ransackdev

I'd like to know where companies like https://www.hawkanalytics.com/cellhawk/ and https://en.wikipedia.org/wiki/Fog_Reveal get location data on US citizens legally without the permission of those citizens, and how them buying such info isn't illegal surveillance, and how reselling the data to law enforcement is not selling stolen property for them, and receiving stolen property for the fuzz (assuming, maybe wrongly so, that I own my location data as PII)

If the hotspot were compromised, why would you connect to it at all?

> NOTE: I am not a lawyer, and this is not legal advice. This is for informational and entertainment purposes only

Asking because I don't know - I see this a lot, but is it necessary? Surely we don't live in a time where a commenter on a news site is liable for their opinion, right?

Irony; NSA, CISA, and DOJ release cybersecurity bulletin as a pdf attachment

> This just sounds like a gateway to the widespread open robbery and stealing

If it looks like a duck, and quacks like a duck...

Do you type faster than what javascript is able to handle?

Couple things to consider

1. Check your competitors who return json and see if they have a Location header 301'ing or 302'ing all their traffic to your service (if the client follows redirects).

2. Reverse dns lookup your origin ips and see if anyone has a domain's dns pointed at your service. Check the Host header on your end and make sure it's your domain as well as ensure your web server and/or proxy are not blindly accepting traffic for `*`/any host, and make sure it's serving only your host

3. Ip address headers can be spoofed. It might not be coming from where you think it's coming from

You mentioned low income countries. This could be infected devices running ancient unpatched OSes, but what if the traffic is legit, coming from impoverished countries who found your service and use it to teach their children and learn things they'd otherwise not have access to?

Personally I would deep dive the traffic and try to determine the intent behind it, you could be destroying a future generation's potential, and not blocking malware I'm assuming you can correlate the requests from those ips with that they are translating. Odds are someone is hitting your service to translate for their paid service, but if it's an important part of a poor country, I'd find a way to allow it to keep happening

> AFAIK we couldn't see translation requests from them, just loading our website.

Browser homepage? Or maybe the unlucky victim of a "connectivity check/am I online" recurring task

There's a huge difference between blocking traffic to keep your servers online (you are the good guy) and returning payloads that are intended to break consuming services (you are the bad guy, performing a premeditated malicious act on unsuspecting devices, across state lines)

You didn't get kicked out, you got played. They bank on the fact that most people will eat less than the price of admission, kinda almost like the ones who under eat the admission cost subsidize the ones who overeat the admission cost. Kinda like the paying customers for a service usually subsidize the running costs of the free tier. The buffet advertised all you can eat, you paid them, that's a contract. Unless there's fine print that you agreed to, you had no obligation to leave before you had your fill if they were open still. America 101, contracts and liability for breaches of contracts.

For example here's the Backblaze team verifying that their unlimited personal backup is indeed unlimited, with one single user storing 430TB for $6/month. The users spending $6/month who use a couple GB more than offset the cost of the 430TB guy. If your business model doesn't support the ability to get in the black, you have a failing business. This isn't the user's responsibility to fix, it's the failing service with a bad business model.

> As you can see, we lose money on a few customers at the high end (we cannot store 430TB of data for only $6/month), but since more customers just want to be reasonable and backup their laptops we are profitable and fully sustainable on the "average"

> Somebody who is costing Backblaze $2,150/month and is only paying $6/month :-)

https://www.reddit.com/r/IAmA/comments/b6lbew/comment/ejlbsq...

pihole and other dns blocklists would reduce traffic to their service, not increase it

> there's a reasonable common sense expectation

Your logic error is in assuming all people have common sense and setting expectations based on that assumption.

This actually has nothing to do with common sense, a jr and sometimes even senior mobile devs would not have the mindset of avoiding a ddos to a third party api when writing a feature that needs to get the device ip. It wouldn't be on purpose, it would just be that they don't know that they don't know yet. These issues of slamming a backend server are pretty common and mobile devs don't know to avoid it until they cause it imo. This could also be malware too which wouldn't care about decency.

Point is, scale your service, adjust your terms, start rate limiting, or shut it down. Calling your users names is the wrong solution no matter the user's intent, and solves exactly zero of the issues at hand.

The service owner should feel proud to have such a popular service, many folks will never have to deal with scaling issues. As the saying goes "scaling issues are good issues to have".

> rolled out an update to hundreds of thousands of millions of devices with simply emailing me if that's ok.

If it's malware, they don't care if it's ok, they are malware authors. Contact your hosting provider which 100% has the ability to offload traffic from malware and ddos. They are responsible for the network and will not want malicious traffic anywhere on it, esp if it's tying up bandwidth for paying customers or premium bandwidth. If it was a large amount of bandwidth they would have contacted you long before you contacted them. I'd still reach out, they will move on it quick if it's an issue, and at the least can examine the traffic to determine if it's bad or not.

Cloudflare won't do much good here no? The requests still have to proxy back to your origin servers to spit back the ip. You can't utilize any caching on cloudflare due to the unique ip of each client. Their ddos prevention might not help because these are clients each with their own unique ip address, which is probably a cellular provider's ip space and not bad traffic. If it's the volume of clients hitting you, and not the volume of requests they make, it wouldn't trip cloudflare, or they'd be blocking major cellular address space across their entire network (which is a large portion of the internet these days)

Think of your average engineer doing mobile development. "Here, hit this url to get the device ip". They write the code, it makes 1 request. The average backend engineer isn't performance focused, why would the average mobile engineer be thinking about a distributed denial of service against some third party api? Most mobile engineers have to be guided to not slam their own backend servers, and do not approach problems in their sphere with the mindset to prevent this type of issue. Not knocking mobile devs, it's just literally not something they have to care about most of the time, and imo only the ones who go out of their way to have a solid understanding of the backend systems would even understand what's in play here

Besides that, odds are that this is malware of some sort hitting this service to get the infected device's public ip to phone it home for use in a command and control situation, and if so, they don't care that they are slamming this service.

Mobile devs who care about this type of thing will not need to make any sort of outbound connection anywhere to get the device ip address, it's right on the device already. These what's my ip sites are used by script kiddies and malicious software running on anything

"There's always an individual with autism-level consideration for what one says, isn't there?" isn't needed and I'd advise you to be more professional, or at least more human.

CAPTCHA is for humans while this json service is for machines

Building the paid features announced 3 years ago would pay for compute as well as bandwidth. If the service runs at a loss after that, shut it down or start reaching out to these companies that have integrated it into their products and ask them to sponsor the service, which will certainly be cheaper for the company compared to the cost of dev time to change to some other service that can shutdown just as quick, QA the updates, iterate, approve, ship, wait for adoption, triage bugs, manage all the people doing those things, etc.

Or better yet update the TOS to be free and unlimited for non-commercial use, and to contact sales for commercial use with an estimate of request volume, then sign a phat enterprise contract and rest easy

Welcome to the internet. Install pfsense/opnsense and run your own firewall at home and you'll be shocked at the flood of non-stop portscans hitting your ip getting blocked. This is par for the course and there is nothing you can do to prevent it, you have to build systems able to mitigate, offload, block bad actors. This will always be the case.

Any free service that has utility will be quickly scripted against and used to make someone else money. Build accordingly

The site advertises itself as free for all and unlimited usage. To suddenly return malicious responses to intentionally break these apps might very well be illegal in many countries, or maybe would make them liable for damages claims. These clients are not violating any TOS or doing anything not allowed, after all.

> That kind of increase in traffic costs me money I've never had to plan for.

https://getjsonip.com/#plus

  Going further with jsonip Plus
  With the upcoming Plus service, you get special features and 
  even more information about your users.

    - All of the free service features
    - IP geo location - Country and city to within best available accuracy
    - ISP Info
    - Time zone data
    - Full referer data
    - Browser and OS info

https://web.archive.org/web/20200811215649/https://getjsonip...

A paid service has been "upcoming" since at least August 2020, which would subsidize the free tier usage you allow on your site. Aside from the ISP and geo data, everything else is given to you in the request headers or can be determined with the ip address (geo can get tz).

If it's costing you money, shipping the Plus features might offset your out of pocket expenses.

This is a failure of growth/capacity planning and lack of a proper TOS that clarifies "unlimited within reason and at our sole discretion with no SLA or warranty of any kind for non-paying users", as well as failure to ship any monetizing features 3 years after announcing it.

Contacting them to have them stop wouldn't solve your problems. What happens when the next million devices get random updates from literally anybody that starts doing it again? Try to implement rate limiting, optimize your hot code paths, watch out for slow clients (buffered reverse proxies), needless header parsing, slow template rendering, etc. Any language capable of concurrency should be able to handle 100s of thousands of requests on a cheap vm. The client ip is coming to you in the request headers and all you do is print it back to them... A go handler would be a few lines of code to do this and that's including dealing with reverse proxy real-ip type stuff. You don't need to allocate an actual struct and serialize into a json object, just printf a hardcoded string with a replacement for the ip from the header, or better yet benchmark the fastest solution.

I'll do it for you, I'm looking for a job ;)

icanhazip.com had similar issues. Cloudflare took over the project https://major.io/2021/06/06/a-new-future-for-icanhazip/

Fyi, dns can be used to obtain public ip from large companies, without the overhead of tcp and http

dig +short txt ch whoami.cloudflare @1.0.0.1

dig +short txt o-o.myaddr.l.google.com @ns1.google.com

dig +short myip.opendns.com @resolver1.opendns.com

Relevant video from Veritasium on cosmic rays flipping bits and causing chaos

https://www.youtube.com/watch?v=AaZ_RSt0KP8

Tip: `sudo apt-get install ubuntu-desktop` after installing ubuntu server for arm since there is no desktop for arm installable iso (that is obvious from their downloads page)

Sorry to be the one who brings you up to speed, but this is just adding one more option for both the gov and civilians to track people.

https://en.wikipedia.org/wiki/Fog_Reveal

As for randos tracking women, or anyone, this is already happening

https://www.npr.org/2022/02/18/1080944193/apple-airtags-thef...

https://www.komando.com/security-privacy/modified-airtags-us...

and trackers are a dime a dozen it seems, complete with cellular data plans

https://www.amazon.com/s?k=gps+tracker+for+vehicles

Or install an opensource gem[1] that recreates the functionality using the same redis rpoplpush[2] command

[1] https://gitlab.com/gitlab-org/ruby/gems/sidekiq-reliable-fet...

[2] https://redis.io/commands/rpoplpush/#pattern-reliable-queue