Status of the DDoS on SA Infrastructure

This is an OpenPGP/MIME signed message (RFC 3156 and 4880).

--=_MailMate_46FDE0DB-9A64-454F-89F7-71E7881C1E8E_=
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

As many of you know, for over a year now we've been dealing with a massiv=
e flood of queries on the RuleQA server at https://ruleqa.spamassassin.or=
g, with broadly variable success. The original theory was that this was L=
LM trainers sucking in all the data they can find mindlessly, but the fig=
ht has exposed a pattern making it clear that this is a directed attack o=
n the daily updates of rules and scores. As a result, those updates have =
been sporadically broken, predominantly due to our QA contributors being =
unable to upload their scoring results. I believe that as of today, we ha=
ve found a workable tactic to protect that process.

As with most tactics used to resist such attacks, there's a cost. Some qu=
eries to the RuleQA server will break, somewhat randomly based on timing =
and the load on the system. Retrying on any explicit error is likely to s=
ucceed. Some networks that may have legitimate users are very much blocke=
d due to abuse (e.g. Huawei Cloud and some other VPS providers as well as=
 some mobile networks) so if you cannot reach the server at all but inste=
ad just time out, speak up here and I'll try to fix it.

ALSO: don't go to any rule performance detail page cold, without a Refere=
r header. That just won't work.


-- =

 Bill Cole
 [email protected] or [email protected]
 (AKA @[email protected] and many *@billmail.scconsult.com addresses=
)
 Please keep discussion mailing list replies *on-list*
 Not Currently Available For Hire

--=_MailMate_46FDE0DB-9A64-454F-89F7-71E7881C1E8E_=
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename=signature.asc
Content-Type: application/pgp-signature; name=signature.asc

-----BEGIN PGP SIGNATURE-----

iIoEAREKADIWIQSD6xgpiXWgu9hXilLazUImdqvDjAUCailzAxQcYmlsbGNvbGVA
YXBhY2hlLm9yZwAKCRDazUImdqvDjAyRAQCPzBeMcKmmHowGb9g+2LQHlWNIFRUr
PXrtWs9hu7tSVwD+LiRJafmOridh8m5rvd1RLDaasrIzgvk1ibSVLYNN7/M=
=38x8
-----END PGP SIGNATURE-----

--=_MailMate_46FDE0DB-9A64-454F-89F7-71E7881C1E8E_=--