Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How the FSF sysadmins block botnets with reaction

fsf.org

Post reply on HN
Print view View original

61–70 of 87 posts

Re: How the FSF sysadmins block botnets with reaction

#61

Post by LoganDark »

graemep wrote: post #20
Groxx wrote: post #14

Earlier quoted context omitted.

You can have preferences while not restricting legal rights.

You can, but if the exact quote in the GP is correct the claim is claiming the software is "gay, trans and anti-colonialist" and asks you not to use it. Why use a license that is designed to be politically neutral and then ask some people not to use it? What I can see is a fairly clear indication that they do not want contributions from people whose politics differ from theirs. I would also question whether governmen…

You can always ask anyone not to use anything. Doesn't mean they have to listen, but you can still ask.

Re: How the FSF sysadmins block botnets with reaction

#62

Post by seki285 »

Bender wrote: post #28
seki285 wrote: post #26

Earlier quoted context omitted.

I would like to learn more how you maintain your table of IP ranges (or CIDR block). How do you decide when to add/remove a range? I'm most concerned about blocking innocent users, currently I use Cloudflare to block known bad ASNs using a list I found on GitHub.

How do you decide when to add/remove a range? The only IP's that come and go are the Tor 30 day blocklist and a couple FireHOL attackers from a repo though I will sometimes leave the last entries live until reboot. I do not really need to block tor but I use this silly blog as a testing ground. Tor and some known abusers come from a git repo I refresh periodically. The data-centers, VPS providers, CDNs, known botnets…

Thank you for including a link to your blog, very useful read.

Re: How the FSF sysadmins block botnets with reaction

#63

Post by Bender »

TurdF3rguson wrote: post #60
Bender wrote: post #15

My personal preference is to 'ip route add blackhole ${net}' as it has the lowest CPU overhead and I can add hundreds of thousands of CIDR blocks with no noticeable impact. The only downside is that it won't stop UDP packets from getting to a UDP listener. There will not be a response but the application will still see it. For my TCP daemons it's great. grep -m1 -E ^Tot /proc/net/fib_triestat ;ip route | grep -Fc bla…

The problem is when you block those "residential proxy bots" you also block real people who just happen to have a dumb teenager on their network playing some free games that are monetized by proxies. The only real solution to bots is making users log in. And even then you have to fight registration bots.

I get what you mean. It happens all the time when some clown trashes an IP's reputation and Cloudflare or Google will send the next lease of that IP into crosswalk fire-hydrant bus traffic light purgatory.

That's why I eventually let those go usually after a kernel update and the git repo for FireHOL gets updated often. The kernels get updated often. I only perma-ban the data-centers which is fine for my silly blog and probably for some peoples hobby sites. People can chose which methods to apply, how to apply them or which ones to skip entirely.

Excellent username btw. Those SNL Celebrity Jeopardy episodes are unforgettable. [1]

[1] - https://www.youtube.com/watch?v=bEghu90QJH4

Re: How the FSF sysadmins block botnets with reaction

#64

Post by arjie »

Magicrafter13 wrote: post #12

> This software is gay, trans and anticolonialist. If you're uncomfortable with that, please don't use it Weird message to include in AGPLv3 licensed software (which explicitly allows people to use software however they like, regardless of their beliefs or feelings).

Functions are colored. Software has sexuality. And we aren't even talking about AI!

Re: How the FSF sysadmins block botnets with reaction

#65

Post by FabCH »

worik wrote: post #58
charcircuit wrote: post #33

>Popa botnet It's no more of a botnet than ProtonVPN for example. Apps intentionally added the Popa SDK to their apps as a monetization method. This allows apps without ads and tracking to be financially viable. I would expect FSF to support apps being able to move off of monetization schemes that depend on tracking people so it is disappointing for them to put such alternative monetization technologies in a negative…

"Monetization". What a horror. I pay for some software services. The services I pay for have a billing page (or a donation page) and I pay via the banking system I rigorously block every ad, every tracker, every thing that does "monetization" The evil period of trying sneaky ways to generate money is, I am optimistic, coming to an end. If you want my money, ask me. If you must have my money, demand it. If you are sne…

Yeah but they don’t want your money. They want the botnet users money.

You got a genuinely free, to you, app.

Re: How the FSF sysadmins block botnets with reaction

#66

Post by pixl97 »

jasonvorhe wrote: post #50
stonogo wrote: post #24

Earlier quoted context omitted.

The aim is to reduce the number of users of the software who are uncomfortable with those who are gay, trans, and/or anticolonial, probably because dealing with such people is a heavier burden than the other kind.

You wouldn't know my stance on the matter based on a pull request, especially not if some author didn't plaster it all around their profile.

Then you don't care. People that care tend not to do a PR.

Re: How the FSF sysadmins block botnets with reaction

#67

Post by m3047 »

thomzane wrote: post #42
m3047 wrote: post #32

"Many sysadmins know about fail2ban..." and many will now know about reaction. But why will the result be any different than fail2ban? It won't. I identify features (which can be expressed as firewall rules) from log data; I write totals to a temporary store (Redis). I have periodic tasks which scan the temp store for patterns which exceed thresholds. When that occurs, fail2ban creates the appropriate rules. This occ…

The difference between fail2ban and reaction is performance. If you are not hitting the ceiling of fail2ban, then you may not need reaction. Do you have a blog post about your automated fail2ban rule generation?

Why should I have a blog post? I get amazing "performance" out of fail2ban, it does what it's supposed to do and I don't ask it to do more. I've given it "super powers".

Last year I blocked basically all of Brazil. No problems. Who knew?

Re: How the FSF sysadmins block botnets with reaction

#68

Post by perching_aix »

superkuh wrote: post #18
wasmperson wrote: post #16

It's somewhat interesting to see the FSF's approach to this. From what I understand they can't really use something like anubis since they want their websites to be accessible without javascript: https://www.gnu.org/philosophy/javascript-trap.html Users can't consent to running a page's javascript the way they can consent to running a program they've intentionally downloaded, so it's effectively "non-free" regardless…

Anubis does support the no-JS HTTP meta-redirect proof of work but few know about it and fewer enable it. And it may not block everything .

Does it still need a cookie though? Another thing I have disabled by default.

Re: How the FSF sysadmins block botnets with reaction

#69

Post by vinceguidry »

fluoridation wrote: post #47
Magicrafter13 wrote: post #12

> This software is gay, trans and anticolonialist. If you're uncomfortable with that, please don't use it Weird message to include in AGPLv3 licensed software (which explicitly allows people to use software however they like, regardless of their beliefs or feelings).

My Gen Y brain can't read the phrase "[inanimate object] is gay" without interpreting it as disapproval.

My Gen Y brain can do this no problem, and I'm among the oldest of the generation. Anthropomorphizing is fun!

Re: How the FSF sysadmins block botnets with reaction

#70

Post by Permik »

jasonvorhe wrote: post #49
graemep wrote: post #20

Earlier quoted context omitted.

You can, but if the exact quote in the GP is correct the claim is claiming the software is "gay, trans and anti-colonialist" and asks you not to use it. Why use a license that is designed to be politically neutral and then ask some people not to use it? What I can see is a fairly clear indication that they do not want contributions from people whose politics differ from theirs. I would also question whether governmen…

Because signalling has replaced real virtue.

I'd like to suggest that this messaging is actually the inverse of virtue signaling, I.E. "icky signaling" for snowflakes. Keeps people at bay who are icked by the message.
Post reply on HN