Re: The status of the Rule QA system

On 2026-06-26 at 07:38:30 UTC-0400 (Fri, 26 Jun 2026 13:38:30 +0200)
Tom Hendrikx <[email protected]>
is rumored to have said:

> On 6/26/26 11:38, Benny Pedersen via users wrote:
>> Kevin A. McGrail skrev den 2026-06-26 03:53:
>>> Amen
>>
>> jehova :-)
>>
>> should it not just be running on 127.0.0.1 ? and create results to 
>> live servers presenting the results, it does not need to be 0.0.0.0 
>> while computing imho, lesson learned here
>>
>
> My firsthunch was (and I'm guessing Benny suggests same thing here) is 
> that the RuleQA webserver should not be on the same machine as the 
> actual RuleQA processing stuff, assuming that the DDOS is over HTTP. 
> Maybe an aggressive caching reverse HTTP proxy would be enough?

That would be great, but at present ASF is only providing one VM per 
project. As of yesterday, this is a pretty beefy one.

> Then we could allowlist the rsync submitters (at least to an ISP range 
> if a single IP doesn't suffice) and close public access to the RuleQA 
> backend server altogether?
>
> Probably these ideas have already been catered and discarded for 
> reasons beyond my knowledge, but I'm still putting them here in case 
> it might help someone.

It's the simplest reason in IT: time and money. ASF is a charitable 
entity which does not give donors any governance privileges, so we don't 
have the same sort of resources that donor-run foundations may have.

So far (a bit over a day...) it looks like the latest mitigation is 
doing a good job.



-- 
  Bill Cole
  [email protected] or [email protected]
  (AKA @[email protected] and many *@billmail.scconsult.com 
addresses)
  Please keep discussion mailing list replies *on-list*
  Not Currently Available For Hire