EEVBlog overly zealous user verification

[Benta]

I'm fully aware of the problems this site has had the last days (DDOS), but the CloudFlare solution is overly zealous. I'm being "verified" every (felt) 15 minutes, and when repying to a post, I'm verified again, making me lose the reply content I just spent time on composing.
There must be some settings that can be optimized. I mean, when I'm constantly on the site, why do I need to be verified again and again? I could understand it if I turned off my PC and then logged on again, but...

Thanks, for any improvements mods, I know it's a tough job.

[Analog Kid]

Not to complain—I certainly appreciate all the efforts to keep this site accessible—but I also wonder why we need to re-authenticate ourselves every X minutes?

Don't (most of) our IPs remain the same throughout a session?
What would be the need for such reauthentication?
Does "the system" (whatever's on the EEVblog end) remember who's who and how long they've been logged in?

Again, not a complaint. Having to click a checkbox every so often is a small price to pay for continued access here.

[Red Squirrel]

I had to do the same to my forum as I'm also under attack. Doesn't seem Cloudflare has any options to alter the frequency of these per IP.  Seems to me it would make sense if there was a way to tell it to either set a cookie or just go by IP, and then only do the verification like every hour or so.

I tried to disable it on my forum and immediately my traffic shot up to the point of DDoS. I suspect it's the same going on overhere too.  I really wonder if there is some sort of global DDoS going on right now or something.

[thm_w]

The discussion is here at the end: https://www.eevblog.com/forum/news/getting-a-lot-of-502-bad-gateway-errors/

For now its recommended to copy what you've posted before posting it. Usually firefox saves this as well but not always.

[wilfred]

... I really wonder if there is some sort of global DDoS going on right now or something.

If that were so, then there would be similar discussions going on elsewhere. Are there? I haven't looked. From what little I've followed this one I don't recall seeing mention of others.

[Randy222]

I'm fully aware of the problems this site has had the last days (DDOS), but the CloudFlare solution is overly zealous.

CrowdSec and nginx. Is that version of nginx R37.0.5.1 ?

Their dials marked 1-11.

[Randy222]

The discussion is here at the end: https://www.eevblog.com/forum/news/getting-a-lot-of-502-bad-gateway-errors/

For now its recommended to copy what you've posted before posting it. Usually firefox saves this as well but not always.

Just use the back button on browser. That at least gets you back to what was typed. The copy-paste extra energy is still needed.
Using an AI bot to handle the keying is a plus these days. 

[EEVblog]

I disabled Under Attack authentication on CloudFlare yesterday, so whatever is being done is being done server side as part of the CrowdSec integration gnif has put in place.

[EEVblog]

Bingo, I found the setting for the authentication timeout, it was set to 1 hour.
I have changed it to 1 week. See if that works.

[gnif]

Bingo, I found the setting for the authentication timeout, it was set to 1 hour.
I have changed it to 1 week. See if that works.

Please undo this, the reason people were getting this was because the servers thought all traffic was originating from the CF proxy IPs instead of each end user individually, stacked on top of CrowdSec. This issue is already solved and doing this will allow bots to hammer the site again via auth and cookie copying for a week at a time.

[Berni]

These days you can get flagged for a suspicions IP even on a regular residential IP.

With the age of scraping everything for AI most websites have put up stricter security. But business that aim to collect data and sell it to the AI companies want to keep going. So this opened up a new niche for providing residential looking IP proxies. Some legit products now burry in their TOS a fine print that let's them use your internet connection as a proxy and then sell that as a service to other companies. Others just build botnets and infect as many home PCs as possible.

So with more and more bot traffic coming from these residential proxies means that a residential IP range (that you might happen to be in) gets flagged for being a bot host.

[EEVblog]

Please undo this, the reason people were getting this was because the servers thought all traffic was originating from the CF proxy IPs instead of each end user individually, stacked on top of CrowdSec. This issue is already solved and doing this will allow bots to hammer the site again via auth and cookie copying for a week at a time.

Oops, sorry, undone. Back to 30min.

[Benta]

I don't know about the settings, but the issue seems to be solved.
Thanks.

[TUMEMBER]

I don't know about the settings, but the issue seems to be solved.
Thanks.

That was the reason.
https://www.eevblog.com/forum/chat/website-error-reports/msg6359604/#msg6359604

[Randy222]

These days you can get flagged for a suspicions IP even on a regular residential IP.

With the age of scraping everything for AI most websites have put up stricter security. But business that aim to collect data and sell it to the AI companies want to keep going. So this opened up a new niche for providing residential looking IP proxies. Some legit products now burry in their TOS a fine print that let's them use your internet connection as a proxy and then sell that as a service to other companies. Others just build botnets and infect as many home PCs as possible.

So with more and more bot traffic coming from these residential proxies means that a residential IP range (that you might happen to be in) gets flagged for being a bot host.

Doing anything security based on IP is like planning to inhabit Mars in year 2030. Use the literal sense of the IP layer, routing.

[Seekonk]

After hitting the box 20 times and getting nowhere, all  could think of was Wolowitz saying to Sheldon ....... I smell a robot.

[GilbouFR]

First we got dialogs almost everywhere because the european legislation doesn't allow data to be collected without the user to agree on it. So I went from browsing to... clicking "OK" or "Minimal cookies" almost everywhere. And I thought that Internet was already becoming really bad at that time.

And now, on top of this, with the AI bots sucking data from every website several times per day, we now have those "checks". So it becomes slow, and often you can't even pass the automatic tests and have to click pictures, Captcha's all around which is way, way worse than just clicking OK in a dialog.

Search engines have become so bad I have to use an AI to type inside of it what I'm searching. Because today, if I search anything, the first 4 or 5 pages or result do not give me anything proper or good anymore.

We peaked in 1999. It's been a slow slope to hell since.

If this keeps going on in full enshitification mode, I now seriously consider a future date where I will just stop using Internet.

[GilbouFR]

Hooo it's much worse than this.

Because the IPv4 space is basically used-up, we now have FAIs giving the SAME IP Address to several clients, and using PORTS at the ISP level to separate the users and route trafic from them to Internet, and back to them when it comes back.

So "your" IP address is not even yours anymore. You can have 2 to n people at the ISP level sharing it...

So even if all you do is just browse around on the EEVBlog forums, any shenanigans made by the others sharing that very same IP will taint it so you get in trouble everywhere you try to load a website.

This technology is called Carrier-Grade NAT (CGNAT), also known as Large-Scale NAT (LSN).

The IPv4 address your ISP gives you can be, on Internet, from 2 to several hundreds of people.

There are variants of this crap : CGNAT/LSN is the general one, you have NAT444 where NAT is performed twice (once in your router at home, once at the ISP) and DS-Lite (which is more an IPv6 thing where is is used for IPv6 users to reach IPv4 servers). We also have MAP-T and MAP-E which is an algorithm-driven IPv4 address/ports sharing and 464XLAT which is all that crap but on mobile devices like phones.

So you understand quickly how tainted "your" IPv4 address can become on Internet.

[thm_w]

First we got dialogs almost everywhere because the european legislation doesn't allow data to be collected without the user to agree on it. So I went from browsing to... clicking "OK" or "Minimal cookies" almost everywhere. And I thought that Internet was already becoming really bad at that time.

ublock has a gdpr filter option for years: https://www.reddit.com/r/YouShouldKnow/comments/8mq4rm/ysk_ublock_origin_has_optional_filter_lists_that/

Google still works fine for me, for example if you would search "how to block gdpr popup" its all useful results.