The Lockout [3rd UPDATED 2019/11/28 - please read]

By using this website and forum, you agree to the rules herein.

The Lockout [3rd UPDATED 2019/11/28 - please read]

Postby DerGolgo » Fri Nov 08, 2019 7:40 am

What happened: at 2:17 and 2:22 AM on November 8, I received abuse notifications from the hosting company. Both of which notified me that everything had to be turned off because abuse.

I contacted them, and was told what happened.
Someone (or something) pinged the forum database with so may requests, the server couldn't keep up without impeding service to other customers. So we were cut off there.

The only way I could get the forum back online was to promise the customer service guy that I'd immediately take measures to ensure it doesn't happen again.
Since any such measures, and any damage control at all, required I be able to log in, I did promise.

I'm afraid I have no great box of tricks for such a situation.
What I did was to lock out all anonymous guests, and all bots. Either will only get to the login page when they try and access any link on the forum.
If the board doesn't remember you as logged in (if you don't have that cookie), you will only get the login page when you try and access any link on the forum.

For how long will this persist?
I honestly don't know. All I can do at this point is to wait and see if we get cut off again or not. If not, I may reenable access to either group, anonymous guests or bots. I want to wait a few weeks before I'd consider it time to do that, though.


3rd Update 2019/11/28
BOOKMARKS!

Please ensure your bookmarks do not end in ?sid=stuff

The "session ID" is a unique identifier that is automatically generated fresh every time you visit the board. If you have that in your bookmark, and you try visiting that URL, the server will get confused because it didn't issue that session ID to you today.

A good URL for your bookmark should be, for example:
Code: Select all
http://www.utmc-forum.org/pub/index.php


But it worked in the past?
Yeah, maybe.
But in the past, I didn't have to implement tighter security because of brute-force attacks getting us shut down.

Note that, with the new forum software I'm working on setting up, this situation won't change, since I don't expect I will turn off captchas. New software won't stop anyone brute forcing our host into shutting us down.

2nd UPDATE 2019/11/27

Right. The abuse department at the hosting company got back to me.
Ever so conveniently, they can't give me detailed information unless I involve a lawyer to talk to their legal department.

What they could tell me is that the database queries looked like a brute-force attack on the login.
I have therefore restricted the maximum allowed logins attempts further than it had been. I'm sorta skeptical that enough brute force to overwhelm the server could have been applied before, but that's that.

WHAT'S NEW NOW: any given username and any given IP address has only one attempt to log in before the anti-spambot measures are tripped.
WHAT ARE ANTI-SPAMBOT MEASURES: A captcha. I tried installing reCaptcha, but that didn't work as it should, and since I'm already in the process of rebuilding the forum, I won't spend hours and hours trying to make that work. A regular captcha should give us some security. I have tested it, it works as a captcha should.
ONLY ONE ATTEMPT?! Only one attempt without solving a captcha. Many places require captchas for every login, so I don't think it's an excessive restriction.
How quickly must I solve the captcha? You have 10 minutes. I'd rather shorten that, and I might.
What if I can't solve the captcha? You will have to wait 6 hours before you can attempt another login.

A miscreant might yet attempt a brute-force attack, and might again overwhelm the server, even with these measures. But most should be repelled.

UPDATE 2019/11/26:
We got shut down again today, same reason, apparently.
I am trying to get more detailed information from the abuse department. No idea whether any is to be had.
I am presently looking into

a) measures to identify actors and activities that may be causative to the excessive database use that has led our hosting provider to pull the plug, twice.

b) rebuilding the entire website and forum. Not from scratch, I intend to maintain everything, or as much as is possible. Certainly all threads, posts, attachments, gallery images. Fucks given, if I can. Maintaining NotTheFrontPage is not a priority in my eyes. Before making any changes to the forum proper, I will attempt to set up a duplicate on my home computer, on which I can trial all changes.

ANYONE who has recently changed the way in which they use the forum, be it how and when they visit, or a different device or browser, please SPEAK UP.
I will maintain a "no blame culture" here, as they do in commercial aviation. I don't care who you are, or how you're doing whatever. Unless you intended to get us shut down by spamming the database or however, I quite frankly don't give a fuck why you've done it, or whether you've made any dumb mistakes. I just want to keep this place running, smoothly if possible. "Error" is just a different spelling of "fix".
If you prefer handling this on the dl, shoot me an email (if we get shut down again, I won't be able to read a pm). admin at utmc-forum dot org Type it like you'd read it out loud, no spaces. The italic bits are the symbols that go in any email address.

Please do keep in mind that, as the daft bugger whose name is in the contracts, if whatever is going on ends up causing actual damage to anybody or anything outside the scope of the forum, I might end up being liable in a legal and/or financial sense.
If there were absolutely anything to be afraid of, don't you think I would have worn pants?

I said I have a big stick.
User avatar
DerGolgo
Zaphod's Zeitgeist
 
Posts: 12185
Joined: Sun Apr 04, 2004 9:34 am
Location: It's bad enough I gotta live here, don't make me say it, too ...
BANNER!:
Jolly Roger Alternative

Re: The Lockout

Postby Jaeger » Fri Nov 08, 2019 8:02 am

...all that is to say that unless you have a login you can't see/browse the content.

That SUCKS.

--Jaeger
Bigshankhank wrote:The world is a fucking wreck, but there is still sunshine in some places. Go outside and look for it.


<<NEUTIQUAM ERRO>>
2018 Indian Scout
User avatar
Jaeger
Baron von Scrapple
 
Posts: 10050
Joined: Wed Oct 19, 2005 8:24 am
Location: NoVA
BANNER!:
US Virginia

Re: The Lockout

Postby Mk3 » Fri Nov 08, 2019 8:07 am

Damn SinoRussianISIS.

Even sounds like a venereal disease.
"...when someone asks you if you're a god, you say "YES "!

"UTMC, it's an international disorganization of racers, aficionados, mechanics, lunatics, and scumbags. It's like an online motorcycle Mos Eisley."
User avatar
Mk3
Captain Sensible, Space Command.
 
Posts: 897
Joined: Mon Oct 24, 2011 7:02 pm
Location: The people's republic of Illinois Welcome comrade, join the party!
BANNER!:
US Illinois

Re: The Lockout

Postby xtian » Fri Nov 08, 2019 8:37 am

thanks for taking care of this
I'm not really from around here.
User avatar
xtian
Le coureur de lames chasse Tinti...
 
Posts: 4097
Joined: Fri Apr 16, 2004 10:41 pm
Location: belgium

Re: The Lockout

Postby DerGolgo » Fri Nov 08, 2019 9:21 am

Jaeger wrote:...all that is to say that unless you have a login you can't see/browse the content.

That SUCKS.

--Jaeger


Yes it does. And for the time being, what Google, Bing, and whatever haven't yet cached isn't gonna show up among search results.

I took a nap, and upon waking up, realized that I hadn't reset all forum connections.
Hypothetically, or so I feared, whatever piece of fucking malware was used against us here (assuming that malware wasn't me) might come back and, still having some cookie or some URL from deep within the forum, might just go back to whatever it was doing.

Which is why now, everybody who isn't me and reads this had to log in at least once before reading this. Management apologizes for the inconvenience.
If there were absolutely anything to be afraid of, don't you think I would have worn pants?

I said I have a big stick.
User avatar
DerGolgo
Zaphod's Zeitgeist
 
Posts: 12185
Joined: Sun Apr 04, 2004 9:34 am
Location: It's bad enough I gotta live here, don't make me say it, too ...
BANNER!:
Jolly Roger Alternative

Re: The Lockout

Postby jae » Fri Nov 08, 2019 11:09 am

Thanks for all you do to keep this place going!
There, I said it.
http://instagram.com/norrisjc
http://youtube.com/kacivic

Dying old and healthy from boredom is not an achievement.
jae
Magnum Jihad
 
Posts: 546
Joined: Thu Mar 19, 2015 5:12 am
Location: H-town, Tejas
BANNER!:
US Texas

Re: The Lockout

Postby Pintgudge » Fri Nov 08, 2019 4:38 pm

Abuse by anonymous guests and bots?

I am unclear why we want to associate with any such like.

Do they do us any good?

Do we like them?

Please educate me because I really don't know.

I do know however that I am very grateful for the constant efforts and friendship of Herr DerGolgo, without whom we would be well and truly screwed!
If man is fit to be governed, is any man fit to govern?

These are the days of miracles and wonder!

'81 Goldwing Standard w/'61 Ural Sidecar

'06 Bajaj Chetak
User avatar
Pintgudge
The Big Oooola
 
Posts: 1157
Joined: Tue Mar 04, 2008 4:56 pm
Location: Tacoma
BANNER!:
Cascadia

Re: The Lockout

Postby Pintgudge » Sun Nov 10, 2019 8:07 am

Someone or something overtaxed the server by pinging the forum database with too many requests.

I really don't know how all of this works, but I wish you could explain a few things please.

What were the requests? Who made them? If it was a bot, presumably doing some task for some entity, why do we let them have access? do they have any positive outcome for any but themself?

I understand that a guest may want to be anonymous while scoping things out, but there should be a way to look but not touch.

Mainly I wonder what possible good could come from allowing a bot to have access.

If you could tell me about this, I'd be thankful.
If man is fit to be governed, is any man fit to govern?

These are the days of miracles and wonder!

'81 Goldwing Standard w/'61 Ural Sidecar

'06 Bajaj Chetak
User avatar
Pintgudge
The Big Oooola
 
Posts: 1157
Joined: Tue Mar 04, 2008 4:56 pm
Location: Tacoma
BANNER!:
Cascadia

Re: The Lockout

Postby DerGolgo » Sun Nov 10, 2019 4:59 pm

Pintgudge wrote:Someone or something overtaxed the server by pinging the forum database with too many requests.

I really don't know how all of this works, but I wish you could explain a few things please.

What were the requests? Who made them? If it was a bot, presumably doing some task for some entity, why do we let them have access? do they have any positive outcome for any but themself?

I understand that a guest may want to be anonymous while scoping things out, but there should be a way to look but not touch.

Mainly I wonder what possible good could come from allowing a bot to have access.

If you could tell me about this, I'd be thankful.


Okay. Tackling these questions one by one doesn't strike me as too enlightening, while my first attempt at explanation was, well. You know me.

How the website works
The website that your device shows you is just that, a boring little website. A lot of sourcecode that tells your device what image goes here, what background color goes there, etc. Nothing too exciting.

How the forum works
The forum, meanwhile, is a different can of worms. The sourcecode will include little items that aren't static. The "Post a reply" button is the same whether you're in the bike porn ftw thread, or in this here topic, or you're reading up on plans for the next Dooooooom. But the posts, obviously, aren't the same in all those places. That would defeat the purpose of forum.
But because they aren't the same, they can't be stored and handled the same. Can't just have a lot of little files lying around. You can't just store what we post in a big textfile or something.
The only way to do it is basically a gigantic digital spreadsheet, that is the database.
Every piece of information that's not part of the framing or background is in that spreadsheet. It's assigned a line, a column, and multiple further dimensions, tags, and other identifiers. That way, when you want to look at something specific, the server can find and display it in a hurry, rather than having to search through a ginormous texfile or files.
Just loading this topic will have involved several, probably dozens of database requests. What username goes here, what avatar goes there, how many fucks were given about that, and of course, what everyone actually said here.
Looking around the forum is nothing but database requests, with some pretty(ish) graphics to make a nice frame around it all.

What's with the bots
Most bots are benign. When you scroll down the board index page, you will find the list of "who is currently online". At least I see it, and I think you can, too. The most common, by far, are Google [Bot], Majestic-12 [Bot], MSN [Bot]
MSN isn't actually quite so familiar, but Google and Majestic are. The only way someone can find the details of what everyone is thinking about the Hello Kitty Motocross Challenge is that Google sends its bot to scour the place for whatever is new here, to copy it to the Google cache, where it is then indexed for the search. Majestic-12 does pretty much exactly the same thing as the Google bot, but for a proprietary, pay-to-play search engine for businesses to use instead of google. Some people can sell fridges to Eskimos, go figure.
Of course, pretty much anyone can create bots to do pretty much anything, so there's no way to make a blanket dismissal of them as a threat.

Who made all the requests, and what was requested?
I don't know and, to my knowledge, the database isn't really set up to allow such minute monitoring. Recording every request and the origin would probably multiply the scale of the database, geometrically. Like I said, dozens of requests just for this page. Each would need its own little entry in that giant digital spreadsheets. Making those entries expirable, meanwhile, would only mean a lot of extra work for the server to clean everything up.
When I spoke to the customer service guy, I was too focused on getting the board back up to ask for more details, and I don't think he'd have had a lot of them. It's really just as likely that it was their fuckup, and there wasn't really any requestsunami.

Seriously?
Yeah. No way to tell, for me. Perhaps the server was broken and they had to shut it down, but because of some contractual obligation for guaranteed uptime, they had to provide a cover story.
If it wasn't their fuckup, someone else, somewhere, might ha ve made a legit fuckup. A bot might have gotten stuck on reloading the same thread thousands of times because of a misplaced ";". Or a whole different website accidentally redirected its traffic here (though I'd expect I'd have gotten emails in that case, which I didn't).
Or some skript-kiddie tried out "My First DDOS Kit".
I'm fairly confident we can rule out some post here becoming uber-popular on redditt.
Even if all the requests were aimed at our database, there's also the chance that the server just fucked up, redirecting requests aimed at entirely different datbases to ours, this making it look like we were hogging all the bandwidth. Or just reported it incorrectly, was working fine the whole time, and the problem was just in the monitoring software.

Would anyone gain from this business?
Maybe. What appears to be, and is, completely innocuous online whatever, may serve some weird purpose for someone with a very specific agenda.
Just for illustration, remember WannaCry. That ransomware from a few years back that hit the British NHS hard, encrypting data and forcing people to hand over Bitcoin. But some hacker, scrutinizing the source code, found that it would ping a specific domain again and again. He found that the domain in question wasn't even registered. So he registered it.
And suddenly, everyone got their data back, without paying a single satoshi.
Got nothing to do with us. Just illustrating: even if it makes no sense to us. To somebody else, it might.
If there were absolutely anything to be afraid of, don't you think I would have worn pants?

I said I have a big stick.
User avatar
DerGolgo
Zaphod's Zeitgeist
 
Posts: 12185
Joined: Sun Apr 04, 2004 9:34 am
Location: It's bad enough I gotta live here, don't make me say it, too ...
BANNER!:
Jolly Roger Alternative

Re: The Lockout

Postby Pintgudge » Sun Nov 10, 2019 8:11 pm

Thank you.

I know very little about all of this, and now I know a little more.

Thanks for explaining it.
If man is fit to be governed, is any man fit to govern?

These are the days of miracles and wonder!

'81 Goldwing Standard w/'61 Ural Sidecar

'06 Bajaj Chetak
User avatar
Pintgudge
The Big Oooola
 
Posts: 1157
Joined: Tue Mar 04, 2008 4:56 pm
Location: Tacoma
BANNER!:
Cascadia

Re: The Lockout

Postby motorpsycho67 » Fri Nov 15, 2019 8:09 pm

How do the bots and anonymous users benefit us?

I see no reason to entertain them.
'75 Honda CB400F
'82 Kawalski GPz750
etc.
User avatar
motorpsycho67
Double-dip Diogenes
 
Posts: 4643
Joined: Tue Oct 07, 2008 1:24 am
Location: City of Angels

Re: The Lockout

Postby DerGolgo » Sat Nov 16, 2019 11:21 am

motorpsycho67 wrote:How do the bots and anonymous users benefit us?

I see no reason to entertain them.


The bots cache board content for indexing by the Googles, etc.
That's how someone might find a specific post on the board via a Google search. We benefit by being on the Googles, etc. It appears they are still dropping in to look around, but they shouldn't see more than the login page, at present.

Anonymous users is anyone who isn't logged. Anyone who visits the forum, but doesn't fill in the username and password field, nor hits "login" therafter. That might just be someone looking around, or any ootmick who can't be arsed to log in each time they visit.

Curiously, since yesterday, I've received two new registration requests. I think the lockout may be prompting occasional visitors to register.
If there were absolutely anything to be afraid of, don't you think I would have worn pants?

I said I have a big stick.
User avatar
DerGolgo
Zaphod's Zeitgeist
 
Posts: 12185
Joined: Sun Apr 04, 2004 9:34 am
Location: It's bad enough I gotta live here, don't make me say it, too ...
BANNER!:
Jolly Roger Alternative

Re: The Lockout

Postby Bigshankhank » Tue Nov 19, 2019 5:39 am

DerGolgo wrote:
motorpsycho67 wrote:How do the bots and anonymous users benefit us?

I see no reason to entertain them.


The bots cache board content for indexing by the Googles, etc.
That's how someone might find a specific post on the board via a Google search. We benefit by being on the Googles, etc. It appears they are still dropping in to look around, but they shouldn't see more than the login page, at present.

Anonymous users is anyone who isn't logged. Anyone who visits the forum, but doesn't fill in the username and password field, nor hits "login" therafter. That might just be someone looking around, or any ootmick who can't be arsed to log in each time they visit.

Curiously, since yesterday, I've received two new registration requests. I think the lockout may be prompting occasional visitors to register.


Fresh meat for the grinder!
It's time for Humankind to ditch the imaginary friends of our species' childhood and grow the fuck up.
-Davros

"Lasse mich deine Seele dem Herrscher der Finsternis opfern"

Let me sacrifice your soul to the ruler of darkness

Always carry a bottle of whiskey when you travel in case of a snakebite. Futhermore, always carry a small snake.
User avatar
Bigshankhank
Fully Autonomous Cock-Puncher
 
Posts: 7556
Joined: Wed Sep 14, 2005 8:11 am
Location: Deep In The Swamps of South Florida
BANNER!:
US Florida

Re: The Lockout [UPDATED 2019/11/26 - please read]

Postby DerGolgo » Tue Nov 26, 2019 8:45 am

UPDATE 2019/11/26:
We got shut down again today, same reason, apparently.
I am trying to get more detailed information from the abuse department. No idea whether any is to be had.
I am presently looking into

a) measures to identify actors and activities that may be causative to the excessive database use that has led our hosting provider to pull the plug, twice.

b) rebuilding the entire website and forum. Not from scratch, I intend to maintain everything, or as much as is possible. Certainly all threads, posts, attachments, gallery images. Fucks given, if I can. Maintaining NotTheFrontPage is not a priority in my eyes. Before making any changes to the forum proper, I will attempt to set up a duplicate on my home computer, on which I can trial all changes.

ANYONE who has recently changed the way in which they use the forum, be it how and when they visit, or a different device or browser, please SPEAK UP.
I will maintain a "no blame culture" here, as they do in commercial aviation. I don't care who you are, or how you're doing whatever. Unless you intended to get us shut down by spamming the database or however, I quite frankly don't give a fuck why you've done it, or whether you've made any dumb mistakes. I just want to keep this place running, smoothly if possible. "Error" is just a different spelling of "fix".
If you prefer handling this on the dl, shoot me an email (if we get shut down again, I won't be able to read a pm). admin at utmc-forum dot org Type it like you'd read it out loud, no spaces. The italic bits are the symbols that go in any email address.

Please do keep in mind that, as the daft bugger whose name is in the contracts, if whatever is going on ends up causing actual damage to anybody or anything outside the scope of the forum, I might end up being liable in a legal and/or financial sense.
If there were absolutely anything to be afraid of, don't you think I would have worn pants?

I said I have a big stick.
User avatar
DerGolgo
Zaphod's Zeitgeist
 
Posts: 12185
Joined: Sun Apr 04, 2004 9:34 am
Location: It's bad enough I gotta live here, don't make me say it, too ...
BANNER!:
Jolly Roger Alternative

Re: The Lockout [UPDATED 2019/11/26 - please read]

Postby Bigshankhank » Tue Nov 26, 2019 11:19 am

Well fuck a duck, thus far I only view/use the forum on the same three devices, and am not doing anything unseemly in such formats.
It's time for Humankind to ditch the imaginary friends of our species' childhood and grow the fuck up.
-Davros

"Lasse mich deine Seele dem Herrscher der Finsternis opfern"

Let me sacrifice your soul to the ruler of darkness

Always carry a bottle of whiskey when you travel in case of a snakebite. Futhermore, always carry a small snake.
User avatar
Bigshankhank
Fully Autonomous Cock-Puncher
 
Posts: 7556
Joined: Wed Sep 14, 2005 8:11 am
Location: Deep In The Swamps of South Florida
BANNER!:
US Florida

Re: The Lockout [UPDATED 2019/11/26 - please read]

Postby red » Tue Nov 26, 2019 1:16 pm

Bigshankhank wrote:Well fuck a duck, thus far I only view/use the forum on the same three devices, and am not doing anything unseemly in such formats.


I have a three different PCs and two mobile devices that I use.
User avatar
red
Yap. Doomed for all eternity.
 
Posts: 2651
Joined: Sat Nov 20, 2004 1:47 am
Location: Indy
BANNER!:
Jolly Roger

Re: The Lockout [UPDATED 2019/11/26 - please read]

Postby DerGolgo » Tue Nov 26, 2019 4:35 pm

Again, only if you recently adopted something new would this be important.
If there were absolutely anything to be afraid of, don't you think I would have worn pants?

I said I have a big stick.
User avatar
DerGolgo
Zaphod's Zeitgeist
 
Posts: 12185
Joined: Sun Apr 04, 2004 9:34 am
Location: It's bad enough I gotta live here, don't make me say it, too ...
BANNER!:
Jolly Roger Alternative

Re: The Lockout [UPDATED 2019/11/26 - please read]

Postby Pintgudge » Tue Nov 26, 2019 7:50 pm

My i-pad broke and I'm using my sweetie's macbook. I'm pretty sure I've used it before, just not for the past year or so?

Actually, I don't know why the i-pad broke, it started loading slower and slower, and after I re-booted repeatedly, it just failed to re-start so it's in the shop now. He is going to put in a new battery, maybe that was the problem, . . . . but I don't know for sure.
If man is fit to be governed, is any man fit to govern?

These are the days of miracles and wonder!

'81 Goldwing Standard w/'61 Ural Sidecar

'06 Bajaj Chetak
User avatar
Pintgudge
The Big Oooola
 
Posts: 1157
Joined: Tue Mar 04, 2008 4:56 pm
Location: Tacoma
BANNER!:
Cascadia

Re: The Lockout [UPDATED 2019/11/26 - please read]

Postby xtian » Tue Nov 26, 2019 10:42 pm

someone is doing something, don't know who, don't know what. you'll get us all paranoïd. is it me is it me ?
isn't it possible to monitor who/what was online at the time the page went off ?
I'm not really from around here.
User avatar
xtian
Le coureur de lames chasse Tinti...
 
Posts: 4097
Joined: Fri Apr 16, 2004 10:41 pm
Location: belgium

Re: The Lockout [UPDATED 2019/11/26 - please read]

Postby DerGolgo » Wed Nov 27, 2019 3:22 am

xtian wrote:someone is doing something, don't know who, don't know what. you'll get us all paranoïd. is it me is it me ?

Well, I did lock out guest users, and unknown bots. So the list of suspects got narrowed already.
A malfunctioning device or program, or functioning device or program that's doing something the user didn't intend, is a potential candidate.

Again, everyone. Unless it's a recent change, some time not long before November 8, we can rule it out.

xtian wrote:isn't it possible to monitor who/what was online at the time the page went off ?

Tricky. I'm trying to get some info out of the people at the hosting company.

Apart from that, I've once again scoured all the settings, so as to lock out anyone who may have slipped through the first time, and am working on rebuilding the entire forum, to rule out that it's maybe the forum software, in one way or another.
That, as you can imagine, is a fairly big project, though, so not something I'd be able to pull off in just a day or so even if I could hack working a full working day's worth.
If there were absolutely anything to be afraid of, don't you think I would have worn pants?

I said I have a big stick.
User avatar
DerGolgo
Zaphod's Zeitgeist
 
Posts: 12185
Joined: Sun Apr 04, 2004 9:34 am
Location: It's bad enough I gotta live here, don't make me say it, too ...
BANNER!:
Jolly Roger Alternative

Re: The Lockout [UPDATED 2019/11/26 - please read]

Postby Pintgudge » Wed Nov 27, 2019 4:59 am

So, both of my changes happened in that time period including my i-pad malfunctioning and doing stuff I didn't intend.
If man is fit to be governed, is any man fit to govern?

These are the days of miracles and wonder!

'81 Goldwing Standard w/'61 Ural Sidecar

'06 Bajaj Chetak
User avatar
Pintgudge
The Big Oooola
 
Posts: 1157
Joined: Tue Mar 04, 2008 4:56 pm
Location: Tacoma
BANNER!:
Cascadia

Re: The Lockout [2nd UPDATED 2019/11/27 - please read]

Postby DerGolgo » Wed Nov 27, 2019 6:38 am

2nd UPDATE 2019/11/27

Right. The abuse department at the hosting company got back to me.
Ever so conveniently, they can't give me detailed information unless I involve a lawyer to talk to their legal department.

What they could tell me is that the database queries looked like a brute-force attack on the login.
I have therefore restricted the maximum allowed logins attempts further than it had been. I'm sorta skeptical that enough brute force to overwhelm the server could have been applied before, but that's that.

WHAT'S NEW NOW: any given username and any given IP address has only one attempt to log in before the anti-spambot measures are tripped.
WHAT ARE ANTI-SPAMBOT MEASURES: A captcha. I tried installing reCaptcha, but that didn't work as it should, and since I'm already in the process of rebuilding the forum, I won't spend hours and hours trying to make that work. A regular captcha should give us some security. I have tested it, it works as a captcha should.
ONLY ONE ATTEMPT?! Only one attempt without solving a captcha. Many places require captchas for every login, so I don't think it's an excessive restriction.
How quickly must I solve the captcha? You have 10 minutes. I'd rather shorten that, and I might.
What if I can't solve the captcha? You will have to wait 6 hours before you can attempt another login.

A miscreant might yet attempt a brute-force attack, and might again overwhelm the server, even with these measures. But most should be repelled.
If there were absolutely anything to be afraid of, don't you think I would have worn pants?

I said I have a big stick.
User avatar
DerGolgo
Zaphod's Zeitgeist
 
Posts: 12185
Joined: Sun Apr 04, 2004 9:34 am
Location: It's bad enough I gotta live here, don't make me say it, too ...
BANNER!:
Jolly Roger Alternative

Re: The Lockout [UPDATED 2019/11/26 - please read]

Postby DerGolgo » Wed Nov 27, 2019 6:47 am

Pintgudge wrote:So, both of my changes happened in that time period including my i-pad malfunctioning and doing stuff I didn't intend.


Hm. Curious.
The last assault was on November 26, approximately 3:45 AM EST. Were you visiting the board around that time?
Could you describe the malfunction and stuff you didn't intend?
If there were absolutely anything to be afraid of, don't you think I would have worn pants?

I said I have a big stick.
User avatar
DerGolgo
Zaphod's Zeitgeist
 
Posts: 12185
Joined: Sun Apr 04, 2004 9:34 am
Location: It's bad enough I gotta live here, don't make me say it, too ...
BANNER!:
Jolly Roger Alternative

Re: The Lockout [UPDATED 2019/11/26 - please read]

Postby xtian » Wed Nov 27, 2019 9:08 am

DerGolgo wrote:
Apart from that, I've once again scoured all the settings, so as to lock out anyone who may have slipped through the first time, and am working on rebuilding the entire forum, to rule out that it's maybe the forum software, in one way or another.
That, as you can imagine, is a fairly big project, though, so not something I'd be able to pull off in just a day or so even if I could hack working a full working day's worth.


Maybe it's worth considering a board 2.0 and maybe not rebuild everything to what it has been for the last decades (actually yes, I remember visiting this page before 9/11), but give it a new momentum, considering fecesbook sort of killed it. and I don't mean to let you do all the work. just an idea ?
I'm not really from around here.
User avatar
xtian
Le coureur de lames chasse Tinti...
 
Posts: 4097
Joined: Fri Apr 16, 2004 10:41 pm
Location: belgium

Re: The Lockout [2nd UPDATED 2019/11/27 - please read]

Postby Pintgudge » Wed Nov 27, 2019 4:22 pm

Yes, i might have been visiting at that time, I would have been using my sweetie's macbook.
I just got my i-pad back from the shop, it had a bad battery, and it works fine now.
If man is fit to be governed, is any man fit to govern?

These are the days of miracles and wonder!

'81 Goldwing Standard w/'61 Ural Sidecar

'06 Bajaj Chetak
User avatar
Pintgudge
The Big Oooola
 
Posts: 1157
Joined: Tue Mar 04, 2008 4:56 pm
Location: Tacoma
BANNER!:
Cascadia

Re: The Lockout [UPDATED 2019/11/26 - please read]

Postby DerGolgo » Thu Nov 28, 2019 1:56 am

xtian wrote:
DerGolgo wrote:
Apart from that, I've once again scoured all the settings, so as to lock out anyone who may have slipped through the first time, and am working on rebuilding the entire forum, to rule out that it's maybe the forum software, in one way or another.
That, as you can imagine, is a fairly big project, though, so not something I'd be able to pull off in just a day or so even if I could hack working a full working day's worth.


Maybe it's worth considering a board 2.0 and maybe not rebuild everything to what it has been for the last decades (actually yes, I remember visiting this page before 9/11), but give it a new momentum, considering fecesbook sort of killed it. and I don't mean to let you do all the work. just an idea ?


I'm sorry, I should have expressed this more clearly.
I am working on what you suggest. Migrating the forum to a new version of the software. That will have a few new features straight out of the box, will let me implement other features, and should avoid a few problems we've been having (that most of y'all don't even know about).

Unfortunately, I'm still at the stage of making the forum work proper on my home computer, or proper-ish, so that I'll have a sandbox to test everything before going live with it. That will be a few days yet.
If there were absolutely anything to be afraid of, don't you think I would have worn pants?

I said I have a big stick.
User avatar
DerGolgo
Zaphod's Zeitgeist
 
Posts: 12185
Joined: Sun Apr 04, 2004 9:34 am
Location: It's bad enough I gotta live here, don't make me say it, too ...
BANNER!:
Jolly Roger Alternative

Re: The Lockout [2nd UPDATED 2019/11/27 - please read]

Postby DerGolgo » Thu Nov 28, 2019 2:18 am

Pintgudge wrote:Yes, i might have been visiting at that time, I would have been using my sweetie's macbook.
I just got my i-pad back from the shop, it had a bad battery, and it works fine now.


Were you using your sweetie's macbook on November 7th, around 8pm EST? That was when we got shut down the first time, three weeks agon on Thursday.
Not wishing to cast aspersions, do you know whether your sweetie keeps her anti-malware stuff up-to-date and avoids common vectors of infection (unsolicited attachments, etc.)?

I think if your i-pad only needed a new battery, it's probably safe to assume that wasn't it.
However, would you note the time and date, next time you use either your i-pad or your sweetie's macbook to visit? I will continue working on updating everything around here, regardless. But it would be helpful to rule out the applesauce as the culprit.

Just in case, your registered email here is still current?
If there were absolutely anything to be afraid of, don't you think I would have worn pants?

I said I have a big stick.
User avatar
DerGolgo
Zaphod's Zeitgeist
 
Posts: 12185
Joined: Sun Apr 04, 2004 9:34 am
Location: It's bad enough I gotta live here, don't make me say it, too ...
BANNER!:
Jolly Roger Alternative

Re: The Lockout [2nd UPDATED 2019/11/27 - please read]

Postby Pintgudge » Thu Nov 28, 2019 4:29 am

e-mail is current, and on 11/7 I would only have used the i-pad which is now fixed and will be my only vehicle.
She would have avoided infection vectors, and having a mac product, is likely to think that malware is never targeted at mac users. Only those poor microsofters!
If man is fit to be governed, is any man fit to govern?

These are the days of miracles and wonder!

'81 Goldwing Standard w/'61 Ural Sidecar

'06 Bajaj Chetak
User avatar
Pintgudge
The Big Oooola
 
Posts: 1157
Joined: Tue Mar 04, 2008 4:56 pm
Location: Tacoma
BANNER!:
Cascadia

Re: The Lockout [2nd UPDATED 2019/11/27 - please read]

Postby DerGolgo » Thu Nov 28, 2019 10:19 am

Pintgudge wrote:e-mail is current, and on 11/7 I would only have used the i-pad which is now fixed and will be my only vehicle.

Good, that rules that out. I'd actually be more comfortable with a real brute-force attack than with the idea that some popular, yet legit, product will cause trouble.

Pintgudge wrote:She would have avoided infection vectors,

That's always good, but

Pintgudge wrote:and having a mac product, is likely to think that malware is never targeted at mac users. Only those poor microsofters!

that's where I'd advise caution. People who think thus will often not really do the former ("Why be cautious if it doesn't concern me?" is probably among the main reasons for malware success).
If there were absolutely anything to be afraid of, don't you think I would have worn pants?

I said I have a big stick.
User avatar
DerGolgo
Zaphod's Zeitgeist
 
Posts: 12185
Joined: Sun Apr 04, 2004 9:34 am
Location: It's bad enough I gotta live here, don't make me say it, too ...
BANNER!:
Jolly Roger Alternative

Re: The Lockout [3rd UPDATED 2019/11/28 - please read]

Postby DerGolgo » Thu Nov 28, 2019 11:31 am

3rd Update 2019/11/28
BOOKMARKS!

Please ensure your bookmarks do not end in ?sid=stuff

The "session ID" is a unique identifier that is automatically generated fresh every time you visit the board. If you have that in your bookmark, and you try visiting that URL, the server will get confused because it didn't issue that session ID to you today.

A good URL for your bookmark should be, for example:
Code: Select all
http://www.utmc-forum.org/pub/index.php


But it worked in the past?
Yeah, maybe.
But in the past, I didn't have to implement tighter security because of brute-force attacks getting us shut down.

Note that, with the new forum software I'm working on setting up, this situation won't change, since I don't expect I will turn off captchas. New software won't stop anyone brute forcing our host into shutting us down.
If there were absolutely anything to be afraid of, don't you think I would have worn pants?

I said I have a big stick.
User avatar
DerGolgo
Zaphod's Zeitgeist
 
Posts: 12185
Joined: Sun Apr 04, 2004 9:34 am
Location: It's bad enough I gotta live here, don't make me say it, too ...
BANNER!:
Jolly Roger Alternative

Next

Return to Your choice regarding your data (+ how to register)

Who is online

Users browsing this forum: No registered users and 1 guest

cron