Could one use this to attack Facebook from within its network, bypassing its DDoS mitigation measures?
I'll bet that if it could then suddenly they might start caring more about it.
I'll bet that could end you up in jail.
Using Facebook Notes to DDoS any website
51–60 of 79 posts
Re: Using Facebook Notes to DDoS any website
#52This is actually the third time this has been submitted [1] (including once by the actual author of this post). There's an extra `/?` appended to the url so HN thinks it's a different link. Not sure why - just adding the slash and question mark doesn't change the target. [1] https://hn.algolia.com/#!/story/past_month/0/ddos%20facebook
Are you saying this is a bad thing? Personally I think it's a good thing that the duplicate detector is easy to get around. Allows for submissions to get multiple chances.
I don't get it. Why not just allow duplicate submissions, but show a warning and link to the previous submissions before confirming the submission? Or if you intend the URL trick to be semi-secret and thus limited to "power users," then just allow duplicate submissions for users meeting some criterion, like account age or a karma threshold.
Re: Using Facebook Notes to DDoS any website
#53> In the end, the conclusion is that there’s no real way to us fix this that would stop “attacks” against small consumer grade sites without also significantly degrading the overall functionality. Nonsense. Every web crawler should have some form of rate limiting. That's just good etiquette. I can control the number of requests that the Google search indexer sends to my site via webmaster tools. I don't see a good re…
I'm kind of wondering why they need so many different servers to fetch the file from the remote host.
It would be smart to at implement rate-limiting, and also delegate to a specific server close to the host to fetch the image, and then sync the image/file across their own networks to whatever server needs it.
It is just a huge waste of bandwidth that 100+ servers need to fetch the file, instead of Facebook itself absorbing the cost.
Re: Using Facebook Notes to DDoS any website
#54So giving a 404 for unknown get parameters should fix this for your own site? A way for Facebook to detect such a thing would be to hash the images and when two images have the same hash and only differ by some get parameter it could remember that it can ignore that parameter.
[deleted]
Re: Using Facebook Notes to DDoS any website
#55This is actually the third time this has been submitted [1] (including once by the actual author of this post). There's an extra `/?` appended to the url so HN thinks it's a different link. Not sure why - just adding the slash and question mark doesn't change the target. [1] https://hn.algolia.com/#!/story/past_month/0/ddos%20facebook
Next post: using hacker news to DDoS any website.
Actually it has a name, "The HN Effect" (inspired by "The Digg Effect", I guess) and it's a real thing as many web sites go down when they are featured in the front page.
Re: Using Facebook Notes to DDoS any website
#56Earlier quoted context omitted.
Next post: using hacker news to DDoS any website.
Actually it has a name, "The HN Effect" (inspired by "The Digg Effect", I guess) and it's a real thing as many web sites go down when they are featured in the front page.
Or the Reddit alternative, "The Reddit Hug," which sounds quite heartwarming.
Re: Using Facebook Notes to DDoS any website
#57> In the end, the conclusion is that there’s no real way to us fix this that would stop “attacks” against small consumer grade sites without also significantly degrading the overall functionality. Nonsense. Every web crawler should have some form of rate limiting. That's just good etiquette. I can control the number of requests that the Google search indexer sends to my site via webmaster tools. I don't see a good re…
I'm kind of wondering why they need so many different servers to fetch the file from the remote host. It would be smart to at implement rate-limiting, and also delegate to a specific server close to the host to fetch the image, and then sync the image/file across their own networks to whatever server needs it. It is just a huge waste of bandwidth that 100+ servers need to fetch the file, instead of Facebook itself ab…
Well I would assume that when you add a link to a note the link gets thrown into a queue and a cluster of servers pops items off that queue to fetch and store the result. Also remember FB sees each link as a different link so it can't fetch it once and share it.
Re: Using Facebook Notes to DDoS any website
#58Earlier quoted context omitted.
Next post: using hacker news to DDoS any website.
Actually it has a name, "The HN Effect" (inspired by "The Digg Effect", I guess) and it's a real thing as many web sites go down when they are featured in the front page.
fyi, it used to be the slashdot effect before anything else.
Re: Using Facebook Notes to DDoS any website
#59This can be fixed easily ( i have read it fast, but i suppose this could be a fix)
Add a boolean to a attachment in the db, queryDiff
Add a string (for md5 hash)
Calculate the hash on every file with a query parameter, if the file is requested the second time (with different query parameters), check if the file hash is the same. If the file hash is the same, change the bool queryDiff
Next time you fetch the file, queryDiff is false, so you shouldn't fetch the url and only get the original one (which was already downloaded)
Re: Using Facebook Notes to DDoS any website
#60Earlier quoted context omitted.
Next post: using hacker news to DDoS any website.
Actually it has a name, "The HN Effect" (inspired by "The Digg Effect", I guess) and it's a real thing as many web sites go down when they are featured in the front page.
Actually it has a name, "Slashdot effect".