Using Facebook Notes to DDoS any website

Post by md224 » Sat, Apr 26, 2014, 3:07 AM UTC

RKoutnik wrote: post #25

This is actually the third time this has been submitted [1] (including once by the actual author of this post). There's an extra `/?` appended to the url so HN thinks it's a different link. Not sure why - just adding the slash and question mark doesn't change the target. [1] https://hn.algolia.com/#!/story/past_month/0/ddos%20facebook

Post by brador » Sat, Apr 26, 2014, 4:09 AM UTC

Post by georgemcbay » Sat, Apr 26, 2014, 4:53 AM UTC

md224 wrote: post #41

RKoutnik wrote: post #25

This is actually the third time this has been submitted [1] (including once by the actual author of this post). There's an extra `/?` appended to the url so HN thinks it's a different link. Not sure why - just adding the slash and question mark doesn't change the target. [1] https://hn.algolia.com/#!/story/past_month/0/ddos%20facebook

Are you saying this is a bad thing? Personally I think it's a good thing that the duplicate detector is easy to get around. Allows for submissions to get multiple chances.

Post by joeblau » Sat, Apr 26, 2014, 5:25 AM UTC

STRiDEX wrote: post #26

RKoutnik wrote: post #25

This is actually the third time this has been submitted [1] (including once by the actual author of this post). There's an extra `/?` appended to the url so HN thinks it's a different link. Not sure why - just adding the slash and question mark doesn't change the target. [1] https://hn.algolia.com/#!/story/past_month/0/ddos%20facebook

Next post: using hacker news to DDoS any website.

Post by steveklabnik » Sat, Apr 26, 2014, 6:20 AM UTC

hk__2 wrote: post #20

sargun wrote: post #11

Ideally, if the webserver should just return HTTP 420 (Enhance your calm), 429 (Too many requests), or 509 (Bandwidth Limit exceeded).

Side note: 420 is not a standard HTTP error.

  > HTTP status codes are extensible. HTTP applications are not required
  > to understand the meaning of all registered status codes, though such
  > understanding is obviously desirable. However, applications MUST
  > understand the class of any status code, as indicated by the first
  > digit, and treat any unrecognized response as being equivalent to the
  > x00 status code of that class, with the exception that an
  > unrecognized response MUST NOT be cached. For example, if an
  > unrecognized status code of 431 is received by the client, it can
  > safely assume that there was something wrong with its request and
  > treat the response as if it had received a 400 status code. In such
  > cases, user agents SHOULD present to the user the entity returned
  > with the response, since that entity is likely to include human-
  > readable information which will explain the unusual status.