Basically because of a combination: The vanilla exploits in the OSS package, which forced us to move to the hosted solution (where much of the old look and feel of LET was lost), to then leaving the hosted solution and continuous attacks on the site.
@jbiloh Install Naxsi along with Nginx, and also enable CloudFlare. Naxsi will prevent XSS/Injections. And also protect the admin area of Vanilla with a htpasswd. All of this can be done in under an hour.
@Magiobiwan said:
What about Cloudflare? It's pretty decent at defeating botnets.
Not really. Well, it depends on the plan and type of attack.
I tend to think that PMs don't work either because today someone said that they couldn't reach me and I've sent you @jbiloh a few PMs but never heard back. Hopefully everything gets fixed and we can all go back to the usual things :-)
Comments
I get that error when i try to respond @liam
I also get the following message when i try, also when i logged out and back in(took a few refreshes to get back in):
503 Service Temporarily Unavailable
nginx/1.4.1
How is it working now?
@jbiloh When I hit the button to send it I get the above error message.
I think I just sent you one. Can you confirm?
Same problem happens occasionally for notifications.
@jbiloh 503 Service Temporarily Unavailable nginx/1.4.1
Ok standby, we will increase the limits some.
Working fine here, I was getting a 503 error this morning.
How about now?
It let it through, can you confirm receipt?
Got it. We'll just have to closely monitor things and up thresholds when/where possible.
cool, thanks
@jbiloh Why are we having so many issues here recently?
Basically because of a combination: The vanilla exploits in the OSS package, which forced us to move to the hosted solution (where much of the old look and feel of LET was lost), to then leaving the hosted solution and continuous attacks on the site.
so right now LET is hosted on your own servers in buffalo?
In Chicago, but yes.
@jbiloh Install Naxsi along with Nginx, and also enable CloudFlare. Naxsi will prevent XSS/Injections. And also protect the admin area of Vanilla with a htpasswd. All of this can be done in under an hour.
@jbiloh to stop the ddos attacks, why not put it under a filtered IPv4 address? Firewall?
The DDOS attacks are easy to stop, it's the more targeted low traffic type attacks that are the challenge.
@jbiloh those sub 500Mbit attacks can be a pain in the ass, however @Jeffrey is right, IP filtering could help with that in a big way.
Indeed, big UDP attacks are the easiest to deal with.
Get filtered IPv4 Address, problem solved. I'm sure you guys can afford it.
@jbiloh When I click on the "edit" button to edit my comment, I get the 503 message. 503 Service Temporarily Unavailable
I keep getting that in other occasions as well, such as instead of draft saved notification.
If only you knew anything about the kind of attack, a filtered IP will not help in this case.
What about Cloudflare? It's pretty decent at defeating botnets.
Not really. Well, it depends on the plan and type of attack.
I tend to think that PMs don't work either because today someone said that they couldn't reach me and I've sent you @jbiloh a few PMs but never heard back. Hopefully everything gets fixed and we can all go back to the usual things :-)
I mentioned CF more in response to the attacks rather than PMs not working, but it's CF so it might make it work
@Magiobiwan you're better off with CF than without it, that's for damn sure