m3047

Having first run a bot motel in I think 2005, I'm thrilled and greatly entertained to see this taking off. When I first did it, I had crawlers lost in it literally for days; and you could tell that eventually some human would come back and try to suss the wreckage. After about a year I started seeing URLs like ../this-page-does-not-exist-hahaha.html. Sure it's an arms race but just like security is generally an afterthought these days, don't think that you can't be the woodpecker which destroys civilization. The comments are great too, this one in particular reflects my personal sentiments:

> the moment it becomes the basic default install ( ala adblocker in browsers for people ), it does not matter what the bigger players want to do

At least under some circumstances Linux shows (schedulable) threads as separate processes. Just be aware of that.

For whatever it's worth I live in South Tacoma, Pierce, WA, USA. You're not going to find a working, greasy auto club at the flagship Lemay Museum (although it's worth a visit, as is Blackhawk in CA). However, the Lemay family is a local fixture / institution.

I drive by the family compound in Parkland maybe once a month. They own / owned Marymount, the former military boarding school; for lack of a better characterization they use it as a garage. There are auto and motorcycle shows there annually (and also gun shows). Walking one of those shows and talking to people is certainly on the table, but it's not a "need to do something now" option.

Meanwhile, talking to people (Burns Towing, the good people, as opposed to the sh*tshow on Hilltop which the City contracts for impounds) and making phone calls has generated some promising leads on the mechanic front anyway. I went and visited a guy a week ago who has a lift (and his old race car) in his garage and wrenches older US metal as a semi-retired pastime. He might find time to help me out if along with paying him decently I provide him with some home brewed beer.

We talk about "free beer", but in fact beer is not fungible on the internet.

That's the 30s-60s car people primarily. They charge admission "for a good cause". Show me a picture from your local car show with a 1985-1995 working pickup truck in it; honestly I'd like to see it, and know Santa Claus lives somewhere. But we're off the track.

So about this car show: does it have an internet presence, or is it AOL^H^H^HFacebook? A mailing list? IRC? Slack? What's it got? Is it actually "alive"?

Calling (phone calls, not internet) around, it became apparent that there is more interest around vehicles like this in "farm country": if I'd wanted to drive 50+ miles I'd have several mechanics to choose from.

The "friendly online world" was a reflection of people's willingness to meet in meat space in a civil fashion, even if it was uncomfortable at times.

Purely anecdata, but a recent personal experience which seems pretty unremarkable:

I have a 1991 pickup truck; good truck, I still drive it and use it as a truck. The two local mechanics I would have taken it to for some needed work both sold out in the past few years and the new owners don't want to work on anything more than 20 years old. (Their reasons belying their inexperience, but I digress.)

There used to be auto and bike clubs around here, where motorheads got together to wrench and talk about their vehicles, and share personal experiences with mechanics, machine shops, etc. Now the clubs are (still) focused on the (same) 1930s-1960s cars and they've been upscaled into a high-roller venue and fundraising channel.

I'm not the only person driving 25-50 year old metal around here.

I put an ad on Craigslist seeking a suitable group or birds of a feather to form one; I got six responses. I put my phone number in the ad, and there's no escaping Craigslist's anonymous remailer.

No phone calls. Two of the responses were duds, leaving four people who demonstrated that they wanted to have conversations using CL's anonymous remailer: that doesn't scale. Sent a boilerplate response to all four once again providing my phone number, and also my real email address; offering to drive my truck to some local public place if they drove theirs.

No takers.

20+ years ago, online communities existed to complement other means of communication whether that was private chat / email / telephone calls, or meatspace meetups.

> not federated and centralized

That's curious to me, because I see those as roughly opposed (both are proxies for organizational systems). NNTP (usenet): clearly federated (works by flooding). DNS: the religious obsession with the "one true root" doctrine, while it makes sense in the context of a global naming scheme (anybody advertising false root should be shot, according to Mockapetris), hampers the technology's adoption for other purposes. Global internet routing i.e. BGP is still pretty much federated.

Just the other day I saw a shitpost from someone to the effect that if "BDR" is a thing they're going to quit cybersecurity entirely. Did you know there is a company actually offering BDR? Apparently that's true.

> There are already H5N1 vaccines for both chickens and humans; pharma companies are working hard on cows.

We need another term besides "vaccine" for the class of inoculations which don't prevent disease spread but rather lessen the (statistical) occurrence of severe illness. A lot of the focus on "vaccines" for chickens, cows, pigs etc. is on preventing severe illness: preventing serious illness still allows product to be delivered to market (hopefully post illness) whereas preventing disease spread requires a commitment to culling breakthroughs which interferes with profit!

My general understanding that preventing serious illness, rather than transmission, is the objective with current influenza vaccines for humans as well.

(As long as they're not noticeably sick, I'll keep on hugging my chickens as a source of generalized immunity to both coronaviruses and influenza.)

Covid, or its immediate analogues, were extensively studied in a lab in Wuhan for exactly this reason. When it became the "Covid" we all know and love then it was a thing and not a precursor.

H5N1 today is a precursor. How would we know whether the strain which finally goes "viral" in humans is a product of "natural" washing or was done in a lab with humanized mouse cells?

I didn't run the text generator in real time (that would defeat the point of shifting cost to the adversary, wouldn't it?). I created and cached a corpus, and then selectively made small edits (primarily URL rewriting) on the way out.

(I was going to post "run a bot motel" as a topline, but I get tired of sounding like broken record.)

To generate garbage data I've had good success using Markov Chains in the past. These days I think I'd try an LLM and turning up the "heat".

Some useful measurements from Geoff, I'm not sure what the thesis is or it wasn't stated clearly enough for me at the outset, and the conclusion appears to be to use anycast for authoritative nameservers because it's recursives' faults.

Anyway: Recursives don't consistently do a good job of picking the fastest-responding authoritative. Apparently the description of how to do this in RFCs is unclear (not to me). Unbound uses a measure (400ms) which is conflated with a "diameter of the public internet". My interpretation is that BIND does the best job of honoring the RFC's intent in this regard.

I concur that faster is generally better, but on the other hand recursives shouldn't be running with a cold cache except on startup. Parallelization of requests isn't addressed and neither is for instance the impact of long CNAME chains or requiring resources from numerous instances of disparate authoritative infrastructure (or CNAME chains requiring resources from disparate infrastructure).

So this kind of seems to me like telling authoritative operators what they want to hear and probably already know / suspect.

Purple Earth hypothesis. The first (AFAWK) photosynthetic critters were cyanobacteria. They produced enough oxygen to kill off everything which couldn't withstand its reductive effects. Oxygen levels have been much higher than they are today, presumably this is what made e.g. 6 foot centipedes a possibility.

Since this is getting upvoted, I will put forth a suggestion I've made to the people who've paid me to help with this sort of subterfuge: turn your 404 handler into search. Then a human who goes there has a way out. But absolutely, load it up with garbage and broken links.

Thanks for the explanation.

Once in a while people pay you to do something you enjoy doing, like making people cry and wish they had a jobs flipping burgers instead. But I do it on my own systems for fun, honestly.

> What is the issue with this request?

I didn't realize this was an Apple thing, but that's fine. It changes the color of the horse and the name of the river, but the same road leads to the same destination.

1) There is a notion that Cloudflare is a content distribution network. The risk profile for a content distribution network is different from a VPN service. Now I know it's a VPN service (or is it?). Changes it from "seems weird and inappropriate" to "do I care about people relying on this? no, probably not". Cloudflare can't be arsed to provide reverse DNS for something which is clearly not part of their CDN, or is it?

1.5) Is it layer 2 or application? Cloudflare runs a CDN. Correct me if I'm wrong, but the CDN is a reverse proxy is it not? Is Cloudflare caching my website's content? Can they observe it? (It's surprisingly hard to find a solid explanation, but they talk about "proxies" and "decrypts the name of the website you requested" and none of that adds clarity, it makes it sound more like believe what we want you want to believe.)

2) I don't block incoming SYNs from Cloudflare (yet) the way I do with Amazon, and this traffic per se isn't going to trip any mitigations here. But not all of the traffic is as benign (and it's impressive that they're so technically savvy they don't need the CSS as noted elsewhere). Presumably those exit points are shared by multiple customers. Did I mention I block all incoming SYNs from Amazon?

Heres Crime^H^H^H^H^(ahem)Cloudflare requesting assets from one of my servers. I don't use Cloudflare, they have no business doing this.

  104.28.42.8 - - [21/Dec/2024:13:58:35 -0800] consulting.m3047.net "GET /apple-touch-icon-precomposed.png HTTP/1.1" 404 980 "-" "NetworkingExtension/8620.1.16.10.11 Network/4277.60.255 iOS/18.2"
  104.28.42.8 - - [21/Dec/2024:13:58:35 -0800] consulting.m3047.net "GET /favicon.ico HTTP/1.1" 200 302 "-" "NetworkingExtension/8620.1.16.10.11 Network/4277.60.255 iOS/18.2"
  104.28.42.8 - - [21/Dec/2024:13:58:35 -0800] consulting.m3047.net "GET /dubai-letters/balkanized-internet.html HTTP/1.1" 200 16370 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.4 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.4 facebookexternalhit/1.1 Facebot Twitterbot/1.0"
  104.28.42.8 - - [21/Dec/2024:13:58:35 -0800] consulting.m3047.net "GET /apple-touch-icon.png HTTP/1.1" 404 980 "-" "NetworkingExtension/8620.1.16.10.11 Network/4277.60.255 iOS/18.2"

  # dig -x 104.28.42.8

  ; <<>> DiG 9.12.3-P1 <<>> -x 104.28.42.8
  ;; global options: +cmd
  ;; Got answer:
  ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 35228
  ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

  ;; OPT PSEUDOSECTION:
  ; EDNS: version: 0, flags:; udp: 1280
  ; COOKIE: 6b82e88bcaf538fc7ab9d44467685e82becd47ff4492b1be (good)
  ;; QUESTION SECTION:
  ;8.42.28.104.in-addr.arpa.      IN      PTR

  ;; AUTHORITY SECTION:
  28.104.in-addr.arpa.    3600    IN      SOA     cruz.ns.cloudflare.com. dns.cloudflare.com. 2288625504 10000 2400 604800 3600

  ;; Query time: 212 msec
  ;; SERVER: 127.0.0.1#53(127.0.0.1)
  ;; WHEN: Sun Dec 22 10:46:26 PST 2024
  ;; MSG SIZE  rcvd: 176

Further osint left as an exercise for the reader.

Easy way is to implement e.g. a 4xx handler which serves content with links which generate further 4xx errors and rewrite the status code to something like 200 when sent to the requester. Load the garbage pages up with... garbage.

My reason for smacking stuff down is that I don't want to see it in my logs. That simple.

I'm seeing some address ranges in the US clearly serving what must be VPN traffic from Asia, and I'm also seeing an uptick in TOR traffic looking for feeds as well as WP infra.

It's not that hard to dominate bots. I do it for fun, I do it for profit. Block datacenters. Run bot motels. Poison them. Lie to them. Make them have really really bad luck. Change the cost equation so that it costs them more than it costs you.

You're thinking of it wrong, the seeds of the thinking error are here: "I wonder how soon it becomes actually infeasible to operate a website with actual original content".

Bots want original content, no? So what's the problem with giving it to them? But that's the issue, isn't it? Clearly, contextually, what you should be saying is "I wonder how soon it becomes actually infeasible to operate a website for actual organic users" or something like that. But phrased that way, I'm not sure a CDN helps (I'm not sure they don't suffer false positives which interfere with organic traffic when they intermediate, more security theater because hangings and executions look good, look at the numbers of enemy dead).

Take measures that any damn fool (or at least your desired audience) can recognize.

Reading for comprehension, I think Rachel understands this.

> All the New Yorkers just thought that's how Coloradoans talk.

I love it. I blame France, specifically Remulac.

I don't know for a fact how the machine does it based on feather shading, but I do know for a fact that there is a thing about chickens: sex linking in hybrids.

When you hybridize certain pairs of breeds (e.g. reds and barred rocks) the hybrid chicks show different feather coloring at the time they hatch. Hybridization can also produce offspring which are for instance more productive egg layers. Being hybrids, they don't breed true.

Not all hybrids have the same consistent sex-linked characteristics.

I apologize for the commercial plug, but when I switched off of CenturyLink and onto Ooma last year my robo / spam calls went way down. Part of that is that they have some filtering options, part of that is that I believe they provide telemetry to something akin to NoMoRobo.

Ooma isn't in there (woot! that's my VOIP to DECT provider). There's a Zoom Telcom, but I don't think it's the Zoom we all know.

Very nice. My favorite definition of "blue collar vs white collar" is whether you wash your hands before or after you use the toilet. Not entirely true, but that's the gist of it.

Own a 1990-1991 motorcycle (own two actually, same model) which came from the factory with 10.5:1 compression (drive train from a different bike, they upped the displacement slightly and that also contributed to the increased compression). In the winter it warms up faster on the cheap lower octane gas with ethanol (can't use it in the summer, can't use it for highway riding). On the highway it runs better / better mileage with higher octane gas with ethanol than without. YMMV (had to say that!)

I was looking for possible inspiration for some kind of best practice to reduce the amount of information returned for wildcarded Redis queries (reduce it to just what's changing, or maybe some piece of what's changing). Didn't find it. Could be the documentation lacks clarity.

Since there was no interest I turned it off.