@JeGr@chaos.social

· 3mo ago

Replying to

@masek@infosec.exchange Haben sich dann auch extrem lange gewunden und wollten nicht, bis nochmal Druck vom Hersteller und mir kam, dann hat der neue Inhaber endlich nen Ersatz bekommrn. Werde Asustor aber meiden, sind mir zu sehr aufs Limit gebaut. Kiste lief ständig bei 60+ Grad. Bin auf nen Beelink Würfel gewechselt (hatte nur 6 bestückt von 12) und die Kiste ist leiser und kälter ohne Probleme. Vermutlich bei dir 12 Drives voll bestückt?

2

1

0

Jens @JeGr@chaos.social

· 3mo ago

Replying to

@masek@infosec.exchange fühle ich, hatte das gleiche Theater. Gerät reklamieren wollen weil läuft zu heiß (subjektiv), Hersteller sagt alles iO. Verkauft das Ding auf eBay - 2 Wochen später meldet sich Käufer, Gerät wäre kurz drauf gestorben (damn nicht beabsichtigt aber bestätigt mein Bauchgefühl) Also Händler geschrieben dass ich Eigentum an neue Person abgetreten habe und die die Garantie abwickeln sollen, gleichen Mist bekommen mit Beweisumkehr blabla - hallo 3 Jahre Garantie, keine Gewährleistung! Elend.

1

2

0

Jens @JeGr@chaos.social

· 3mo ago

Replying to

@handi@mastodon.ie @mike805@noc.social Only thing you see when getting hit by such a bot wave is that you only get hits from the same IP once every 12-72h (they're careful) and you often see only hits to URI (cause of scraping) but no further content (no JS, CSS etc is downloaded). So single hits but from a metric shit ton of IPs that all/most are located in residential IP blocks so if you don't accidentally want to block innocent customers, blocking ranges, ASNs or stuff is out of question. We analyzed one case ...

1

5

0

Jens @JeGr@chaos.social

· 3mo ago

Replying to

@handi@mastodon.ie @mike805@noc.social for days and located IPs that fit that rough description of only being used infrequently, dl'ing only the one URI/path, perhaps weird UA combo and stopped after our manual blocklist aggregated over 1.2Mio entries and wasn't even complete. Those residential proxy scrapers are really fucking annoying and destructive (no interest in e.g. robots.txt). Only real counter was host based solutions like Anubis (https://github.com/TecharoHQ/anubis) which does "proof of work" tests that bots fail :)

GitHub

GitHub - TecharoHQ/anubis: Weighs the soul of incoming HTTP requests to stop AI crawlers

Weighs the soul of incoming HTTP requests to stop AI crawlers - TecharoHQ/anubis

1

4

0

Jens @JeGr@chaos.social

· 4mo ago

Replying to

@jimp@masto.ai So Jekyll is "close enough" in MD syntax to just e.g. throw a copy pasta from Joplin over and modify 1-2 things and hit save to use? Huh... I could see that work as a first draft to get going and somehow "automating" it later on if that's the case. After having run dozens of CMS sites over the years, I'm just tired by most of it and speed+security are so much better to get with static site generators like Jekyll, Hugo or Mkdocs that I'd love to use this instead of patching other systems :)

1

0

Jens @JeGr@chaos.social

· 20mo ago

Replying to

@echopapa@social.tchncs.de @masek@infosec.exchange @Lilith@chaos.social Ich finde Kunden und zu viele Geschichten aus dem Alltag in diesem thread und finde es belastend 😵‍💫 Gerade heute wieder ein Ticket vom Kunden, der weiß dass es Blödsinn ist, dass er auflisten soll, was seine kleine Firewall gegen DDoS macht und dass er gerüstet ist. Weil das in der Checkliste steht. WTF. Wenn dich jemand in Paketen ersäuft kannst du den Regenschirm auspacken aber ohne dass jemand das Wasser weiter vorn abdreht stehst du trotzdem im Regen...

3

0

Jens @JeGr@chaos.social

· 3mo ago

Replying to

@handi@mastodon.ie @mike805@noc.social In one case of a customer it reduced the page hits of their shop site by more then 80 freakin percent and at the same time they had more turnaround and sales then before as the site was way faster and responsive and not wrangled down by a storm of bullshit scraping. We almost thought we misconfigured the service as the hits dropped but it was actually mainly bots ans scrapers ruining the day so the customer was really happy by the outcome. It's insane. 80% hits for nothing.

0

Jens @JeGr@chaos.social

· 4mo ago

Replying to

as static HTML (like mkdocs etc) so it can be simply uploaded to a prepared webserver. Without dependencies to BS like GitHub (Pages) or something extremely specific. And open source of course. And with the option to sync between devices (even if manually or like Syncthing). Additional big bonus would be with minimal additional stuff. I know many would eg point to Obsidian, half a dozen plugins, a self hosted server component, some Git and CI, Hugo, yada yada. How about: simpler if possible? :)

0

1

0

Jens @JeGr@chaos.social

· 4mo ago

Replying to

Why local/offline? Because writing and accessing my knowledge base stuff should be possible especially! when nothing else is working. No internet. No self hosted server component but a local app with local data that can sync and publish automatically or on demand writing stuff like Wikis with drag and drop of images and nice looking formatting etc. That'd be a really nice thing. Systems for "app" usage: Linux, Android, Windows (shrinking)

0

Jens @JeGr@chaos.social

· 4mo ago

@davidrevoy@framapiaf.org I know you didn't have much to do with the actual print and publish but the books from Silly Studios and their Pepper & Carrot Kickstarter are finally here any THEY ARE A BLAST! So happy about the quality and to have those comics of yours now available even for a quiet time without internet and drama :)

0

2

0

Jens @JeGr@chaos.social

· 4mo ago

Replying to

@dnkrupinski@hannover.town I know Dokuwiki and for the content side, yeah similar to it. But no, I want no centrally on installed wiki somewhere with permission and stuff to set up, but a more on device app like usage primarily and the ability to export some of it to the web on a secondary level. But the main thing is to not be online or centrally installed somewhere in the first place. When push comes to shove that would leave me locked out without internet or access. That's why offline comes first :)

0

Jens @JeGr@chaos.social

· 3mo ago

Replying to

@handi@mastodon.ie @mike805@noc.social

As someone working for a small hosting corp that has to deal with those shitty scrapers:

More companies than you'd think.
User Agents are either all over the place (randomized so you get e.g. Presto (old Opera) on Fedora current Linux (what'd be really weird) or stuff like iPod Touch on B2B sites where that would be really strange.
Other times UA is matching the most common Chrome tags
No, reverse engineering is hard as the count of IPs are literally in the millions.

0

6

0

Jens @JeGr@chaos.social

· 3mo ago

Replying to

@handi@mastodon.ie @mike805@noc.social Simplest PoW is something like asking the client (normally the browser) to calculate the result of a mathematical expression. Many crawlers are there for speed and content and don't react well to questions back but there are newer ones that try to simulate stuff. AI is throwing more AI to fuck up your service to serve more AI slop. So Anubis as example can raise the complexity of calls. Best explained on their website or GitHub page than my layman's terms. But it works so far.

0

2

0