Some time ago somebody posted an extensive list of things you can do to stop bots from aggressively getting your website, if you don’t want to hide behind Cloudfare.
As the original poster said at the time: don’t use on a production server!
That said, I’ve been using it on a production server for a month. It’s surprisingly efficient, and if you ban RU, US, IN and CN it’s extremely efficient.
Ask a lawyer about sending an unpleasant letter to the scanner, detailing the situation and demanding that they cease & desist. That clobbers their "we didn't know" defense, and their Legal Dept. will likely order them to stop ASAP.
Most distributed bots won't follow a 301. If 404/400 don't work, just 444 them, they're not worth giving back a response, especially on a personal website.
If the non-profit was walking down the road and rattling everybody’s door lock to see which are unlocked, and having a look around the windows to see if any are open, would that be a crime?
Because that is exactly what all of these vulnerability scanning companies are doing, and all of us sort of just… let them.
If the neighborhood was constantly being canvased by criminals checking doorknobs, so your concerned neighbor went over to your house to check your doorknob, and then let you know if you accidentally left it open, would you also accuse your neighbor of being a criminal trying to break in?
This is why the checking doors / neighborhood analogy isn't a good one.
Having one person with poor computer security negatively impacts everyone. Hacked sites turn into phishing landing pages, exploit kit hosting, stolen data dumps, and launching off points for attacks on everyone else. The vuln scanning ShadowServer is doing is meant to be a public good, which is why they share the info with ISPs and governments.
Security is too intertwined to stand by and say other people's vulnerabilities aren't your problem.
It is a good analogy because thieves stealing from one house successfully gives them resources and incentivizes them stealing from the same area again.
And even if you remove the analogy, ShadowServer means good, but good intentions doesn’t necessarily make their action moral or legal.
Yes, compromised servers can be used by hackers as means to commit crimes. But when these groups scan the entire internet, they do cause harm as well, as shown in the original linked article. Much less harm than a black hat, but they still waste time and resources from innocent third parties.
It’s fair to ask if the harm they cause is worth the good they do.
> It’s fair to ask if the harm they cause is worth the good they do.
Researcher disclosures, even with POCs, have moved the industry to action incumbents would have rather buried. I’m thinking of CPU and memory exploits, and stuff like log4j, as examples.
Frontier AI is enabling the cyber arms race more than anything past, and certainly more than some bot slowly crawling web servers for old vulnerabilities.
If we’re talking harm, it should be in the broader context of internet history, imo.
Ok, but there is a massive difference between "I hammered my own CPU and found a bug that affects everyone" and "I hammered THE ENTIRE INTERNET and found some poor persons website that is not super secure and then I snitched on them to their ISP".
The first is a lot more legal and ethical than the second.
They didn't hammer the entire internet. That would be like a multi-terabit DDOS. In contrast, the scanner in question sent a trickle of web requests for old vulns, nearly-innocuous at this point.
Fear & the danger aren't the same. anyway, I'll let it go.
Gamers Nexus paid a lawyer to read the contract and had one of their staff members try to read the entire thing on the TV.
The lawyers conclusion is that a non-lawyer basically has no chance of correctly interpreting the contract and the TV auto-standby almost made it physically impossible for the staff member to even read it.
The „happy path“ is the only path, for all practical purposes.
Not only that but to read every single related T&C from the whole chain of partners, and to keep track of it when it changed, is basically impossible.
This sort of malicious compliance of using T&C to enable bad behaviour by corporations needs to be fixed with laws.
Reminds me of cookie banners, the dark pattern where they've decided to be deliberately verbose and annoying in order to get people to take the easy path and agree to let them continue doing their bad behaviour.
If ~~someone gives you a hint about an approach~~ you steal someone’s notes about a promising approach, and then you hire 10,000 people to brute force the problem basically everyone would consider that “shitty behaviour”, “theft”, and “poor form”.
TBH China is not currently bombing a foreign country for no reason and it is not threatening to invade its allies.
It’s not a particularly high bar, but of the big powers, only China currently meets it.
And I know you will say „but payment networks are not a warfare question, they are an economic question“ but that kind of breaks down when they are used to sanction ICC judges presiding over war crime cases.
China has invaded and conquered other countries before, has occupied territories and clearly plans to invade at least one neighbour id it gets the chance. Its hugely oppressive internally and is wiping out minority cultures by any means required.
Some time ago somebody posted an extensive list of things you can do to stop bots from aggressively getting your website, if you don’t want to hide behind Cloudfare.
I thought I’d make a nice UI for that:
https://github.com/ivankovic/stop-bots
As the original poster said at the time: don’t use on a production server!
That said, I’ve been using it on a production server for a month. It’s surprisingly efficient, and if you ban RU, US, IN and CN it’s extremely efficient.
reply