Re: The status of the Rule QA system

--000000000000d7214206551e61c8
Content-Type: text/plain; charset="UTF-8"

Amen

On Thu, Jun 25, 2026, 20:35 Bill Cole <[email protected]> wrote:

> With help from the fine folks at ASF Infra, I've managed to get back into
> our DDoS'd machine which handles all of the Rule QA operations. I've added
> a rather gross but effective stanza to the main script for the ruleqa
> website which assures that no volume of hits on the webserver can so
> overload the machine that it cannot do it's most important work: ingesting
> and analyzing masscheck results and rescoring the ruleset. If you hit it
> when it is being hit too hard by the thousands of IPs used in the attack,
> you will get a page saying that it is offline. This is suboptimal. We live
> in a broken world.
>
> At this moment, after ~2 hours with that in place, the site is
> persistently accessible and the load is low. It looks like the segment of
> the mob which was doing the heaviest hitting has taken a break for now.
> This sort of break had not occurred for over 2 weeks until now.
>
> Please be aware that while this same sort of attack is hitting a lot of
> sites, it is not universal and it is not untargeted. I get a sense that it
> is also not unmonitored as a DDoS, as it does seem that when I've found a
> useful tactic and worked it for a while (e.g. whack-a-mole blocking)
> eventually the new hits just stop coming. As if they've stopped to revise
> their tactics. That sort of lull is present now, after about an hour of
> heavy pounding after I deployed the current defense.
>
>
> --
>  Bill Cole
>  [email protected] or [email protected]
>  (AKA @[email protected] and many *@billmail.scconsult.com addresses)
>  Please keep discussion mailing list replies *on-list*
>  Not Currently Available For Hire
>

--000000000000d7214206551e61c8
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto">Amen</div><br><div class=3D"gmail_quote gmail_quote_conta=
iner"><div dir=3D"ltr" class=3D"gmail_attr">On Thu, Jun 25, 2026, 20:35 Bil=
l Cole &lt;<a href=3D"mailto:[email protected]">[email protected]</a>&g=
t; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 =
.8ex;border-left:1px #ccc solid;padding-left:1ex">With help from the fine f=
olks at ASF Infra, I&#39;ve managed to get back into our DDoS&#39;d machine=
 which handles all of the Rule QA operations. I&#39;ve added a rather gross=
 but effective stanza to the main script for the ruleqa website which assur=
es that no volume of hits on the webserver can so overload the machine that=
 it cannot do it&#39;s most important work: ingesting and analyzing massche=
ck results and rescoring the ruleset. If you hit it when it is being hit to=
o hard by the thousands of IPs used in the attack, you will get a page sayi=
ng that it is offline. This is suboptimal. We live in a broken world.<br>
<br>
At this moment, after ~2 hours with that in place, the site is persistently=
 accessible and the load is low. It looks like the segment of the mob which=
 was doing the heaviest hitting has taken a break for now. This sort of bre=
ak had not occurred for over 2 weeks until now.<br>
<br>
Please be aware that while this same sort of attack is hitting a lot of sit=
es, it is not universal and it is not untargeted. I get a sense that it is =
also not unmonitored as a DDoS, as it does seem that when I&#39;ve found a =
useful tactic and worked it for a while (e.g. whack-a-mole blocking) eventu=
ally the new hits just stop coming. As if they&#39;ve stopped to revise the=
ir tactics. That sort of lull is present now, after about an hour of heavy =
pounding after I deployed the current defense.<br>
<br>
<br>
-- <br>
=C2=A0Bill Cole<br>
=C2=A0<a href=3D"mailto:[email protected]" target=3D"_blank" rel=3D"norefe=
rrer">[email protected]</a> or <a href=3D"mailto:[email protected]" targ=
et=3D"_blank" rel=3D"noreferrer">[email protected]</a><br>
=C2=A0(AKA @[email protected] and many *@<a href=3D"http://billmail.sc=
consult.com" rel=3D"noreferrer noreferrer" target=3D"_blank">billmail.sccon=
sult.com</a> addresses)<br>
=C2=A0Please keep discussion mailing list replies *on-list*<br>
=C2=A0Not Currently Available For Hire<br>
</blockquote></div>

--000000000000d7214206551e61c8--