Hacker News Reader

Comment by KRAKRISMOTT | Hacker News Reader

A million password resets is shockingly low for a DDOS, could this have been an university assignment gone wrong? I can imagine some clueless dean ordering all their engineering grads to submit research to arXiv. If they have 100-200K students, a single poorly written script to link the institution's SSO with automatically created arXiv accounts could easily overwhelm the system.

View on HN

What school has 200k engineering students?

"poorly written" could easily remove the "engineering" qualifier.

They would also have to be in the same class and all running their code at the same time.

It was from about 10 accounts. Which we suspended. But it appears that they created new accounts overnight (daytime in China). arXiv is not well-equipped to play whack-a-mole.

And 10 accounts using 100 different IP addresses, would seem unlikely for an innocent project. And creating new accounts ...

Can you set a restriction so that each user cannot change the email if it has already been changed during the last hour/day? In this way you won't need to ban IPs while still allowing legitimate users to change their emails or to create new accounts.

Indira Gandhi National Open University has over 4 million students, and in China about 40% of university students are in STEM. It's certainly not impossible that this is coming from a single institution.

The question to ask yourself is: After seeing the service clearly degrade, why wouldn't you stop?

Also there may be a good reason why arXiv call it a DDoS attack - they can probably see the same emails being flipped multiple times, which would not be inline with an accidental script issue.

Reply on news.ycombinator.com