The status of the Rule QA system

This is an OpenPGP/MIME signed message (RFC 3156 and 4880).

--=_MailMate_EDAD5819-DB59-47CE-87DB-DC006A04D9CB_=
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

With help from the fine folks at ASF Infra, I've managed to get back into=
 our DDoS'd machine which handles all of the Rule QA operations. I've add=
ed a rather gross but effective stanza to the main script for the ruleqa =
website which assures that no volume of hits on the webserver can so over=
load the machine that it cannot do it's most important work: ingesting an=
d analyzing masscheck results and rescoring the ruleset. If you hit it wh=
en it is being hit too hard by the thousands of IPs used in the attack, y=
ou will get a page saying that it is offline. This is suboptimal. We live=
 in a broken world.

At this moment, after ~2 hours with that in place, the site is persistent=
ly accessible and the load is low. It looks like the segment of the mob w=
hich was doing the heaviest hitting has taken a break for now. This sort =
of break had not occurred for over 2 weeks until now.

Please be aware that while this same sort of attack is hitting a lot of s=
ites, it is not universal and it is not untargeted. I get a sense that it=
 is also not unmonitored as a DDoS, as it does seem that when I've found =
a useful tactic and worked it for a while (e.g. whack-a-mole blocking) ev=
entually the new hits just stop coming. As if they've stopped to revise t=
heir tactics. That sort of lull is present now, after about an hour of he=
avy pounding after I deployed the current defense.


-- =

 Bill Cole
 [email protected] or [email protected]
 (AKA @[email protected] and many *@billmail.scconsult.com addresses=
)
 Please keep discussion mailing list replies *on-list*
 Not Currently Available For Hire

--=_MailMate_EDAD5819-DB59-47CE-87DB-DC006A04D9CB_=
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename=signature.asc
Content-Type: application/pgp-signature; name=signature.asc

-----BEGIN PGP SIGNATURE-----

iIoEAREKADIWIQSD6xgpiXWgu9hXilLazUImdqvDjAUCaj3JLhQcYmlsbGNvbGVA
YXBhY2hlLm9yZwAKCRDazUImdqvDjMzpAP4hLfz+3ABXvWKw6TTrg60bOPuPs4CL
5/XecQ68CJkepAD9FaJWOfrLEJN1n1pXN1NHayVK+C68bUAWiXi9GxJp7LM=
=BoOE
-----END PGP SIGNATURE-----

--=_MailMate_EDAD5819-DB59-47CE-87DB-DC006A04D9CB_=--