Hacker News Reader

Comment by drpixie | Hacker News Reader

1. Don't take it personally. They don't know or care who you are.

2. Some kind of rate limiter is becoming essential for servers. Scanning/probing is worse than rude but there's plenty of obnoxious out there.

Fail2ban can easily be configured to handle simple login or vulnerability scans.

If there's not something similar for web servers, it wouldn't be hard to write one. Anyone know of fail2ban or rate-limiters for webservers?

View on HN

Needs to put Cloudflare (free plan) in front of the website and the problem is fixed

I imagine something can be rigged with fail2ban as well.

The state of the internet is a bit sad if we need to collectively rely on Cloudflare. And we don't even have other free alternatives (that I know of).

Nobody needs to rely on Cloudflare when they can use server-side solutions like Fail2ban (already mentioned). Other tools like iptables exist for more granular control over incoming traffic. There is no one-size-fits-all solution, so just pick the tool(s) that work for your situation. If your situation is so unique that no existing tool will work, you likely have the resources to write your own.

It costs a lot of time and energy, especially for a music artist, for a website that has no private data and that is not sensitive. Cloudflare has specialized people who watch 24/7 and they provide free bandwidth, all of that for 0 USD

I'm not arguing against using Cloudflare. I was responding to the assertion that we "need to collectively rely on Cloudflare" by pointing out that other options exist.

Maybe I’m just a curmudgeonly old fart but I’m so tired of everyone pretending like the entire internet being MiTM’d by Cloudflare is somehow a good thing.

FWIF if you are looking for a decent alternative take a look at ModSecurity project by OWASP.

It’s a good cost vs reward ratio in that specific case. Very little risk if NSA knows your MyNoise history. And for emails and very confidential content they have partnerships with Apple, Google, Meta, etc

Think bigger. Very little risk if the NSA knows your MyNoise history, very great risk if the government knows all of your history.

SSL added and removed here :)

One good sign that your viewpoint may not be well thought through is if you find yourself claiming that any contrary opinions could only be pretense.

Yeah. You’re right. I should have spent the time to write out my thoughts more succinctly. I appreciate your comment. It’s what I really enjoy about discourse on hackernews.

My main problem with it is that we put all websites behind a single point of failure. One with large corporate interests. It is the antithesis of the free and open web.

Also I dislike it from a technical standpoint. It makes response times from the server much worse. And I spend a lot of time improving the performance of my sites, to throw that all away because I’m afraid of hackers seems like the wrong solution to me personally.

He mentions in an earlier blog post [0] that the audio files are behind Cloudflare already so if Cloudflare did its job so I think the actual bandwidth impact on the origin server should have been pretty limited. Hopefully he'd turned on the option to ignore the query string to avoid the cache being bypassed.

I run a similar audio-heavy site [1] that's reached the front page of HN, also behind Cloudflare - the traffic spiking to terabytes a day is a bit of a shock at first but if everything's configured properly CF works well

[0] https://mynoise.net/blog.php#landed

[1] https://ambiph.one

myNoise uses Cloudflare.

> myNoise is now running on a Virtual Private Server (VPS) hosted at One, with audio assets served via a CDN through Cloudflare ...

Reply on news.ycombinator.com