I thought about submitting this a week or so ago. Here's the link to the issue and discussion on it: https://github.com/TeamPiped/Piped/issues/1704 TL;DR: Apparently there's a Hong Kong dude living in Germany that didn't like his videos being on Youtube, so he sent DMCA takedown requests to Piped instead and Cloudflare did a takedown on the whole domain, which only appears if sent as a referral from outside piped.kav…
Close. Seems to me more like he didn’t realize that Piped is an alternative front end to YouTube, and assumed that someone had actually reuploaded his YouTube content elsewhere.
Internet security has, in my experience, always been about "being just hard enough a target the bad actors decide to go torment somebody else." It was true twenty years ago too, the only difference I can see between then and now is that you can outsource that task for a (relatively) small amount of money if you want to. Then again, the last time I dealt with a site under DDoS, something in their stack was leaking the…
I'm surprised you're handing incoming requests from everybody. We only process the CloudFlare ones and drop the rest.
You can fill the pipes to the server(s) you're targeting, it doesn't have to be application layer.
Why is yewtu.be a stupid domainname? It's an "alternative" spelling of youtu.be that's easy to memorize and fast to type. I use a plugin to redirect to newpipe instances, but if I hadn't one I would probably use yewtu.be because it would suck to always type something like piped.kavin.rocks or invidious.pussthecat.org
I think that is a comment about alt right commentators online. YewTube sounds like an anti Semitic joke.
Oh I even checked urbandict to be sure that it couldn't be this and all I found was the happy sound surfer make "Yew".
I think that's just a sign of the times that you see right-wing and left-wing comments everywhere even when it isn't there at all.
I thought about submitting this a week or so ago. Here's the link to the issue and discussion on it: https://github.com/TeamPiped/Piped/issues/1704 TL;DR: Apparently there's a Hong Kong dude living in Germany that didn't like his videos being on Youtube, so he sent DMCA takedown requests to Piped instead and Cloudflare did a takedown on the whole domain, which only appears if sent as a referral from outside piped.kav…
Close. Seems to me more like he didn’t realize that Piped is an alternative front end to YouTube, and assumed that someone had actually reuploaded his YouTube content elsewhere.
Yeah I realized it while sleeping and when I woke up it was too late to edit. I meant to say the takedown was likely sent to the abuse contact on the whois info for cloudflare's ip address. Could be his own content he's claiming or something he really didn't want public and just exhausted every potential avenue to send takedown requests to. Not going to assume either way, but that's likely how this started.
On a theoretical level, a service like Cloudflare is the most terrifying entity on the Internet I'm aware of. They've accumulated an insane degree of insight into the traffic flow of the web (since their entire service is essentially acting as a HTTPS middle man), and their business is offering protection against bot spam that could ruin most websites. Even if they aren't operating the bots themselves, they're essent…
I always figured that the main thing Cloudflare protected against was DDoS attacks, not bots (DDoS may be caused by bots, but with significantly different outcomes -- a single bot in and of itself won't take down a website) RE bots: TikTok has incredible bot protection that comes from engineering (webmssdk) instead of network-based filtering. I'm not even sure if they use Cloudflare.
Cloudflare doesn't even really protect against DDOS. Sometimes taking your website off Cloudflare is the only way to stop a DDOS attack. That's because you can't stop something like a level 4 ddos attack by blocking the IPs in raw prerouting iptables, because if you did that then you'd be blocking Cloudflare's IPs. The only option Cloudflare really provides you is pressing a panic button that forces everyone who visits your site to view a captcha, when it's really so trivial to just run the iptables commands using a token bucket algorithm. I know because I run a website on a 2 vCPU VM that gets DDOS'd all the time. I've had to block over nine thousand malicious malicious IPs so far. I tried using Cloudflare in the past for their protection services, but it made me (1) defenseless against bad visitors and (2) made good visitors angry at me for the captchas.
I couldn't run search.marginalia.nu without it. I've seen up to 50,000 bot queries per hour (and peak out at about 500 human queries per hour). I don't have the hardware to cater to the bots. I also don't have the money to buy the hardware to eat the cost. The options are hide behind cloudflare or shut down the service. It's not about traffic costs, but processing power.
Can you please explain what exactly bot were doing? What was their goal? Yes, I've seen bot scraping sites, which is expected. But what queries bots were doing towards niche search engine?
Search queries look like spam, like the sort of spam keywords you will find in comment spam. "Free cialis 50mg online pharmacy near me"-type stuff
Best guess is they're gambling I'm backed by Google's API and trying to poison their suggestion data.
Can you please explain what exactly bot were doing? What was their goal? Yes, I've seen bot scraping sites, which is expected. But what queries bots were doing towards niche search engine?
Search queries look like spam, like the sort of spam keywords you will find in comment spam. "Free cialis 50mg online pharmacy near me"-type stuff Best guess is they're gambling I'm backed by Google's API and trying to poison their suggestion data.
Sorry I don't follow. Could please elaborate. You mean bots do query 'cialis' to get an ad-sense ad, while they are the same guys benefiting from ads shown? Or what? I genuinely want to understand the problem and most importantly the motivation.
By now Cloudflare is more of an obstacle to the free web than it is helping. A centralized entity, whose scripts from randomly named subdomains you must allow to run on your machine, or be stuck at their obnoxious "checking your browser" page endlessly reloading, because some web dev decided to put their website behind Cloudflare. Cloudflare is one of the most prominent reasons for me to simply close the browser tab…
I never really understood Cloudflare's intent, because from the marketing material it seems that you get DDOS "protection", free TLS certs, everything in a monthly package, affordable, bla bla bla. But from some basic calculations I get that R2, Workers and egress bandwidth beyond a few terabytes costs just as much as Oracle cloud / Alibaba. But what I dislike the most is how little control you have over what's going…
Sorry if I am missing something here. Cloudflare gives flexibility to their customers. That seems right.
Cloudflare enterprise is pretty transparent if you've gone through the sales process. They tell you exactly what the limits are. For average person, on free plan, they are not obligated to provide details of where the limits are. That's no different than BackBlaze unlimited storage plan.
Search queries look like spam, like the sort of spam keywords you will find in comment spam. "Free cialis 50mg online pharmacy near me"-type stuff Best guess is they're gambling I'm backed by Google's API and trying to poison their suggestion data.
Sorry I don't follow. Could please elaborate. You mean bots do query 'cialis' to get an ad-sense ad, while they are the same guys benefiting from ads shown? Or what? I genuinely want to understand the problem and most importantly the motivation.
I don't understand the motivation either, but I think what they are attempting is to make e.g. typing cialis into Google suggest specific queries like the one i showed, which may be so overspecified they provide the spammers' links.
