Salta al contenuto
Citiverse è uno spazio aperto a tutte le comunità. Se vuoi aprire un gruppo locale o una sezione per la tua organizzazione, puoi contattare gli amministratori: pagina dei contatti.

TIL the fediverse basically DDOS's sites when you share a link.

Fediverse
141 78 0
  • So we need people to just mass post links to bad websites, is what you're saying.

    scritto ultima modifica di

    i'm feeling less ambivalent about those reddit repost bots for a moment

  • Thanks for bringing this up. I think in general we need to work on optimisation of Activitypub and Threadiverse implementations of it.

    scritto ultima modifica di

    Either publishing server should serve the metadata - although it would be prone to bad actors, so a refetch in the next 0-180 seconds would be appropriate. Or just add a random 0-60 second delay before fetching the data.

  • Similar, except those are caused by users visiting a link, whereas the Fediverse issue is federated servers gathering info before users even see a link.

    scritto ultima modifica di

    How many servers are we talking about? 10,000 ?

  • that don’t honour robots.txt

    That's essentially all of them in my experience.

    scritto ultima modifica di

    At least anything "AI"

  • I shared a link from NPR Tiny Desk but there was no image preview or video embed. After investigating this I learned that when you do that, each instance picks up the link and individually retrieves the link preview nearly simultaneously. For gargantuan sites like YT or Reddit, this is a trivial amount of traffic and not a problem, but for smaller sites like NPR this results in a sort of botnet DDOS attack on the site's servers. More here. Another example here . For that reason, NPR has blocked Fediverse servers like Mastodon.

    I have experienced this on my personal server as well (DDOS), but at the time didn't know why, exactly.

    This isn't the end of the world, but certainly is not great and hurts engagement with the content. Is there a solution for this? Perhaps using some sort of webtorrent service like PeerTube where they just fetch the information from another fediverse server instead of the source server? Maybe fetching embeds client-side? At least that would stagger the requests.

    E: Many people have replied comparing this to the Reddit "hug of death" or "The Slashdot effect". This is not the same at all. Those are legitimate site visits from humans that happen over the course of several hours. This is the result of several thousand servers all automatically fetching the same image simultaneously , and without any human involvement, and potentially next to zero human traffic to the site, which is why I compared it to a botnet or DDOS attack.

    scritto ultima modifica di

    it seems like ideally it shouldn't attempt to preview the link before a user tries to view the content. i guess that would increase latency for users though

  • it seems like ideally it shouldn't attempt to preview the link before a user tries to view the content. i guess that would increase latency for users though

    scritto ultima modifica di

    Sure would.

  • I liked writing efficient code but every place I worked didn't care at all about it. All they wanted was a finished feature and a kanban note moved to finished.

    scritto ultima modifica di

    The many pointless presentations I've given about tech debt and code quality. Argued for redesigning poorly designed systems. They don't care. Just churn out more features to cross off the list, and why do those features take so long?

  • The many pointless presentations I've given about tech debt and code quality. Argued for redesigning poorly designed systems. They don't care. Just churn out more features to cross off the list, and why do those features take so long?

    scritto ultima modifica di

    Yeah I think a lot of us share this experience. All the stuff we are tought in our educations about clean code and architecture... Once we come out and work, management don't want that stuff if it takes extra time. They want features shipped as soon as possible, and every meeting is about "how fast can you do this feature".

    And now of course embracing AI since it's so fast. When things break, engineers will have to figure out the problem when the entire system is down, not management. 🙂

    And then they can have a post mortem where they say that engineering must have better routines...lol.

    I no longer work in tech but I quit at the top I think, before Ai was a requirement. And when consulting salaries was still good. Now they are awful.

  • I have my blog address (which goes to my home server) in my Mastodon profile, and every time I post on Masto, my server gets a request from every Mastodon site that federates with my instance - i.e. hundreds of requests. It's no problem for my server, because my blog is a static site, but for anything that dynamically generates every single page impression (like worpress or joomla), it could be a problem. Caching settings might help, I suppose.

    Truth is, though, I get far more traffic from vulnerability scanners and AI crawlers that don't honour robots.txt (or aren't yet listed).

    scritto ultima modifica di

    To be honest, if a website has no caching of their server-rendered parts, they are also doing something wrong! Very little sites really need to re-render a public page on every view.

  • To be honest, if a website has no caching of their server-rendered parts, they are also doing something wrong! Very little sites really need to re-render a public page on every view.

    scritto ultima modifica di

    Around 2010, I used to work at an MSP, and once had a customer that ran a custom LAMP stack website for local radio UK stations web presence. It was a bit slow, running on a dedicated physical server, but every time it snowed, the website would 500 out - because of too many requests to the "School Closures" page. The site had no caching other than Apache's internal cache, but PHP pages could not be cached because "reasons", and the original developer was "not available". I optimised their MySQL indexes, increased the number of Apache workers, and it improved the render time per page and number of concurrent connections. Stress testing looked good.

    Anyway, some months later, 2AM one snowy morning, I was on call, and it went down again. This was when I discovered the school closures problem. After diagnosing, and then liaising with the customer to discuss the options, I was told "just make it work". I ended up modifying the PHP script to add some "on spec" caching that saved the HTML to a temp file in ramdisk, and only re-ran the query-and-render code if the cached copy was more than 5 minutes old. It was hacky, but it did the trick, and I was finished by about 4 AM. This hack was later applied at their request to a number of trouble-points in the source tree, as and when things broke.

    We recommended adding a Varnish cache, and found a more generalised caching library but they wouldn't/couldn't authorise engineering work for this - they were running on a shoestring - and they already had the tech break-fix contract with us, and decided it was sufficient to just spot fix things as they broke rather than fix the root cause.

    I left that MSP in 2012, so I don't know what happened after that, but as far as I know, the site could still be running.... unlikely, but possible.

  • that don’t honour robots.txt (or aren’t yet listed).

    Throw'em in the tar pit.

    scritto ultima modifica di

    Limited mental capacity these days, so I don't have the spoons to properly research and implement a solution at the moment. I installed Nepenthes last year, but I've never managed to get round to integrating it into my site. It's low priority at the moment.

  • Yeah I think a lot of us share this experience. All the stuff we are tought in our educations about clean code and architecture... Once we come out and work, management don't want that stuff if it takes extra time. They want features shipped as soon as possible, and every meeting is about "how fast can you do this feature".

    And now of course embracing AI since it's so fast. When things break, engineers will have to figure out the problem when the entire system is down, not management. 🙂

    And then they can have a post mortem where they say that engineering must have better routines...lol.

    I no longer work in tech but I quit at the top I think, before Ai was a requirement. And when consulting salaries was still good. Now they are awful.

    scritto ultima modifica di

    No, you just worked at bad places

  • No, you just worked at bad places

    scritto ultima modifica di

    Sure, but there are a lot of bad places. I bet the majority of engineers work in bad places like this.

  • I shared a link from NPR Tiny Desk but there was no image preview or video embed. After investigating this I learned that when you do that, each instance picks up the link and individually retrieves the link preview nearly simultaneously. For gargantuan sites like YT or Reddit, this is a trivial amount of traffic and not a problem, but for smaller sites like NPR this results in a sort of botnet DDOS attack on the site's servers. More here. Another example here . For that reason, NPR has blocked Fediverse servers like Mastodon.

    I have experienced this on my personal server as well (DDOS), but at the time didn't know why, exactly.

    This isn't the end of the world, but certainly is not great and hurts engagement with the content. Is there a solution for this? Perhaps using some sort of webtorrent service like PeerTube where they just fetch the information from another fediverse server instead of the source server? Maybe fetching embeds client-side? At least that would stagger the requests.

    E: Many people have replied comparing this to the Reddit "hug of death" or "The Slashdot effect". This is not the same at all. Those are legitimate site visits from humans that happen over the course of several hours. This is the result of several thousand servers all automatically fetching the same image simultaneously , and without any human involvement, and potentially next to zero human traffic to the site, which is why I compared it to a botnet or DDOS attack.

    scritto ultima modifica di

    I'm not exactly sure why a web server can't handle legit web traffic, just because it's a lot? I agree that smaller actors should be given a little breastfeeding but solving it on the other side is bad architecture. A legit request can never be compared to a a ddos attack, the overloaded net has to throttle and then the instances need to retry with a generous enough delay.

    Options for solutions to another systems problems are all going to introduce more problems. Sure, the requests could honestly be routed to a cache and it would help this problem, att least until it breaks or is exploited. But it would never be truly solved that way.

  • I'm not exactly sure why a web server can't handle legit web traffic, just because it's a lot? I agree that smaller actors should be given a little breastfeeding but solving it on the other side is bad architecture. A legit request can never be compared to a a ddos attack, the overloaded net has to throttle and then the instances need to retry with a generous enough delay.

    Options for solutions to another systems problems are all going to introduce more problems. Sure, the requests could honestly be routed to a cache and it would help this problem, att least until it breaks or is exploited. But it would never be truly solved that way.

    scritto ultima modifica di

    I'm not exactly sure why a web server can't handle legit web traffic, just because it's a lot?

    Its not because it's a lot, it's because it all happens in the same instant, which does not resemble any sort of normal web traffic.

    but solving it on the other side is bad architecture

    Solving it on the side that's creating the problem is bad architecture? 🤔

    But it would never be truly solved that way.

    Several potential solutions have been posited, if you just look through the comments.

  • I shared a link from NPR Tiny Desk but there was no image preview or video embed. After investigating this I learned that when you do that, each instance picks up the link and individually retrieves the link preview nearly simultaneously. For gargantuan sites like YT or Reddit, this is a trivial amount of traffic and not a problem, but for smaller sites like NPR this results in a sort of botnet DDOS attack on the site's servers. More here. Another example here . For that reason, NPR has blocked Fediverse servers like Mastodon.

    I have experienced this on my personal server as well (DDOS), but at the time didn't know why, exactly.

    This isn't the end of the world, but certainly is not great and hurts engagement with the content. Is there a solution for this? Perhaps using some sort of webtorrent service like PeerTube where they just fetch the information from another fediverse server instead of the source server? Maybe fetching embeds client-side? At least that would stagger the requests.

    E: Many people have replied comparing this to the Reddit "hug of death" or "The Slashdot effect". This is not the same at all. Those are legitimate site visits from humans that happen over the course of several hours. This is the result of several thousand servers all automatically fetching the same image simultaneously , and without any human involvement, and potentially next to zero human traffic to the site, which is why I compared it to a botnet or DDOS attack.

    scritto ultima modifica di

    Sounds like every instance is doing the preview generation. Maybe it could grab the preview data it needs on the original instance, and pass that around with the post...

  • Absolutely LOVE this idea but I feel like a solid implementation would be a pain in the fanny (and it also requires other peers to be online). I dip in and out over the day myself but I don't know what others use case is.

    Also it is far less trustworthy and harder to block bad actors (V's removing a known bad actor from a relatively small peer group).

    scritto ultima modifica di

    Not really "peers" in this case, just different servers communicating amongst themselves instead of all going to the original source.

  • But what happens when a link target changes? For example, I've seen news articles change as the author gets new information. Might be an edge case, but a solution like this would always show the preview at the time of the initial post.

    scritto ultima modifica di

    Is that normally updated? If so, how often are they polling for changes?

  • I'm not exactly sure why a web server can't handle legit web traffic, just because it's a lot?

    Its not because it's a lot, it's because it all happens in the same instant, which does not resemble any sort of normal web traffic.

    but solving it on the other side is bad architecture

    Solving it on the side that's creating the problem is bad architecture? 🤔

    But it would never be truly solved that way.

    Several potential solutions have been posited, if you just look through the comments.

    scritto ultima modifica di

    Lots of normal traffic is instant. Throttling must be handled by for in this instance NPR or its providers routers because even if hammering is a bad practice, we are participating in why it happens at all if we just build structures to mitigate it.

    Yes that's why I included a solution, and explained explicitly that it can be solved but only temporarily

  • Lots of normal traffic is instant. Throttling must be handled by for in this instance NPR or its providers routers because even if hammering is a bad practice, we are participating in why it happens at all if we just build structures to mitigate it.

    Yes that's why I included a solution, and explained explicitly that it can be solved but only temporarily

    scritto ultima modifica di

    Lots of normal traffic is instant

    Not instant from a thousand different servers. That's what a botnet looks like. AKA DDOS. That's why I explained that. Why are you acting like you don't understand this?

    Throttling must be handled by for in this instance NPR

    No. It mustn't. AP servers can fix it on their end.

    Yes that's why I included a solution

    Which you then went on to explain wasn't a solution...?


Citiverse è un progetto che si basa su NodeBB ed è federato! | Categorie federate | Chat | 📱 Installa web app o APK | 🧡 Donazioni | Privacy Policy

Il server utilizzato è quello di Webdock, in Danimarca. Se volete provarlo potete ottenere il 20% di sconto con questo link e noi riceveremo un aiuto sotto forma di credito da usare proprio per mantenere Citiverse.