19 ms·
> I've tried 30X redirects (which it follows) 301 response to a selection of very large files hosted by companies you don't like. When their AWS instances sta
by AdamJacobMuller 11mo ago
> I've tried 30X redirects (which it follows)
301 response to a selection of very large files hosted by companies you don't like.
When their AWS instances start downloading 70000 windows ISOs in parallel, they might notice.
Hard to do with cloudflare but you can also tar pit them. Accept the request and send a response, one character at a time (make sure you uncork and flush buffers/etc), with a 30 second delay between characters.
700 requests/second with say 10Kb headers/response. Sure is a shame your server is so slow.
- more_corn 11mo ago^ I love you
- notatoad 11mo ago>301 response to a selection of very large files hosted by companies you don't like. i suggest amazon
- lgats 11mo agounfortunately, it seems AWS even has firewalls that will quickly start failing these requests after a few thousand, then they're back up to their high-concurrency rate
- knowitnone3 11mo agoMicrosoft
- gruez 11mo ago>When their AWS instances start downloading 70000 windows ISOs in parallel, they might notice. Inbound traffic is free for AWS
- gitgud 11mo ago> Accept the request and send a response, one character at a time Sounds like the opposite of the [1] Slow Loris DDOS attack. Instead of attacking with slow connections, you’re defending with slow connections [1] https://www.cloudflare.com/en-au/learning/ddos/ddos-attack-tools/slowloris/ https://www.cloudflare.com/en-au/learning/ddos/ddos-attack-t...
- tliltocatl 11mo agoThat's why it is actually sometimes called inverse slow loris.
- amy_petrik 11mo agoit's called the slow sirol in my circles
- tremon 11mo agoAs an alternative: 301 redirect to an official .sg government site, let local law enforcement deal with it.
- integralid 11mo agoDon't actually do this, unless you fancy meeting AWS lawyers in court and love explaining intricate details of HTTP to judges.
- more_corn 11mo agoI like this idea. Here’s how it plays out: Singapore law enforcement gets involved. They send a nasty-gram to AWS. lawyers get involved. AWS lawyers collect facts. Find that the culprit is not you, find that you’ve asked for help, find that they (AWS) failed to remediate, properly fix responsibility on the culprit and secondary responsibility on themselves, punch themselves in the crotch for a minute, and then solve the problem by canceling the account of the offending party.
- kadoban 11mo ago> Find that the culprit is not you, find that you’ve asked for help, find that they (AWS) failed to remediate, properly fix responsibility on the culprit and secondary responsibility on themselves, punch themselves in the crotch for a minute, and then solve the problem by canceling the account of the offending party. Yeah, lawyers are notorious for blaming themselves and taking responsibility. You definitely won't just get blamed.
- anakaine 11mo agoA lawyer who can see an easy defence to a path they wish to pursue is going to consider that in their response. If thay defence looks like their own clients vulnerability would be exposed in defence because of their clients action or inaction, their first response will almost certainly be to get the client to fix that action or inaction.