would make them liable for damages claims. These clients are not violating any TOS or doing anything not allowed, after all.

I said "evil" for a reason. That said, it seems like a _single_ actor is causing 300% cost increase compared to _every other actor combined_. Even if advertised as free, there's decency to be had. If I lend someone my home without TOS and say "make yourself at home" there's a reasonable common sense expectation from both parties that visitors should not turn on every water tap and electric device full blast 24/7, bec…

> there's a reasonable common sense expectation

Your logic error is in assuming all people have common sense and setting expectations based on that assumption.

This actually has nothing to do with common sense, a jr and sometimes even senior mobile devs would not have the mindset of avoiding a ddos to a third party api when writing a feature that needs to get the device ip. It wouldn't be on purpose, it would just be that they don't know that they don't know yet. These issues of slamming a backend server are pretty common and mobile devs don't know to avoid it until they cause it imo. This could also be malware too which wouldn't care about decency.

Point is, scale your service, adjust your terms, start rate limiting, or shut it down. Calling your users names is the wrong solution no matter the user's intent, and solves exactly zero of the issues at hand.

The service owner should feel proud to have such a popular service, many folks will never have to deal with scaling issues. As the saying goes "scaling issues are good issues to have".