Earlier quoted context omitted.
I'll bet that if it could then suddenly they might start caring more about it.
I'll bet that could end you up in jail.
Wait... This comment thread looks familiar. Did this happen already?
Using Facebook Notes to DDoS any website
71–79 of 79 posts
Re: Using Facebook Notes to DDoS any website
#72Earlier quoted context omitted.
Actually it has a name, "The HN Effect" (inspired by "The Digg Effect", I guess) and it's a real thing as many web sites go down when they are featured in the front page.
Actually it has a name, "Slashdot effect". http://en.wikipedia.org/wiki/Slashdot_effect
Theres so many local variations. In the german speaking part of the internet, there is the verb "geheist", after a popular tech news site.
Re: Using Facebook Notes to DDoS any website
#73Earlier quoted context omitted.
I'm kind of wondering why they need so many different servers to fetch the file from the remote host. It would be smart to at implement rate-limiting, and also delegate to a specific server close to the host to fetch the image, and then sync the image/file across their own networks to whatever server needs it. It is just a huge waste of bandwidth that 100+ servers need to fetch the file, instead of Facebook itself ab…
Well I would assume that when you add a link to a note the link gets thrown into a queue and a cluster of servers pops items off that queue to fetch and store the result. Also remember FB sees each link as a different link so it can't fetch it once and share it.
I remember reading that FB saw each link as a different link, but I somehow managed to forget that while writing the comment. Oops.
Re: Using Facebook Notes to DDoS any website
#74Same as http://chr13.com/2014/03/10/using-google-to-ddos-any-website...
so if Facebook and Google got this bug ... or feature ... point one to another and boooom goes the internet!
But isn't Google constantly "ddos"ed by definition? (I mean simultaneously used by almost every computer on Earth).
Re: Using Facebook Notes to DDoS any website
#75Thought Facebook had already fixed it. I tried with an image on my domain and it only went till about 660KB/s. Then I found a bigger file. It's now maxes out my upload speed (50mbps on fiber). The notes have been deleted but Facebook continues to do http requests for the file. That, or Apache continues to write requests to the access log after they finished and Facebook does not close active connections when it knows…
I wonder, what is the legality of having them DDoS themselves, using something they've suggested will not impact on someone of their scale, and that they won't fix? Are you breaching their ToC or AUP? (I'm sure I've "agreed" to it but I doubt I've ever read it in full.)
I have no clue and I personally do not really care :P
It's way easier to just fix the issue than to sue me, as long as I don't noticeably disturb their infrastructure (i.e. don't bother other users).
Re: Using Facebook Notes to DDoS any website
#76Earlier quoted context omitted.
Especially, Facebook is not supposed to intelligently crawl websites but to just proxy images. That's an easy one.
Ah, but intelligently for whom? Benefits to Facebook might outweigh intangibles like "being nice" to the people and places they are indirectly making money off of.
I think in this intance we've passsed the line between "not being nice" and "being a dick", or in this case being an accessory to a dickish move.
If the issue is used to DoS a site Zuckerberg cares about, not that I would encourage such action as it would in itself be a dick move, I'm sure some form of rate limiting will be implemented in short order...
Re: Using Facebook Notes to DDoS any website
#77This can be fixed easily ( i have read it fast, but i suppose this could be a fix) Add a boolean to a attachment in the db, queryDiff Add a string (for md5 hash) Calculate the hash on every file with a query parameter, if the file is requested the second time (with different query parameters), check if the file hash is the same. If the file hash is the same, change the bool queryDiff Next time you fetch the file, que…
There's no way to know if difference in query parameter is a different image or not, you can't simply re-use a prior URL which is equivalent but for query param in place of a new one. http://example.org/images?image_id=12121 http://example.org/images?image_id=7272
If
http://example.org/images?image_id=12121
http://example.org/images?image_id=7272
If they are different, chances are very high that other query parameters are also different.
Want to up your chances, then instead of only 2 requests, raise the bar to 10 different query parameter checks and add some additional db values (like CountFetch:int,sameUntillCurrentFetch:bool)
As soon as sameUntillCurrentFetch = false, then you request all images in the future. If CountFetch = 5 and sameUntillCurrentFetch = true, then queryDiff = false.
It's kinda weird my answer was downvoted, any better solutions to avoid the stated problem then?
Re: Using Facebook Notes to DDoS any website
#78This can be fixed easily ( i have read it fast, but i suppose this could be a fix) Add a boolean to a attachment in the db, queryDiff Add a string (for md5 hash) Calculate the hash on every file with a query parameter, if the file is requested the second time (with different query parameters), check if the file hash is the same. If the file hash is the same, change the bool queryDiff Next time you fetch the file, que…
There's no way to know if difference in query parameter is a different image or not, you can't simply re-use a prior URL which is equivalent but for query param in place of a new one. http://example.org/images?image_id=12121 http://example.org/images?image_id=7272
Calculate a md5 hash file to identify the image id
http://stackoverflow.com/questions/4032209/is-md5-still-good...
Re: Using Facebook Notes to DDoS any website
#79Interesting. I wonder if being behind CloudFlare would mitigate this?