• 0 Posts
  • 27 Comments
Joined 1 year ago
cake
Cake day: November 23rd, 2024

help-circle




  • The code forge is gitea/forgejo, and the proxy in front used to be traefik. I tried fail2ban in front for a while as well but the issue was that everything appeared to come from different IPs.

    The bots were also hitting my other public services pretty hard but nowhere near as bad. I think it’s a combination of 2 things:

    • most things I host publicly beside git are smaller or static pages, so quickly served and not draining resources as much
    • they try to hit all ‘exit nodes’ (i.e. links) off a page, and on repos with a couple hundred+ commits, with all the individual commits and diffs that are possible to hit that’s a lot.

    A small interesting observation I made was that they also seemed to ‘focus’ on specific projects. So my guess would be you get unlucky once by having a large-ish repo targeted for crawling and then they just get stuck in there and get lost in the maze of possible pages. On the other hand it may make targeted blocking for certain routes more feasible…

    I think there’s a lot to be gained here by everybody pooling their knowledge, but on the other hand it’s also an annoying topic and most selfhosting (including mine) is afaik done as a hobby, so most peeps will slap an Anubis-like PoW in front and call it a day.


  • I’m providing hosting for a few FOSS services, relatively small scale, for around 7 years now and always thought the same for most of that time. People were complaining about their servers being hit but my traffic was alright and the server seemed bulky enough to have a lot of buffer.

    Then, like a month or two ago, the fire nation attacked the bots came crawling. I had sudden traffic spikes of up to 1000x, memory was hogged and the CPU could barely keep up. The worst was the git forge, public repos with bots just continuously hammering away at diffs between random commits, repeatedly building out history graphs for different branches and so on - all fairly intense operations.

    After the server went to its knees multiple times over a couple days I had to block public access. Only with proof of work in front could I finally open it again without destroying service uptime. And even weeks later, they were still trying to get at different project diffs whose links they collected earlier, it was honestly crazy.



  • hoppolito@mander.xyztolinuxmemes@lemmy.worldGUIs
    link
    fedilink
    English
    arrow-up
    3
    ·
    6 days ago

    hater!

    (but for real, I love a well-done TUI. Scriptability of CLIs is nice but sometimes the in-between of a good interface while remaining embedded in the shell works so well. Something like vifm allows me to zoom around with fzf, select things by regex or rename with vidir, move and package with rsync or tar, all without ever leaving my terminal context)






  • Comprehensive reviews of body cam usage already put into question the overall efficacy of body cameras (https://doi.org/10.1111/1745-9133.12412 is the one I see cited most often, not sure if there are newer systematic reviews).

    And that one also comes to the conclusion, especially regarding effects on use-of-force:

    Ariel et al. (2016a) recently provided one nuanced explanation to these mixed findings. They discovered that when officers have more discretion in turning on their cameras, they tend to exhibit greater uses of force than officers who have less discretion regarding their BWCs [Body-worn Cameras]. In most of the use-of-force studies reviewed earlier, researchers did not track activation and therefore it was not clear to what extent Ariel et al.’s nuance is salient. If activation is related to use of force in these ways, however, consistently training, reinforcing, and supervising the implementation of mandatory policies may be needed to secure a positive effect of BWCs on reported uses of force

    That, combined with the seemingly more gung-ho internal processes in DHS/ICE, also leads me to believe in few positive outcomes here – especially with the ‘editorial monopoly’ in institutional hands.


  • Though I personally have the feeling in exactly the opposite way, having used unix-likes for most of my adult life, I won’t argue with you on the principle of the idea (for obtuse syntax e.g. dd the disk destroyer or the infamous tar command come to mind).

    At the same time… I really don’t think you chose your examples super well here.

    cp and it’s mv companion don’t seem more ‘obtuse’ than copy written out in your example.

    ls following the same two-letter logic for ‘list’ also does not seem out-of-this-world crazy syntax. In fact, I always wondered more about dir to list things, especially in a world where the things it lists are technically called folders not directories.

    This same logic once again extends to lsblk to ‘list’ what? ‘block devices’ which describes all sorts of storage media in unix-land. Sure, it’s different, but in these specific examples I definitely don’t see an objective better/worse option. I mean, similar examples for obtuseness could be made e.g. for why the primary drive starts with a C: on windows, or why we have magical drive letters at the beginning at all if you come from the opposite paradigm.

    And lastly your disk example is equally written as fdisk --list which once again just describes its own operation.

    Dunno, I think both systems have their idiosyncrasies which you just find weird if you’re used to the other.


  • I am fairly sure this is the actual point of the campaign. The selection bias for a ‘poll’ like this (one that instantly on-boards you to the ai-disabled version of your product if you click answer negative, no less) is so great that I don’t believe the suits/analysts at ddg ever envisioned a different result. Polls and comment sections lure the extreme viewpoints and the ddg crowd already skews privacy-conscious so this was a highly expected outcome.

    What the campaign does instead is:

    1. Show that you ‘care’ and ‘listen to feedback’ (by a response to the poll somewhere between disabling the ai by default to making the no-ai button a little bit bigger)
    2. show that you have the ability to turn off ai on your product in the first place to those who care
    3. like I said above, directly onboard people onto their preferred search strategy so that when relatives/friends send this around people get a little taste, and realize this exists

    It’s quite clever imo, and there’s no real bad outcome for what I assume is a pretty inexpensive campaign.






  • It’s an interesting concept that I also started exploring last year, though somewhat less extreme.

    My deployments run on incus containers/VMs which are spun up by terraform. Those may in turn host things e.g. through docker or just bare-metal.

    But instead of going full packer-golden image, my principle orchestration is still done by Ansible which prepares the bare-metal host, gets incus rolling, and then starts the terraform process, before taking control again and operating on the now spun-up individual machines.