Slashdot is Port Scanning Its Users | Hacker News Reader

Slashdot is Port Scanning Its Users

soylentnews.org

60 pointsbado43 comments

Open articleView on HN

This tactic has probably blocked a million bot posts over the years, so I guess... Sorry... But not really sorry?

I don't understand all the huff on that forum about this. It pings to see if you have some ports open. So what?

The "huff" is that this forum is the attempted community fork of Slashdot that even less people care about.

That's typically the signature of malware, not a document server.

Exactly my thought. I'm a creature of stubborn habit. I still browse when waiting for things or bored.

I'm just glad to see that a lot of GNAA and other crap has largely stopped.

Still see the Golden Girls spam posts, but, out of all the possible crap you could be clogging the internet up with, the Golden Girls aren't a bad way to go.

I don't mind portscanning per say if its clear you're doing it but a website should never trip a corporate firewall or IDS. We're going to re-rig this code to check the inbound IP against a local DNSBL or something similar and not something that will cause an IDS to shit itself. Generally, if I access a site on a port, I expect return traffic to come back only on that port (excluding protocols like FTP which are explicately multi-port). We officially support tor (and have our own hidden service) and are looking at connecting posts through SpamAssassin to automoderate crap down to -1 (this feature still fairly far out)

What got me upset was the fact that I respect users privacy, and to find out about this behaviour from a bug report notification pissed me off. In /code's defence, at that point, it was basically /., /.JP and Burrapuento as the last three slash sites on the internet so a lot of slashdot specific functionality has creped in over the years before the code drops stopped in 2009, with the documentation for independent sites being a bit stale.

EDIT: I've written a follow up on my SN journal: http://soylentnews.org/~NCommander/journal/277

This is old news. Slashdot even did a story about this long ago. It seems every couple years someone finds this and makes a mountain out of a mole hill. If you're connected to the internet expect all kinds of random packets to be tossed your way.

I'm firmly in the "So what?" camp on this.

IRC servers have been known to do this as well, from time to time, as bot mitigation.

Yup, if anything more web sites should be doing this.

This isn't anything new. Slashdot commenting used to trigger my IDS. This is just an old and unnecessary way of approaching a problem, just like Slashdot itself.

+1 Insightful.

The responses to this issue appear to fall into two groups: The first group doesn't care, and the second group is apoplectic but is unable (or unwilling) to explain why.

The issue is with Slashcode that runs many sites including Slashdot, its birthplace.

Can you name another site that uses Slash?

Soylent News!

Really, Slashcode is just unbelievably horrible. I ran it myself. It's stupidly fragile, you can break it by altering things in the interface and it stores its weblogs in the MySQL database.

I eventually moved everything to WordPress and stopped wanting to STAB MYSELF IN THE FACE REPEATEDLY whenever I wanted to make a post.

Slashcode is not my favourite CMS.

>stores its weblogs in the MySQL database

Can you explain this to me? this seems like exactly what wordpress does..?

I think he meant "a log of accesses to the website" rather than "a blog." Those are often persisted on disk because they tend to get rather voluminous and the questions one wants to ask of them rarely benefit from SQL.

I mean the Apache log!

Maybe it doesn't do that any more. BUT SOMEONE EVER THOUGHT THIS WAS A GOOD IDEA.

backslash (the admin interface) is fragile, during beta testing, we got the site stuck in an infinite loop because the UI for topic creation is not the greatest. I'm not sure I get the 'stores weblogs in mysql' bit as wordpress by default does the same thing.

We've been discussing migrating over to PostgreSQL and rearchitecting the database to run on stored proceedures and views; almost all the DB calls are already abstracted in MySQL.pm, so this is relatively straight forward (if a bit tedious).

It;s 404 at the moment, looks like for awhile as there is no goog result nor subsequent cache to view... http://slashcode.com/www.slashcode.com/sites.shtml

I believe the other site(s) would include the ruinator's other Taco acquisitions Sourceforge & Freecode. I could be wrong and often am.

Slashdot.JP (which is owned by ODSJ), and BurraPuento. At the time this code was added to the repo, macslash was also up.

Why?

That question was asked now ~10 years back. The answer was: to check if the submitter is using an random open proxy server from the net to bypass their IP filter.

From the code

    # If we don't have an IP address, it can't be an open proxy.

And scanning commonly known proxy server ports.

    my $ports = $constants->{comments_portscan_ports} || '80 8080 8000 3128';

Actually, the "don't have IP address" is a sanity check if this code fired from slashd; if someone coming in from the web interface, the GATEWAY_INTERFACE var is always set by mod_perl.

Yeah, I remember reading the same discussion in Slashdot ten or more years go. I also had the reason in the back of my head, thanks for reminding me :). This is nothing new, really. I hope we don't get a submission about how some contemporary CD's from Sony have a rootkit...

I thought this was well known, and I think it only happens when someone tries to submit a comment, so the title is slightly misleading. There is a perceptible delay while trying to submit after a day or so, but it seems to cache the result so it's faster if you comment again within the interval.

I've never understood why port-scanning upset people anyway. Could someone please explain that to me?

It's like somebody walking around your house and checking to see if all the doors and windows are locked.

"Goober with firewall".

Some users get a windows software firewall product. Those products have to persuade users that the money was well spent, so they log everything and sometimes alert too much. "WE PROTECTED YOU FROM 9,042 HOSTILE ATTEMPTS" sounds better than "it's just Internet noise. Ignore it."

I'm not sure what Slashdot actually is anymore. The titles of the entries appear interesting at first, but when you read the associated articles, any substantive content seems to vanish into thin air.

I'm still interested, it's just not that interesting.

And this is different from much of the socially viral Web how?

I agree that Slashdot's lost its way and cachet, but substance is hardly prominent across much of the Internet today.

Agreed; nowadays anywhere you go, there's some snarky dude saying 'hardly'.

According to their (IIRC) tag line, it is/was "news for nerds, stuff that matters." Basically, HN for the late 90s, but with better features.

The draw of /. used to be its comments. Nowhere else could you get such informative discussions. often with the people involved in the story. The rating-of-comments concept has been copied by many other sites, but few of them have a user reputation system and fewer get it right. This is why I pretty much copied /. for my own site.

Computers all over the world port-scan me all day every day, looking for attack vectors. Not sure it's a issue worth committing Seppuku over.

Stages of Open Source:

Run opensource so you can pour through the code and trust that it is secure by finding the issues in the code.

Benefit from the masses of users also pouring through the code to make sure it is safe.

Gain critical mass such that no security flaw goes undiscovered.

Grow complacent and assume all the other users are checking so you don't have.

Gain a large enough install base that malicious contributors add back doors and other nastiness to the code base.

Have a bad thing happen.

Snap out of complacency and start taking security seriously again.

The process you're describing bears no relation whatsoever to the origin of this code. It was written by Slashdot employees to solve a real operational problem on Slashdot; see above for a comment from the man himself.

And the masses should have said "that's a bad idea", but they didn't because they grew complacent.

Yes. This is known. It is to stop spam bots and to detect whether you are a regular user and not a VPS.

Both of them are outraged.

I stopped clicking slashdot last year, whatever change they made on the mobile template I ended up with a blank page 4 times out of 5. I got over it. Moved on.

Slashdot beta, a new redesign, is causing quite a stir these days amongst the vocal majority.

Big deal, the internet is made for devices to connect to each other. So what if they are trying to connect?

Tell me when they attempt a DOS or send funky packets.

So, I don't get what the fuss is about. It port scans users, and does nothing interesting with it.

But on the other hand, we're talking about Slashdot. I've forgotten it exists. Maybe that was the purpose of all the hot air.

Reply on news.ycombinator.com