Hacker News Reader

Comment by sbierwagen | Hacker News Reader

Temporarily add 500ms of latency to all ipv6 users, backoff timers for ipv4 addresses. Since there's only 4 billion v4 addresses, it's easy enough to just track them all in a sqlite db.

View on HN

Mostly works, but there do exist a couple of botnets that contain 1 million compromised machines. If each makes one request before hitting backoff, spread evenly throughout the day, that's about 10 QPS alone before they use an IP number twice. But they tend to not actually level out their usage (which is a bummer - if they did they could have kept using it). Instead they hit with a lot of parallel queries all at once.

There's only so much you can really do when your underlying resource is so limited. Luckily the value of the query is lower than the cost of a recaptcha solve, so the attackers moved on to some other target.

Ironically I could now turn off the endpoint protection (or have it responsive to traffic load), until the attackers return. I shall not go into too many details, no need to give people a map.

I don't think that works if your attacker has millions of IPs and is only using 200 per second.

How are they getting millions of ipv4 addresses? IIUC that’s at least the equivalent of a /12 block. Do those shady residential proxies really operate at that scale?

If they’re ipv6 address wouldn’t they be safe to block across large ranges?

My guess through compromised boxes (or some apps) that act as proxies.

It is trivially easy to get millions of IPv6’s, even spread out across a thousand ranges.

It is also trivially “easy” to get past reCAPTCHA, but it costs more. My guess is that a domain name checker tool isn’t worth the cost per request to bypass reCAPTCHA (approximate 0.02 cents per session)

Right, but this is why the GGP's post suggested throttling IPV6. Or at least that was my understanding.

The 500ms latency will help a lot if tons of requests are coming in serial. But most likely they are coming in parallel.

It’s hard to “throttle” a single isolated request from a lone IP.

So.. make the requests serial. Just dump all the requests coming in over IPv6 into a queue, service that queue at a rate that's higher than the non-bot traffic requires but still low enough to be a problem for bots that can't self-limit to a reasonable rate. And of course, manage that queue intelligently so that you start dropping requests before you run out of RAM.

That just sounds like DDoSing yourself? It costs bots almost nothing to wait in the queue, and exactly zero real IPv6 clients will wait 10+ seconds to complete the request.

Reply on news.ycombinator.com