Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arxiv.org is experiencing a DDoS attack

blog.arxiv.org

Post reply on HN
Print view View original

41–49 of 49 posts

Re: Arxiv.org is experiencing a DDoS attack

#41

Post by bdavbdav »

KirillPanov wrote: post #23
elashri wrote: post #4

> We will shortly be reaching out to the abuse desk of the affected ISP for assistance. Does anyone here have experience working with an ISP in abuse cases like this one, specially a Chinese ISP?

If it's one ISP you don't work with them, you simply add a `drop` rule for their IP range. I think this article is misleading; there's nothing terribly "distributed" about the DoS.

Yep - customers will start getting pretty shirty if websites become unavailable only on their ISP, as their ISP fails to respond to abuse reports.

Re: Arxiv.org is experiencing a DDoS attack

#42

Post by _lvbh »

Abecid wrote: post #3

Who would have the incentive to bring arxiv down?

I’ve hosted a few free services over the past 2 years. They are just utilities, nothing controversial, yet there are DDOS attacks ever few weeks from some Chinese IP ranges (especially Alibaba). Ended up just blocking the ASN as the JA3 fingerprints were spoofed and they were sending legitimate looking data (thus difficult to identify and block)

Re: Arxiv.org is experiencing a DDoS attack

#43

Post by plaguepilled »

Angostura wrote: post #26
plaguepilled wrote: post #20

Earlier quoted context omitted.

Doesn't change the point. Also doesn't refute the point.

The original suggested "Gatekeepers who hate open access." The example was actually a Gatekeeper who values peer review before publication.

Arxiv is open access prepublication, and doesn't remove the need for peer review to get into actual journals. If you apply for a grant and you say "I was published on Arxiv" you are not getting that grant.

Additionally, Arxiv won't kick you off their platform if you post a preprint there, and then you get published in Nature.

In other words, the reason it does not change the point is that Arxiv does not weaken the publication process for the actual journals the preprint will be submitted to. You still need peer review to get published and you are still incentivised to do just that.

You could argue 'preprints ARE publishing' but I'd need to be convinced of that point because I don't agree for the reasons stated above.

Re: Arxiv.org is experiencing a DDoS attack

#44

Post by taskforcegemini »

KirillPanov wrote: post #23
elashri wrote: post #4

> We will shortly be reaching out to the abuse desk of the affected ISP for assistance. Does anyone here have experience working with an ISP in abuse cases like this one, specially a Chinese ISP?

If it's one ISP you don't work with them, you simply add a `drop` rule for their IP range. I think this article is misleading; there's nothing terribly "distributed" about the DoS.

whois on the ip-address tells their range, also their asn with which you can find and block all their nets if necessary. but block via firewall, not webserver

Re: Arxiv.org is experiencing a DDoS attack

#45

Post by davidgerard »

woadwarrior01 wrote: post #27
davidgerard wrote: post #17

Earlier quoted context omitted.

and the context really isn't "gatekeepers hate open access", is it.

The context is that the author of the tweet hates fast paced open research (which IMO is a net good for humanity) and makes up the strawman `"can't keep up" + "anything older than 6 months is irrelevant" in CS` quotes to justify that position. There's timeless beauty in CS, but there's also a lot more fertile ground for research in CS, given how young the field is compared to the older sciences.

counterpoint: no she doesn't, that's weird nonsense.

and I've offered at least as much evidence as you have.

Re: Arxiv.org is experiencing a DDoS attack

#46

Post by deathlock »

cbf66 wrote: post #39
bagels wrote: post #8

Earlier quoted context omitted.

What school has 200k engineering students?

It was from about 10 accounts. Which we suspended. But it appears that they created new accounts overnight (daytime in China). arXiv is not well-equipped to play whack-a-mole. And 10 accounts using 100 different IP addresses, would seem unlikely for an innocent project. And creating new accounts ...

Can you set a restriction so that each user cannot change the email if it has already been changed during the last hour/day? In this way you won't need to ban IPs while still allowing legitimate users to change their emails or to create new accounts.

Re: Arxiv.org is experiencing a DDoS attack

#47

Post by skoocda »

bagels wrote: post #8
KRAKRISMOTT wrote: post #6

A million password resets is shockingly low for a DDOS, could this have been an university assignment gone wrong? I can imagine some clueless dean ordering all their engineering grads to submit research to arXiv. If they have 100-200K students, a single poorly written script to link the institution's SSO with automatically created arXiv accounts could easily overwhelm the system.

What school has 200k engineering students?

Indira Gandhi National Open University has over 4 million students, and in China about 40% of university students are in STEM. It's certainly not impossible that this is coming from a single institution.

Re: Arxiv.org is experiencing a DDoS attack

#48

Post by cbf66 »

qmarchi wrote: post #40
cbf66 wrote: post #38

Earlier quoted context omitted.

Well, no reply from the ISP so far.

Have you tried blocking only endpoint for the IPs in question? Happy to help discussing mitigation techniques. Long time user of ArXiv. Email in Bio.

Sorry qmarchi -- I don't know how to get your contact information here. But it shouldn't be too hard to find mine, if you try.

Re: Arxiv.org is experiencing a DDoS attack

#49

Post by bombcar »

cbf66 wrote: post #48
qmarchi wrote: post #40

Earlier quoted context omitted.

Have you tried blocking only endpoint for the IPs in question? Happy to help discussing mitigation techniques. Long time user of ArXiv. Email in Bio.

Sorry qmarchi -- I don't know how to get your contact information here. But it shouldn't be too hard to find mine, if you try.

Click the post username.
Post reply on HN