davidfischer

11 ms·

1.
by davidfischer 5d ago
> Do you have a list of the addresses that were hammering your site? I could get a list of IPs, but it wouldn't be particularly helpful. It was hundreds of millions of unique IPs. Most IPs made fewer than 100 requests and then disap
2.
by davidfischer 6d ago
Author here. This attack was extremely broad. I saw parts of this attack come from my own home ISP's ASN, though not my IP thankfully. If we just "blocked those places" there would be a lot of collateral damage. As it stood,
3.
by davidfischer 7d ago
> The description/approach seems static and limited? Why not maintain a leaky bucket that counts each request (tickets/points) with higher cost for expensive requests (404, redirects). As the IP's reputation deteriorates (
4.
by davidfischer 7d ago
It will probably be useless one day. In practice, it is still useful today though not for this attack.
5.
by davidfischer 7d ago
Here's my take: * JA3s are mostly useless. JA4s supersede them entirely. * Using JA4s in rate limits is pretty useful and helps a lot against proxy scraping. It was not very helpful in this attack. * Bot detections are somewhat helpful
6.
by davidfischer 7d ago
My assumption would be that it would drastically reduce the attack to be borderline irrelevant. I've never turned on Under Attack so somebody else may have more insight and the docs[1] don't describe precisely what happens besides
7.
by davidfischer 7d ago
Author here. This was not a misconfigured data scraper. We see those every week[1]. This attack wasn't scraping useful content. It was almost entirely 404s and 302s and pulled virtually zero real docs. It specifically looked for URLs n
8.
by davidfischer 7d ago
I've never seen the phrase "manual transmission user-agent". Using your own browser yourself is the new stick shift. Love it.
9.
by davidfischer 7d ago
I talked about that directly in the post. We didn't want to just challenge everyone. We use JS challenges but we try to use them sparingly. The rest of the ops team and I were fighting to stay up but it never got so bad that it was a c
10.
by davidfischer 7d ago
It's terabytes of content and other than we're the host not really related to each other. However, for most projects, it's possible to download a zip file of all the HTML docs for that project. We have a lower rate limit to p
11.
by davidfischer 7d ago
I'm the author of the blog. I don't know. Internally, we were half joking that we were going to get ransom notice, but we never did. The only thing that sort of correlates with this attack is that before it started, we began rolli
12.
Understanding the recent DDoS attack against Read the Docs(about.readthedocs.com)
217 points by davidfischer 7d ago|82 comments
13.
by davidfischer 1mo ago
I use DDG on Android and it works pretty well there. I also saw this line in the article and it's somewhat of a stretch to call DDG either a "major" browser (as you point out) or a "non-Chromium browser". My underst
14.
by davidfischer 4mo ago
Nowadays, somebody can just ask claude to build them a scraper/bot that hooks into a proxy network and all of a sudden they can easily send 20k+ reqs/min from hundreds or thousands of IPs cycling them as they get rate limited or b
15.
by davidfischer 6mo ago
I built EthicalAds ( https://www.ethicalads.io/ ) for exactly this reason. No tracking. No cookies. No behavioral targeting (targeting based on stuff you've previously done). Every website where our ads appear AND every
16.
by davidfischer 7mo ago
They absolutely do. Every sponsorship you see on a podcast or a youtube video or a streamer is a contextual ad. Many open source sponsorships are actually a form of marketing. You could argue that search ads are pretty contextual although t
17.
by davidfischer 7mo ago
Founder of EthicalAds here. In my view, this is only partially true and publishers (sites that show ads) have choices here but their power is dispersed. Advertisers will run advertising as long as it works and they will pay an amount commen
18.
Doing Math with Embeddings for Better AI Ad Targeting(ethicalads.io)
5 points by davidfischer 11mo ago|0 comments
19.
by davidfischer 1y ago
My employer, Read the Docs, has a blog on the subject ( https://about.readthedocs.com/blog/2024/07/ai-crawlers-abuse... ) of how we got pounded by these bots to the tune of thousands of dollars. To be fair thou
20.
DuckDB and PostgreSQL Make a Great Pair for Analytical Processing(ethicalads.io)
3 points by davidfischer 2y ago|0 comments
21.
by davidfischer 2y ago
I'm not the poster you're responding to but I'm one of the founding team of EthicalAds. We're a small team, focused exclusively on marketing to devs, and really trying to show high-quality ads without tracking people (ad
22.
by davidfischer 2y ago
My employer, Read the Docs is a heavy user of Cloudflare. It's actually hard to imagine serving as much traffic as we do as cheaply as we can without them. That said, for publicly hosted open source documentation, we turn down the secu
23.
Mozilla's privacy preserving ad attribution: The future or an oxymoron?(ethicalads.io)
10 points by davidfischer 2y ago|0 comments
24.
by davidfischer 2y ago
There's a few ways first party cookies can track you. Probably the biggest single way is Google Analytics which by default uses only first party cookies. Even without cookies at all, GA could track you across the web although first par
25.
by davidfischer 2y ago
I edited to make my comment more clear but polyfill.io sends dynamic polyfills based on what features the identified browser needs. Since it changes, the SRI hash would need to change so that part won't work.
26.
by davidfischer 2y ago
SRI generally won't work here because the served polyfill JS (and therefore the SRI hash) depends on the user agent/headers sent by the user's browser. If the browser says it's ancient, the resulting polyfill will fill i
27.
by davidfischer 2y ago
Keychain Access has not been "fine". It's had multiple unaddressed data loss bugs. For example, Keychain lost all passwords from all Keychains after the Catalina update[1] and this wasn't fixed in the next 3 Catalina min
28.
by davidfischer 2y ago
I can't confirm if the price is the same or not, but their terms[1] specifically mention that the price can be different. > Prices for Offerings you order for delivery or pickup through the Online Grocery Ordering Service may be hig
29.
by davidfischer 2y ago
While I agree with you to an extent, this is not a very good way to check actual in-store prices. Most grocery stores charge a different rate for products that are delivered or even curbsided than they do if you go to the store and buy it y
30.
by davidfischer 3y ago
I'd just like effective privacy laws in the US generally.

More ›