 |
|
|
|
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Hello,
I can no longer connect to Thunderbird to read the news.
I tried using the web interface, but I was denied access there as well.
I just created an account that lets me log in via the web interface, but I still
can't log in via nntp.
Still getting the same error in the thunderbird console :
error { target: TCPSocket, isTrusted: true, name: "ConnectionRefusedError",
message: "Network", errorCode: 2152398861, srcElement: TCPSocket, currentTarget:
ConnectionRefusedError Network 2152398861 NntpClient.sys.mjs:254:18
_onError resource:///modules/NntpClient.sys.mjs:254
jr (thanks to him) told me that chris must have, quite rightly, put safeguards
in place with cloudflare
Could using 563 (SSL/TLS) be a solution?
If you have a solution, I'd love to hear it!
Thanks in advance
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"kurtz le pirate" <kur### [at] free fr> wrote:
> I can no longer connect to Thunderbird to read the news.
Same here and also thanks to jr for explanation, will communicate by Web now.
--
YB
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
"kurtz le pirate" <kur### [at] freefr> wrote:
> Hello,
>
> I can no longer connect to Thunderbird to read the news.
I'm glad it's not just me. I was getting very frustrated because Thunderbird
also seemed to disconnect from my Bluehost email and Bluehost is not being
helpful in reconnecting.
Uncle Josh
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On 8/08/2026 23:24, kurtz le pirate wrote:
> I can no longer connect to Thunderbird to read the news.
Folks,
Apologies for the issue, but web scrapers forced my hand by totally bringing the
system down attempting to scrape the news.povray.org web interface with several
thousand connections per second (!)
There was no clear pattern of IP addresses or other facets I could use to block them
server-side so I had no option but to turn on cloudflare for the news and www sites.
This has resulted in news.povray.org getting a new IP address pointing at cloudflare,
and it doesn't relay or proxy NNTP.
The workaround for now is to either use a new DNS entry I have created -
nntp.povray.org - which points at the real IP address, or to add a new hosts entry to
your system that equates news.povray.org to the IP address 203.29.75.35. This has the
downside that connections to the web view at news.povray.org will no longer work,
since even after I cloaked news.povray.org with cloudflare, I was still seeing
millions of connections direct to the IP address and had to block ingress on port 80
and 443 to cloudflare IP's only.
After posting this message I will give turning off the IP block a test to see if the
direct connections have gone away - by now the scrapers should all have picked up the
new IP address, or so I hope.
Which method you use depends on your NNTP software. Thunderbird allows you to change
the IP without losing your existing cached NG's, content etc, so changing to
nntp.povray.org in the connection settings should work. Other software may require you
to toss your cached data (my iOS newsreader wanted to do this).
At the moment, provided you can use the new IP address, access to port 119 should work
whichever method you employ.
-- Chris
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On 9/08/2026 12:21, Chris Cason wrote:
> by now the scrapers should all have picked up the new IP address, or so I hope.
And this does appear to be the case. So direct connections to the www server should
work again, meaning a hosts entry is probably the best approach for those who can use
it.
-- Chris
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On 09/08/2026 05:21, Chris Cason wrote:
> Apologies for the issue, but web scrapers forced my hand by totally
> bringing the system down attempting to scrape the news.povray.org web
> interface with several thousand connections per second (!)
Chris,
thanks so much for this fix and all other things you are doing for our
community. Changing server address to nntp.povray.org in settings works
fine for me.
--
YB
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
To give you an idea of how insane the (presumably AI) scraper was hitting us, here's a
screenshot of the DNS analytics for the period in question (I can't use HTTP analytics
for the "before" period because at the time news.povray.org was not proxied by
Cloudflare and thus they have no data on it; the DNS queries are a substitute).
Keep in mind each DNS query for the IP address of news.povray.org does not equal one
connection, since the scrapers only need to query for the IP address once per client,
and it is then cached. This was demonstrated when I did turn on Cloudflare proxying
but the hammering continued due to the above caching, leading me to need to firewall
it off for a day or two.
We will never know how many individual IP addresses were involved in the attack but I
expect it to be in the millions. This is not unprecedented - we had to deal with a
network of scrapers hitting the f-lohmueller.de site a month or two ago. In that case,
while they were coming in fast, they weren't so fast as to overflow the listen queue
so we were able to log every request (it also helps that the FL site is fully static,
no PHP and no database, which is not the case for the news server). As JR can attest,
for that case alone the logs showed the requests coming from over 800,000 unique IP
addresses. Fortunately we were able to isolate them well enough to firewall those off.
In the DNS analytics screenshot (taken today) you can see that over the prior three
days there were about 29 million queries for the address of news.povray.org, averaging
130 queries/second. But that's over three days - you can see from the spike that
almost all were on Friday (AU time) and peaked at 2.6 million requests/hour (about 720
requests/second) just after 3pm, at which time I started tuning the Cloudflare ruleset
to keep bots out but allow normal visitors (there was a pattern in the HTTP requests).
I was trying to avoid having to use a challenge (the "are you human" dialog that web
visitors get) but in the end I had to turn that on, too, as none of the rules I set up
would bite hard enough. I probably could have done it with a regex, but that's only
available for Enterprise customers*
In the screenshot of the HTTP analytics - which only became relevant once I turned on
the proxy - you can see that in a single four-hour period there were over 17 million
requests, peaking at around 250,000 per minute at 3:15-ish, at which point I started
setting the bot rejection rules. These requests were only from clients that "saw" the
new IP address, as mentioned above there were an unknown (but very large) number of
bots still hitting the direct IP address, which Cloudflare doesn't see.
Overall this careless, stupid and needless deployment of a clearly broken scraper not
only took down the site for a while but also has cost me at least a day of lost
productivity, as well as requiring the DNS change which blocked NNTP access. It is
almost beyond belief that anyone would expect something like this to work. I can only
assume it's a so-called "vibe-coded" program and that the authors simply *did not
care* if it worked or not, they just deployed it anyway.
I have taken the time to document this not only to show our userbase why we had to
make the change, but also to make a public record of what's been going on behind the
scenes due to the race to train LLM's and the cheap availability of immense
residential proxy networks. I will also post this same data to povray.org's front
page.
Our site is not by any means the only one dealing with this sort of nonsense, and I
suspect it's going to get worse before it gets better.
* That said I am grateful to Cloudflare for providing us with a free "Pro" account
under their open-source initiative.
-- Chris
Post a reply to this message
Attachments:
Download 'dns-analytics-75%.png' (619 KB)
Download 'http-analytics-75%.png' (131 KB)
Preview of image 'dns-analytics-75%.png'
Preview of image 'http-analytics-75%.png'
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On 9/08/2026 12:21, Chris Cason wrote:
> This has resulted in news.povray.org getting a new IP address pointing at
cloudflare, and it doesn't relay or proxy NNTP.
Also, for the record, I have now added NNTP SRV records to the DNS for povray.org and
news.povray.org. For the technically inclined, you can use nslookup or dig etc to
query _nntp._tcp.povray.org or _nntp._tcp.news.povray.org. e.g. "nslookup -q=srv
_nntp._tcp.povray.org" or "dig _nntp._tcp.povray.org SRV +short".
There are very few NNTP clients that use SRV but it is a thing (see
https://datatracker.ietf.org/doc/html/rfc2782) and will remain for as long as we can
still run NNTP.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On 09/08/2026 04:21, Chris Cason wrote:
> Folks,
>
> Apologies for the issue, but web scrapers forced my hand by totally
> bringing the system down attempting to scrape the news.povray.org web
> interface with several thousand connections per second (!)
>
> [snip]
>
> At the moment, provided you can use the new IP address, access to port
> 119 should work whichever method you employ.
>
You don't need to apologize. If anything, we're the ones who should
thank you for the work you do to maintain the POVray server for our
little community.
Implementing a waf is always complicated. You have to constantly balance
the service you offer with the security measures you need to put in
place. In the world of wafs, darkness reigns supreme—or perhaps even
magic !!!
Setting up this new url just for nntp is a great idea. Simple and effective.
The issue has now been resolved. THANK YOU.
But... my thunderbird didn't handle this transition well, and nothing
was working anymore. I saw some really strange things in the logs (see
screenshot).
So I deleted all the POV-Ray configurations (I have other configurations
for other NTP servers that work fine)
I'm in the process of reconfiguring everything, and my first test in
p.test went well. Gotcha !.
Hoping that Cloudflare doesn't introduce any more jokes.
Regards
Post a reply to this message
Attachments:
Download 'auth_error.png' (62 KB)
Preview of image 'auth_error.png'
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On 10/08/2026 01:31, kurtzlepirate wrote:
> But... my thunderbird didn't handle this transition well, and nothing was working
anymore. I saw some really strange things in the logs (see screenshot).
Any chance that during the reconfiguration you added a username? This isn't necessary
for the NNTP server and unless you actually have an account on it (which you don't;
the website accounts are for HTTP, not NNTP) then your connection will fail in the way
you showed.
While it's working now, I'd still suggest you go to Settings -> Privacy & Security and
click on the "Saved Passwords" button. If in the list you get there is any reference
to news.povray.org then that was the cause.
-- Chris
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
