Email or username:

Password:

Forgot your password?
18 comments
jimpjorps

@Gargron @mkljczk I like how it's somehow your responsibility to do a bunch of sleuthing and ask them nicely to knock it off instead of theirs not to misuse it

🎓 Dr. Freemo :jpf: 🇳🇱

@mkljczk

On the one hand its Gargrons right to allow whatever services he wants to access his API. This is no different than blocking a fediverse server. That said I think its unfair to call this a DDOS or even a misuse of the API.. In fact I'd say this is the very purpose of an activity pub endpoint, so anyone can access the data and interoperate with the server as they see fit.

@xorowl @jimpjorps @Gargron

Eugen Rochko

@freemo @mkljczk @xorowl @jimpjorps It's DDoS when their software is coded in such a way that many IPs hit the same endpoints over and over in frequent fashion when they could simply cache the results

🎓 Dr. Freemo :jpf: 🇳🇱

@Gargron

Fair, if a single client is hitting it excessively then it should be cached and isnt good etiquette for sure. Not quite sure I'd call it a DDoS but still, its bad design.

@mkljczk @xorowl @jimpjorps

Eugen Rochko

@freemo @mkljczk @xorowl @jimpjorps Again, it's distributed DoS because they release this software (a game mod) to end-users whose IPs are the ones hitting the endpoints. As far as I understand, anyway. I'm currently analyzing the log files to find out how many unique IPs the requests are coming from.

marcin mikołajczak • migrated replied to Eugen

@Gargron @freemo @xorowl @jimpjorps itʼs for the 'community tabʼ like this and the requests are done client-side, custom server owners using FiveM can select an ap account they want to use

Rysiekúr Memesson replied to Eugen

@Gargron @freemo @mkljczk @xorowl @jimpjorps or, put differently:

Is it distributed? Yes.

Does it potentially lead to denial of service (through resource exhastion)? Yes.

Sounds about right.

🎓 Dr. Freemo :jpf: 🇳🇱 replied to Rysiekúr Memesson

@rysiek

I cant speak to Gargron's setup but I think most setups would be able to handle 3400 RPM on the outbox without even batting an eye.

Also by that logic if too many people start using mastodon clients on their phone or desktop then that is a DDoS since enough of them are distributed and would lead to resource depletion.

@Gargron @mkljczk @xorowl @jimpjorps

Eugen Rochko replied to Tek say vote

@tek @freemo @rysiek @mkljczk @xorowl @jimpjorps Sorry, that's one zero too many from me. 400 req/s. Corrected.

🎓 Dr. Freemo :jpf: 🇳🇱 replied to Tek say vote

@tek

then I misread it, that is on the high side.. though depends how many users were doing it. I would imagine mastodon clients in general produce more requests per second than that collectively but we wouldnt call those a DDoS... I dunno we are arguing semantics though, does it even matter what we call it?

@Gargron @rysiek @mkljczk @xorowl @jimpjorps

Eugen Rochko replied to 🎓 Dr. Freemo :jpf: 🇳🇱

@freemo @tek @rysiek @mkljczk @xorowl @jimpjorps For comparison, average mastodon.social traffic is 200 req/s. I don't think it matters what we call it though. In my view it's a denial-of-service when it impacts performance due to unintended use, though maybe you could expand that to intended use as well. While the individual endpoints are intended to be used, it is the frequency with which they are retrieved that is unintended.

XorOwl replied to Eugen

@Gargron @freemo@qoto.org @tek @rysiek @mkljczk @jimpjorps
Linus Tech Tips' latest video on water cooling an SSD is a good illustration of this. Just because you can do it, doesn't mean it was intended use.

stn 🇺🇦

@Gargron @mkljczk absolute lmao

How DARE you block our hardcoded logic that is DDoSing your free service that we happen to be re-appropriating for our own purpose without your consent or knowledge. And yet you claim to participate in society! Curious!!!

Go Up