vallismortis

I can't stop thinking about that Lyre bird. I was wondering if it could be trained to establish a modem connection and transfer a file. What would its baud rate be?

That is a fair point. It used to be that way, but around 2016 we started noticing bots and scrapers that use that use full webkit implementations to run JavaScript. Those clients should be triggering Google Analytics just like a desktop browser, but it was difficult to make the correlation due to information hiding in the GA dashboard (tuple of IP address, timestamp, resource would be needed, but they do not provide that, so it was impossible to test).

Holy cow, that was fascinating and disturbing - I wonder how much more that bird is capable of, it reminds me of Whistler from Sneakers.

I think the species that was imitating the cell phone was a rose-breasted grosbeak, and it wasn't nearly as perfect as that Lyre, but close enough to be recognizable.

I never said they were on my network.

When I see patterns in traffic coming from 45,000 one-off hosts for a month straight it is clear that there is a distributed botnet behind the requests.

When I see a vulnerability scan from an Azure cloud instance seconds after I ban a block of Russian addresses, I can be sure there is coordination.

And don't get me started on the Moldavian Registration Bots. Those are a combination of automated and human-assisted CAPTCHA solvers, and it took me almost a full week of careful observation to weed them out.

These are some of the things my application firewall can detect automatically. Every now and then I see a new pattern, that is all I was trying to say.

Right, you got it. Sometimes I feel like we're being attacked by bespoke systems, but it really must be off-the-shelf stuff since our full content is easily licensable. We shouldn't be worth the trouble.

We just weren't getting enough information from Bing or Google Analytics or CloudFlare, and when I developed a realtime activity dashboard, patterns started emerging: distributed web scrapers, registration bots, vulnerability scans, and some of these in tandem (i.e., scans commencing immediately after blocking a block of addresses). And many of these are coming from cloud hosts, Azure being the worst, with Google a close second. This is the type of traffic they don't want you to see, so those respective analytics services just supress it because it would be a negative advertisement if we could actually see what is happening realtime. I compared the numbers - Google was consistently underreporting our traffic by at least 40%, and a lot (not the majority, but enough to be noticible) of that traffic was coming their own hosted servers (not the indexing bots, but the user cloud instances).

CloudFlare implements temporary bans but I needed something permanent for those threats that were recognizable based on their request patterns.

The ARIN squatting is the latest thing I'm seeing - a lot of requests coming from netblocks that are former DoD and RedHat addresses. The publicly available ARIN databases aren't entirely up-to-date and the bad guys know it, some of the checks we depend on have to be taken with a grain of salt.

So far, I've been able to develop business rules to separate out the human activity from the carefully constructed scraper/probe attempts, but I fear that if they get just a bit more sophisticated I may lose that ability.

I knew this would be coming eventually, I just expected it 10 years ago, not now. The one non-subscription device I own finally goes subscription.

They are so late to the game. Just yesterday there were articles here about subscription fatigue. After GoT ended, I dumped everything except a minimal Hulu subscription, and I'm starting to wonder why I'm keeping that around.

I have a lot of questions about this, including how they plan to sell me on their subscription model, which will clearly compete with the backlog of shows and movies that were already bought on iTunes at a price they were notorious for commodotizing, in addition to the other streaming services that they offer over their own hardware (Hulu, Netflix, HBO, CBS), all of which have their own content monopolies. The one thing that might do it for me is if they managed to get a monopoly on BigTen Network, that would get them a dedicated customer for 6 or 7 months out of the year, depending on how the season goes.

I've been seeing some traffic like this recently as well. We've been getting a lot of traffic this year from addresses that were marked as DoD and Redhat as recently as 1 year ago. It is like a new form of domain name squatting, but using stale ARIN records instead of DNS. Of course, neither CloudFlare nor Google Analytics alerts anyone to this problem, and they just let it pass as if it is normal traffic. I only discovered this after having to ditch Google Analytics and develop an application level firewall to satisfy GDPR requirements.

It is about time they started calling out state actors. It doesn't even matter if they are taking active countermeasures as long as the public is made aware that this kind of thing is happening. It might be more effective if instead of shutting them down, they add a descriptive warning at the top of the post that states, "this message contains misinformation that is being deliberately disseminated by the government of China", along with a link to a relevant writeup of the issue. If they are going to point the finger, then they should point it at the instigator, not an "anonymous state actor". Finish growing a backbone, Twitter.

Great question. I've been dealing with APTs from Russia (and to a lesser extent China) for two years now, and there is nobody out there to help independent sites.

GDPR recently drove us to build our own application level firewall from scratch, which turned up behavior that is never reported by CloudFront or Google Analytics - those services are only hiding the severity of the problem.

I asked a question about this exact topic on Information Security over 4 years ago, which received very little attention but the one answer it received came to the same general conclusion (possibility of protocol differences):

https://security.stackexchange.com/q/91717/78662

However, if these are hosted on the same server, there is a long-standing bug in Apache that forces the same protocol and cipher suite for all virtual hosts:

https://serverfault.com/a/698478/293818

Anecdotally, I swear that in the late 90's one of the bird species in Michigan switched over to the Nokia ring tone.

Actually, it was brilliant because it pointed out how flawed the system is, that it can be passively broken or circumvented. This could be used to invalidate all citations that were issued from agencies using that software.

Sarnia, Ontario has an entry labeled "Dumpster (edible)". It sounds like something you'd encounter in Nethack.

That would put patents solely into the hands of already-established corporations and the already-wealthy, making them inaccessible to anyone else.

Thank you for citing the rules. Most of the comments here are based on assumptions.

Look in Public Pair for the Office Actions. The 101 will usually be the first objection raised if it applied. There are many ways to overcome these, even in a Final Rejection, by narrowing the claims or revising the specification (however, the latter resets the priority date).

Not such a bad thing. Each rejection results in a narrowing of the scope and claims of the patent. The resulting claims that are granted will be far narrower than scope of the original specification.