Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ban me at the IP level if you don't like me

boston.conman.org

Post reply on HN
Print view View original

391–400 of 516 posts

Re: Ban me at the IP level if you don't like me

#391

Post by JohnMakin »

dang wrote: post #389
JohnMakin wrote: post #311

Earlier quoted context omitted.

[flagged]

Please don't cross into personal attack. You can make your substantive points without that.

I disagree with that characterization of the post - merely commenting that a user that could come away with this take has never managed a web-facing service, because you'd immediately see the traffic is immense and constant, especially from crawlers. Sorry if I didn't elaborate that point clearly enough, point taken, I will more carefully craft such responses so such a point isn't misinterpreted or flagged.

Re: Ban me at the IP level if you don't like me

#392

Post by hinkley »

SoftTalker wrote: post #322
zeta0134 wrote: post #298

Earlier quoted context omitted.

Just about nobody logs passwords on purpose. But really stupid IoT devices accept credentials as like query strings, or part of the path or something, and it's common to log those. The attacker is sending you passwords meant for a much less secure system.

You probably shouldn't log usernames then, or really any form fields, as users might accidentally enter a password into one of them. Kind of defeats the point of web forms, but safety is important!

So no access logs at all then? That sounds effective.

Re: Ban me at the IP level if you don't like me

#393

Post by hinkley »

dmesg wrote: post #255
JohnFen wrote: post #244

Earlier quoted context omitted.

How are passwords ending up in your logs? Something is very, very wrong there.

Does an attacking bot know your webserver is not a misconfigured router exposing its web interface to the net? I often am baffled what conclusions people come up with from half reading posts. I had bots attack me with SSH 2.0 login attempts on port 80 and 443. Some people underestimate how bad at computer science some skids are.

I recall finding weird URLs in my access logs way back when where someone was trying to hit my machine with the CodeRed worm, a full decade after it was new. That was surreal.

Re: Ban me at the IP level if you don't like me

#394

Post by phyzome »

dang wrote: post #389
JohnMakin wrote: post #311

Earlier quoted context omitted.

[flagged]

Please don't cross into personal attack. You can make your substantive points without that.

It think it's fair play to claim that someone doesn't have relevant experience when it seems very clear that they do not.

Re: Ban me at the IP level if you don't like me

#395

Post by xp84 »

hinkley wrote: post #390
sidewndr46 wrote: post #324

Earlier quoted context omitted.

I don't think you have any idea how serious the issue is. I was loosely speaking in charge of application-level performance at one job for a web app. I was asked to make the backend as fast as possible at dumping the last byte of HTML back to the user. The problem I ran into was performance was bimodal. We had this one group of users that was lightning fast and the rest were far slower. I chased down a few obvious ou…

One of our customers was paying a third party to hit our website with garbage traffic a couple times a week to make sure we were rejecting malformed requests. I was forever tripping over these in Splunk while trying to look for legitimate problems. We also had a period where we generated bad URLs for a week or two, and the worst part was I think they were on links marked nofollow. Three years later there was a bot st…

> they were on links marked nofollow

if i'm understanding you correctly you had an indexable page that contained links with nofollow attribute on the tags.

It's possible some other mechanism got those URLs into the crawler like a person visiting them? Nofollow on the link won't prevent the URL from being crawled or indexed. If you're returning a 404 for them, you ought to be able to use webmaster tools or whatever it's called now, to request removal.

Re: Ban me at the IP level if you don't like me

#396

Post by nullc »

gspencley wrote: post #367
sdenton4 wrote: post #328

Earlier quoted context omitted.

Are you sure you are human?

Yes. I have checked many checkboxes that say "Verify You Are a Human" and they have always confirmed that I am. In fairness, however, my daughters ask me that question all the time and it is possible that the verification checkboxes are lying to me as part of some grand conspiracy to make me think I am a human when I am not.

https://www.youtube.com/watch?v=4VrLQXR7mKU

--- though I think passing them is more a sign that you're a robot than anything else.

Re: Ban me at the IP level if you don't like me

#397

Post by hinkley »

bob1029 wrote: post #156
phito wrote: post #134

Earlier quoted context omitted.

My friend has a small public gitea instance, only use by him a a few friends. He's getting thousounds of requests an hour from bots. I'm sorry but even if it does not impact his service, at the very least it feels like harassment

Thousands of requests per hour? So, something like 1-3 per second? If this is actually impacting perceived QoS then I think a gitea bug report would be justified. Clearly there's been some kind of a performance regression. Just looking at the logs seems to be an infohazard for many people. I don't see why you'd want to inspect the septic tanks of the internet unless absolutely necessary.

We were only getting 60% of our from bots at my last place because we throttled a bunch of sketchy bots to around 50 simultaneous requests. Which was on the order of 100/s. Our customers were paying for SEO so the bot traffic was a substantial cost of doing business. But as someone tasked with decreasing cluster size I was forever jealous of the large amount of cluster thatwasn’t being seen by humans.

Re: Ban me at the IP level if you don't like me

#398

Post by xp84 »

0x457 wrote: post #382
NegativeK wrote: post #314

Earlier quoted context omitted.

I've heard this point raised elsewhere, and I think it's underplaying the magnitude of the issue. Background scanner noise on the internet is incredibly common, but the AI scraping is not at the same level. Wikipedia has published that their infrastructure costs have notably shot up since LLMs started scraping them. I've seen similar idiotic behavior on a small wiki I run; a single AI company took the data usage from…

So weird to scrape wikipedia when you can just download db dumb from them.

Really makes you think about the calibre of minds being applied to buzzy problem spaces these days, doesn't it?

Re: Ban me at the IP level if you don't like me

#399

Post by nullc »

azthecx wrote: post #160
Xiol32 wrote: post #144

Earlier quoted context omitted.

Changing the SSH port also helps cut down the noise, as part of a layered strategy.

Did you really notice a significant drop off in connection attempts? I tried this some years ago and after a few hours on a random very high port number I was already seeing connections.

In my experience can cut out the vast majority of ssh connection attempts by just blocking a couple IPs. ... particularly if you've already disabled password auth because some of the smarter bots notice that and stop trying.

Re: Ban me at the IP level if you don't like me

#400

Post by hinkley »

wraptile wrote: post #174
phito wrote: post #134

Earlier quoted context omitted.

My friend has a small public gitea instance, only use by him a a few friends. He's getting thousounds of requests an hour from bots. I'm sorry but even if it does not impact his service, at the very least it feels like harassment

> thousounds of requests an hour from bots That's not much for any modern server so I genuinely don't understand the frustration. I'm pretty certain gitea should be able to handle thousands of read requests per minute (not per hour) without even breaking a sweat.

We were seeing over a million hits per hour from bots and I agree with GP. It’s fucking out of control. And it’s 100x worse at least if you sell vanity URLs, because the good bots cannot tell that they’re sending you 100 simultaneous requests by throttling on one domain and hitting five others instead.
Post reply on HN