Celebrating Autumn by taking the most generic stock photo that comes to mind, and still being happy about it

Autumn! Golden hours! Only Orange!!!

Re Alpine bug, I am sure this is one of those bugs where you if are in Maryland and if you listen carefully you can hear the TAO people screaming "fuck!"

At the current pace of software buggery, it is looking like one of the best things I did last year was setup a proper server/software/asset inventory system

It has to stated there are so many better things I wish I could be doing with my life and my business, but unfortunately I am basically forced to do a continuous round of fucking fire fighting in order to keep stuff running correctly because people who have no concept of a social contract (instead have replaced it with a race to... something?) are trying to train the next model

(long one, I am sorry)

Reading around the internet I see a lot of people expressing their extreme displeasure at how everything on the internet now seems to show a "verifying your browser" type page, and while this is extremely annoying I assure you from the web sites point of view this is basically existentially required.

Allow me to go into more detail from the point of view of the company that I run, and I'm sure the story is similar in many different places.

On an average day bgp.tools gets about 500~ users or so actively using the website at any given time, and let's assume this results in a request rate of ~10 RPS of dynamic requests (this is not the actual number but it's easier to just provide round benchmark numbers), so basically this excludes CSS/JS/Images/etc.

At the time of writing bgp.tools is "shooting down" about ~40 bot scraper connections _per second_, and the connection attempts the do get through tend to go on to each try and perform ~5 RPS until stopped. To add on top these things continuously do cache misses, which makes sense given at that point is to try and extract as much information from you, for no cost, and as much/fast as possible.

This is very quickly unsustainable.

The problem is that these scrapers are aware that they are unwelcome, and so they will happily do things like: (listed in the order of most commonly done)

A) Use normal browser user agent strings so it's not obvious from basic access.log files

B) Emulate real browser TLS handshakes to evade JA-3 and similar mitigations

C) Use proxies that have lease lines with popular eyeball ISP providers and rented IP space, so that AS blocks do not work

D) Use entire botnets of smart TVs and other compromised devices, mostly sitting behind "normal" networks

E) Use free mobile phone app/games with a "special" SDK as proxies

F) Run entire browser stacks purely to load pages in the most "authentic" way possible

With C+D+E traits combined, IP/Subnet/ASN blocks no longer work, with A+B you cannot easily identify what is what, so this leaves you in a dilemma:

If you run a website which serves information anonymously for free, you have a choice of three options:

1) Put everything behind a log-in barrier (this might destroy your business)

2) Purchase/rent more infrastructure purely for the purpose of serving bots, and at a significant multiplier of your existing infrastructure (this might destroy your business)

3) Use a "verify your browser" step to cut out 90%+ of this mess at the cost of annoying users a bit

(3) is the only really viable option for a lot of people, the pure scale of the scraping problem for some website is just not survivable at most peoples current scales.

I get that modern DDR5 memory controllers need to solve at least 50 electrical engineering sudokus before they can actually use a DIMM, but when you have even a moderately loaded system it takes a whole era to reboot, I fear what DDR6 will look like

# systemd-analyze
Startup finished in 3min 36.134s (firmware) + 7.077s (loader) + 7.043s (kernel) + 7.608s (userspace) = 3min 57.864s 

someone who is good at the economy please help me budget this. my family is dying

"How's the software upgrade cycle going for you at the moment?"

Walked into a coffee place and "iced ube matcha latte" must be close to the final iteration of coffee shop drink evolution

Series of Tubes is absolutely lethal, I don't think I have been "minecraft-ed" that hard in a long time (in that I started at 10AM and suddenly it was 8PM)

If you are wondering how the emsign stuff is going with regards to patching, the bgp.tools banner was getting more than 1RPS+ of successful requests at the start when I deployed it (mostly from Chrome and Chrome forks running on Windows), now it's down to 1 every 10 seconds!

most of those words are not in the bible

I think I've seen my new favorite esoteric exploit construction

The demonstrated packet composition creates a splice-backed UDP skb containing bytes from a file opened read-only, queues the packet to NFQUEUE, taps the resulting netlink skb through a netlink tap and nlmon, rewrites only the linear prefix into a valid authenticated ESP packet using traffic-control pedit, and redirects the packet to loopback. The nonlinear file-backed fragment remains attached. ESP then performs authenticated decryption over the retained page-cache-backed bytes.

Like check it out, it's Tony Hawks Pro Packet Mangler 2

Rube Goldberg Machine of a chain, love it, unhinged

[Stretches]

right, okay, what's next? Maybe OpenSSH could drop some devastating problem as a treat for the end of the week

I just had a scary trip to the local Tesco Express. People glowered at me, muttering "Happy now, PHP developer?". One woman shielded her kids, shrieking "Don't go near the nasty server-side man, kids". And when I got home, someone had posted a ColdFusion manual through my letter box with a message in cut-out newspaper text saying "learn to code, loser".

Need to quickly check your exposure to the compromised CA ? bgp.tools now has a banner that will show if it detects the dire situation.

https://bgp.tools

The real danger is not your browser (who will upgrade quickly), but your VPN Clients, Servers (if you are using badly configured client certs) and software updates that are entirely depending on TLS

RE: https://hachyderm.io/@golang/117470816794707999

Update everything that verifies certificates against public roots.

I find it fascinating that my local (Labour) MP seemingly refuses to display his party on any of his flyers, even going to the point where all of the flyers have a very green colour scheme...

After the whole news of data center sites being valid military targets, my decision this year to colo some stuff in a former nuclear bunker seems less of a whimsical decision and more (unintentionally) prophetic