Hydra page replaced with 1984/Big Brother quotes?

Help
1

Why does the page Perhaps thirty people personally known to Win- ston, was another copy of a. (https://hydra.nixos.org/build/338654792) contain this? Is the infra OK?

1000019097
10000190972560Ă—1446 339 KB

1 Like
2

afaik, this bogus page is returned if your ip address is somehow flagged as suspicious.

using a vpn would mitigate this, as it would in my case.

2 Likes
3

Crazy stuff. Looks like they’re checking useragent too, only some browsers have this issue. Perfect timing to move onto more trustworthy infra :eyes:

3 Likes
4

i’m curious which browser you have used without this issue, cause i have faced it on both laptop (firefox nightly, floorp, ungoogled chromium) and android (firefox nightly as well)

5

It’s iocaine y’all; you can see the config here.

14 Likes
6

What’s your agent? We can tweak the settings.

1 Like
7

soma? Wtf. That’s Brave New World. do y’all even read?! Had me reaching for my 1984 Signet Classic.

8

Medicare beneficiaries (aka USERS) thank you

9

my browser agents are just default values, e.g. on firefox nightly it is Mozilla/5.0 (X11; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0, while it’s Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 on ungoogled chromium.

however, i do see my isp in the unwanted-asns blacklist of iocaine, so i don’t think the user agent is the problem in my case

3 Likes
10

It does seem kinda rude to block entire ISPs from vietnam. Is something like anubis insuficient?

5 Likes
11

Imperfect though all of these solutions are, I am so glad we’re using iocaine instead of that other thing. Thank you for switching, infra team!

3 Likes
12

After checking further, I can’t even really argue. I guess this is how I found out that one browser on one of my systems is outdated… let’s keep the UA list as is.

2 Likes
13

We see disproportionate amounts of abusive requests from the two Vietnam ASNs. They are very likely due to residential proxies, which we cannot match any other way. They were not picked for being in Vietnam but instead for their high request rate distributed over a large set of IP addresses within an ASN, mostly with just a single request per IP address. It’s death by a million cuts for the web frontend and the database.

This is the script we use to evaluate nginx access logs with help from a prefix → asn map from bgp.tools.

#!/usr/bin/env nix-shell
#!nix-shell -i python3 -p "python3.withPackages (ps: with ps; [ pytricia ])"
import argparse
import pytricia
import sys
from collections import defaultdict
from itertools import islice

TOP_N = 50

# Load prefixes into a PyTricia trie
def load_prefixes(filename):
    trie = pytricia.PyTricia(128)  # Support both IPv4 and IPv6
    with open(filename) as fd:
        for line in fd:
            line = line.strip()
            if not line or line.startswith('#'):
                continue
            prefix, asnum = line.split()
            trie[prefix] = asnum
    return trie

# Find ASN for a single IP
def find_as(ip, trie):
    try:
        return trie.get(ip, "Unknown")
    except ValueError:
        # Invalid IP
        return "Unknown"

def main():
    argparser = argparse.ArgumentParser()
    argparser.add_argument("access_log")
    args = argparser.parse_args()

    prefix_file = "/var/lib/nft-prefix-import/table.txt"
    access_log = args.access_log

    if not access_log:
        sys.exit(1)

    prefix_trie = load_prefixes(prefix_file)

    ip_counts = defaultdict(int)
    asn_counts = defaultdict(int)
    asn_ips = defaultdict(set) 

    # parse access log for source ips
    with open(access_log) as fd:
        for line in fd:
            line = line.strip()
            if not line:
                continue
            ip = line.split()[0]
            ip_counts[ip] += 1
            asnum = find_as(ip, prefix_trie)
            asn_counts[asnum] += 1
            asn_ips[asnum].add(ip)

    # Print top IPs
    print("Requests per IP:")
    for ip, count in islice(sorted(ip_counts.items(), key=lambda x: x[1], reverse=True), TOP_N):
        print(f"{ip} {count}")

    print("\nRequests per ASN:")
    for asnum, count in islice(sorted(asn_counts.items(), key=lambda x: x[1], reverse=True), TOP_N):
        ip_spread = len(asn_ips[asnum])
        print(f"AS{asnum} {count} ({ip_spread} IPs)")

if __name__ == "__main__":
    main()
7 Likes
14

The idea behind the switch to iocaine is that it supports more options than Anubis while not annoying regular users with any prompts or waiting pages.

I’m sorry for people being randomly hit by too tight filtering. The internet is frankly going to shit with all these abusive reqeusts.

20 Likes
15

I liked the whimsy of the little animations

3 Likes
16

If you want to add load delays and anime characters to every website you visit, I’m sure you can achieve that with a userscript. I’m fiercely in favor of solutions that don’t impose those things on everyone.

5 Likes
17

Not a big anime guy personally, but would love more whimsy, especially in free software run by volunteers.

Can understand your preference though.

Seems that that part didn’t play into the decision anyway, so it’s moot.

1 Like
18

I’m with you on whimsy; I’d probably feel very differently about this specific tool if I encountered it on one website rather than plastered across 30% (dumb gut statistic not based in facts) of the FLOSS web.

4 Likes
19

You might try adding something like the “Cookie Monster” that iocaine’s author uses on their own personal Forgejo instance. As I understand it, this is specifically geared for distinguish residential-IP bots from humans with minimal cost to the humans (one click-through interstitial).

1 Like
20

Thank you for this.

One one of my machine the Anubis check takes 20 to 30 seconds, and when it was still new, I instaclosed those pages that showed a spurious “1 kH/s” and a progress bar as I thought those were browser miners that beg for crypto-money…

1 Like