Skip Navigation
InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)DI
DigitalDilemma @ digdilem @lemmy.ml
Posts 2
Comments 348
Duck typing
  • Maintaining perl scripts from the 90s is my ball park!

    Mind, I did write some of them, and they're still whirring away making it a pretty easy job. Perl's lack of breaking features is its strongest strength.

  • What do you think got way too much hate than it should've?
  • I found it quite preachy, but still watchable if you don't think about it too hard.

    "Oil = bad". "Smokers = bad". Hopper aside, the bad guys were as shallow as you can get in character development.

    Plus at 2h15m it was about 45 minutes longer than it should have been, and Kevin Costner is a polarising actor for some due to his lack of charisma.

    All that said, I watched it twice. Once partly to admire Jeanne Tripplehorn's dress, which should have got a best supporting role.

  • Volkswagen stands by German factory closure plan
  • Don't forget the diesel cheat devices designed by VAG to pass emissions only during testing.

    That decimated the diesel car industry for all manufacturers and caused a lot of people to pay a lot more "environmental" taxes for their diesel cars ever since, despite governments encouraging ownership of Diesels in the 90s and Naughties because of their greater economy.

  • Trump Is Running His Transition Team on Secret Money
  • “When the money isn’t disclosed, it’s not clear how much everybody is giving, who is giving it and what they are getting in return for their donations,”

    When you give money with expectation of something in return, it's not a donation. Isn't it time we started calling it what it is?

  • Enslaved on OnlyFans: Women describe lives of isolation, torment and sexual servitude
  • Fun fact: the majority of people trafficked in the world are for sex purposes

    What's the source for this, please?

    My own research points to the fairly reputable https://www.antislavery.org/slavery-today/modern-slavery/ which estimated around 28m in modern slavery (on the low side of other estimates), and of those, 6.3m are in commercial sexual exploitation, less than a quarter.

    I get that you’re trying to bring awareness or whatever

    I absolutely am trying to do that - it seems to be ignored by almost everyone, something that I personally find shocking. Even when raising the figures here - usually a place full of people with more empathy than most social media, the response has been partly negative. Maybe because people don't seem to want to acknowledge the bigger problem. I don't get it. Perhaps the numbers are so huge it's hard to appreciate that each one of these is a human being who's trapped, alone and suffering.

    but both comments so far read more like “not worth legalizing sex work when other slaves still exist”

    That wasn't the intention.

  • Enslaved on OnlyFans: Women describe lives of isolation, torment and sexual servitude
  • It can help, yes - but a large percentage of the 38 to 49 million modern day slaves still exist in otherwise fully legal businesses.

    Awareness of slavery is still really low amongst many people. It's going on everywhere, not just in the sex business and is very difficult to stop.

  • Those outside of the US, what's the big news going on in your country currently?
  • UK:

    • Snowing in some parts of the country. First time this year. Historically we lose our shit when it snows. (England and Wales at least, Scotland are pretty good at dealing with it)
    • Farmers upset at a recent budget where they get taxed on death duties above £1m if they didn't transfer property to their kids early enough. (The French farmers are also protesting, but for different reasons)
    • Quite a few small businesses going bankrupt because of the same budget. (Especially motorbike retailers who've suffered some other problems)
    • Ukraine fired a UK-supplied missile into Russia. We're kinda worried about repercussions, but why did we give it to the them if it wasn't meant to be used?
    • Sex allegations about Al Fayed, the now deceased boss of Harrods. "As bad as Savile"

    Pretty much a normal Wednesday.

  • How are people so chill about co-workers stealing food?
  • Be wary of such proof.

    As a young kid in the 80s, I went to stay for three days at an adventure centre. One barn was converted to house bunk beds and there were about 20 kids of about 11 years old. Everyone else was there for a week and I joined midway, and found it difficult to integrate.

    One kid, the only one who had shown me any welcome, had his woolly hat stolen. Another kid suggested searching everyone's bags for it. There was general resistance, most kids thought he'd lost it somewhere and that never happened.

    When I got home the following day and unpacked, I found the hat in my bag. Someone had planted it there, probably the kid who suggested searching bags. Taught me a lot about people, that did.

  • How are people so chill about co-workers stealing food?
  • I agree. It's theft.

    HR should absolutely get involved because it's going to really affect the working environment. And if you're hungry as a result, you're really not going to be doing your best work.

  • Let's Encrypt is 10 years old today !
  • It won't be that simple.

    For starters, you're assuming t-zero response. It'll likely be a week before people worry enough that LE isn't returning before they act. Then they have to find someone else for, possibly, the hundreds or thousands of certs they are responsible for. Set up processes with them. Hope that this new provide is able to cope with the massive, MASSIVE surge in demand without falling over themselves.

    And that's assuming your company knows all its certs. That they haven't changed staff and lost knowledge, or outsourced IT (in which case they provider is likely staggering under the weight of all their clients demanding instant attention) and all that goes with that. Automation is actually bad in this situation because people tend to forget how stuff was done until it breaks. It's very likely that many certs will simply expire because they were forgotten about and the first thing some companies knows is when customers start complaining.

    LetsEncrypt is genuinely brilliant, but we've all added a massive single point of failure into our systems by adopting it.

    (Yeah, I've written a few disaster plans in my time. Why do you ask?)

  • Skara Brae Buddo - 5,000 year old figurine. Buddo means "Friend"

    On display at the Stromness museum. Carved from whalebone and believed to be a child's doll.

    Was discovered at the famous Skara Brae site, and then spent years forgotten in a box at the museum before being rediscovered.

    https://www.bbc.co.uk/news/uk-scotland-north-east-orkney-shetland-36526874

    6

    Stopping a badly behaved bot the wrong way.

    I host a few small low-traffic websites for local interests. I do this for free - and some of them are for a friend who died last year but didn't want all his work to vanish. They don't get so many views, so I was surprised when I happened to glance at munin and saw my bandwidth usage had gone up a lot.

    I spent a couple of hours working to solve this and did everything wrong. But it was a useful learning experience and I thought it might be worth sharing in case anyone else encounters similar.

    My setup is:

    Cloudflare DNS -> Cloudflare Tunnel (Because my residential isp uses CGNAT) -> Haproxy (I like Haproxy and amongst other things, alerts me when a site is down) -> Separate Docker containers for each website. On a Debian server living in my garage.

    From Haproxy's stats page, I was able to see which website was gathering attention. It's one running PhpBB for a little forum. Tailing apache's logs in that container quickly identified the pattern and made it easy to see what was happening.

    It was seeing a lot of 404 errors for URLs all coming from the same user-agent "claudebot". I know what you're thinking - it's an exploit scanning bot, but a closer look showed it was trying to fetch normal forum posts, some which had been deleted months previously, and also robots.txt. That site doesn't have a robots.txt so that was failing. What was weird is that the it was requesting at a rate of up to 20 urls a second, from multiple AWS IPs - and every other request was for robots.txt. You'd think it would take the hint after a million times of asking.

    Googling that UA turns up that other PhpBB users have encountered this quite recently - it seems to be fascinated by web forums and absolutely hammers them with the same behaviour I found.

    So - clearly a broken and stupid bot, right? Rather than being specifically malicious. I think so, but I host these sites on a rural consumer line and it was affecting both system load and bandwidth.

    What I did wrong:

    1. In docker, I tried quite a few things to block the user agent, the country (US based AWS, and this is a UK regional site), various IPs. It took me far too long to realise why my changes to .htaccess were failing - the phpbb docker image I use mounts the root directory to the website internally, ignoring my mounted vol. (My own fault, it was too long since I set it up to remember only certain sub-dirs were mounted in)

    2. Figuring that out, I shelled into the container and edited that .htaccess, but wouldn't have survived restarting/rebuilding the container so wasn't a real solution.

    Whilst I was in there, I created a robots.txt file. Not surprisingly, claudebot doesn't actually honour whats in there, and still continues to request it ten times a second.

    1. Thinking there must be another way, I switched to Haproxy. This was much easier - the documentation is very good. And it actually worked - blocking by Useragent (and yep, I'm lucky this wasn't changing) worked perfectly.

    I then had to leave for a while and the graphs show it's working. (Yellow above the line is requests coming into haproxy, below the line are responses).

    !

    Great - except I'm still seeing half of the traffic, and that's affecting my latency. (Some of you might doubt this, and I can tell you that you're spoiled by an excess of bandwidth...)

    1. That's when the penny dropped and the obvious occured. I use cloudflare, so use their firewall, right? No excuses - I should have gone there first. In fact, I did, but I got distracted by the many options and focused on their bot fighting tools, which didn't work for me. (This bot is somehow getting through the captcha challenge even when bot fight mode is enabled)

    But, their firewall has an option for user agent. The actual fix was simply to add this in WAF for that domain.

    !

    And voila - no more traffic through the tunnel for this very rude and stupid bot.

    After 24 hours, Cloudflare has blocked almost a quarter of a million requests by claudebot to my little phpbb forum which barely gets a single post every three months.

    !

    Moral for myself: Stand back and think for a minute before rushing in and trying to fix something in the wrong way. I've also taken this as an opportunity to improve haproxy's rate limiting internally. Like most website hosts, most of my traffic is outbound, and slowing things down when it gets busy really does help.

    This obviously isn't a perfect solution - all claudebot has to do is change its UA, and by coming from AWS it's pretty hard to block otherwise. One hopes it isn't truly malicious. It would be quite a lot more work to integrate Fail2ban for more bots, but it might yet come to that.

    Also, if you write any kind of web bot, please consider that not everyone who hosts a website has a lot of bandwidth, and at least have enough pride to write software good enough to not keep doing the same thing every second. And, y'know, keep an eye on what your stuff is doing out on the internet - not least for your own benefit. Hopefully AWS really shaft claudebot's owners with some big bandwidth charges...

    EDIT: It came back the next day with a new UA, and an email address linking it to anthropic.com - the Claude3 AI bot, so it looks like a particularly badly written scraper for AI learning.

    31