63
Bots overloading old.lemmy.today (lemmy.today)
submitted 3 months ago by to c/lemmytoday@lemmy.today
61 comments fedilink hide all child comments
 

Hi,

We had a DDOS attack against old.lemmy.today which overloaded the entire server for about 20 minutes. I had to turn off old.lemmy.today temporarily and will look through logs and probably block more chinese ip ranges, since thats where it came from.

Always something to do. :) Keeping this as sticky for a while to inform everyone.

Edit: I added more ip blocks for Chinese networks and hopefully it will keep future bots away. Bringing up the old.lemmy.today user interface again...

Edit 2: Had to take it down again due to massive bot scraping. Currently down.

Edit 3: Decided to require login for old.lemmy.today instead of using anubis.

you are viewing a single comment's thread
view the rest of the comments
[–] [S] 4 points 3 months ago (14 children)

You are very welcome if you do. Its the same content in old.lemmy.today as lemmy.today, just a different look. :)

I dont like cloudflare so doing my best to avoid it if I can.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 14 child comments
    •
  • [–] 2 points 3 months ago (1 child)

    Hi,

    I'm sorry to bother you again (I waited a week before messaging you), but I wanted to check in on something. Last weekend, I wasn't able to access old.lemmy.world.

    Around Tuesday or so, I could access the site, but I can't see any comments. I always get a 403 Forbidden error (with the words nginx at the bottom).

    Is this is a problem on my end that I can fix?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 3 months ago* (2 children)

    seems like it's working again but with anubis.. maybe can we just have something like http basic auth with a public password? (like have the password prompt as "type lemmy")

    i don't think anubis is a good solution. it's very trivially bypassed though maybe good enough to block stupid generic bots..

    see also https://lock.cmpxchg8b.com/anubis.html

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] [S] 3 points 3 months ago

    Ok now its working and seemingly blocking bots, but we will see over time how well this works. Like you said, im sure its possible to bypass but maybe it improves the situation somewhat still.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 3 months ago (8 children)

    Hi I just wanted to follow up on something

    Since last evening, I can't access old.lemmy.today (I can still access lemmy.today but that's not an interface I like).

    Are you having bot issues again or is there something I messed up on my end?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] [S] 3 points 3 months ago (6 children)

    Now it should work well again. I put it behind anubis and we will see if it improves the situation with the bots.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 1 point 3 months ago (4 children)

    I'm so sorry to constantly pester you, but I have another question.

    I've been enjoying old.lemmy.today for the past few days. The biggest praise I can give it: I haven't missed reddit at all, and the smaller community actually makes it feel like an upgrade. Like the reddit of old.

    But I wanted to make an account on Lemmy.today to make a post, however to register it seems I need an email address.

    I don't want to give an email address. I could give a disposable one from one of those sites, but that would be obvious (to what it sounds like is a human curation process).

    I know you said its to ward off bots, I'm wondering if its a temporary pause, or if its a permanent policy?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] [S] 2 points 3 months ago (3 children)

    It's fine to not give an email address. It's just for the email to let you know that you were approved or denied. So if you put something random there and check if you can login later, it's all good.

    I think it's even optional to give it... You can try registering without. :)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 3 months ago (1 child)

    So just as an update, I checked both old.lemmy.today and lemmy.today; both seem to require an email address.

    On lemmy.today is explicitly says email is required. On old.lemmy.today I tried fiddling around with various entries in the email field such as na, not_applicable, etc, but that didn't seem to work either.

    Is there something obvious I'm missing?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] [S] 1 point 3 months ago

    No, I checked and we do require email. I wasnt sure what was set there but yep, its required. But just put any email address there if you dont want to use a real one. You just wont get an email with approval or denyal after account creation, so you have to come back later and try to log in at some point.

  • permalink
  • fedilink
  • source
  • parent