New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Comments
So did I, but unlike yours, mine is written by a human and is confirmed to actually stop the bot flood I was getting.
I think u did not read my post and what makes you think that mine can't stop ?
even tho mine have hidden bugs yet to be fixed
or if you are that confident then lets see whose better
ready to go toe to toe with anyone on this one
thank you
did not reply to all trolls, but happy to answer anyone on the technical and proof of work side
NEW CHALLENGE DROPPED. WHO’S GOT THE BALLS TO ACCEPT IT? LET’S SEE WHO STEPS UP. 🍿
I've been struggling with L7 DDoS all day but it's not the kind a WAF could do anything about.
wanna try ? you might have few pointers to improve it and find few bugs
It's an attack against my Tor relays (and all of the network, actually). By design it's impossible for a relay to know if an incoming request is legitimate or malicious: https://lists.torproject.org/mailman3/hyperkitty/list/[email protected]/thread/U5FTEYNST44IGM2MHSA6VEYD5THOIEOY/. So definitely an L7 attack, but a WAF couldn't do shit for it.
Interesting point
Why use your vibecoded crap over something battle-tested like https://gitgud.io/fatchan/haproxy-protection or https://github.com/techaroHQ/anubis?
true, i will check if something can be done about this, and update u back
surely you can read or you just dumb enough not to read the post and comment/replies ?
call it crap once u can build something yourself like this i guess and you can use all AI you can and try
and did u even check and used the sources you pasted or just asked AI to give you some OSS stuff ?
Anubis sucks, and it's only intended for AI scrapers.
@forest idk much about tor side of things but a L7 protection hosted entirely on the tor will mitigate this easily , i don't have any name of service but you can find them easily since u active on the other side.
Rich coming from you
then why not u do it ?
there's open challenge out there !
If I say what I want to say I'll get banned sir
that means you are just as frustrated along with others, its okay
you can try as well and judge later its in beta so you can contribute a lot with testing
Ah fuck it, I'll test your vibe coded piece of shit.
DM me
as far as i know, i dont think that would work in this case. the problem is that Tor relays cant distinguish legitimate traffic from malicious traffic at the application layer by design, so putting an L7 protection layer in front of the relay doesnt really solve the underlying issue.
a normal WAF/CDN approach works when you control the application and have something meaningful to filter on. with Tor relay traffic, the relay itself doesnt know what the actual user is requesting, so there isnt much useful L7 information available to filter on.
Yes, I've used haproxy-protection in production on a medium sized site where Cloudflare wasn't an option in the past and it worked quite nicely. I don't disagree with @Obelous' point about Anubis sucking but it's very widely used hence why I brought it up.
sent
Yep and the one I built is superior, you can give it a try as well
I read the thread u shared and L7 would be like filtering the wrong layer. make sense what you said
yaa, a Tor relay only sees encrypted Tor cells and circuit level metadata. it doesnt see the actual HTTP request, destination URL, etc, or what the user is requesting. so there’s nothing meaningful for an L7 WAF to classify.
you could still do lower level rate limiting or connection/circuit level mitigation, but that’s a different thing entirely. trying to apply normal L7 filtering to the relay would either be ineffective or require breaking the privacy properties tor is designed around.
exactly entirely different ball game
, someday i might delve deep into tor, forest got good posts regarding that i checked
Yep, it's Tor itself that would have to implement the mitigations. The current attacks seems to be someone requesting a copy of the directory (a list of all relays and associated data like fingerprint and public keys), which most relays will store a mirror of. But the victim relay is being asked for that several-megabyte file nearly a thousand times per second. Each request is small, but the response requires both significant CPU (to calculate a diff and compress outgoing data) and bandwidth (outgoing bandwidth is easily made to exceed 1 Gbps).
The fix is definitely an L7 mitigation, but it'll have to be integrated within Tor itself, e.g. closing any circuit that sends more than a few BEGIN_DIR requests. Dunno.
I guess the tricky part would be setting the limit without affecting legitimate directory requests.