@Gargron

Fair, if a single client is hitting it excessively then it should be cached and isnt good etiquette for sure. Not quite sure I'd call it a DDoS but still, its bad design.

@mkljczk@mstdn.io @xorowl@mastodon.technology @jimpjorps

@freemo @mkljczk @xorowl @jimpjorps Again, it's distributed DoS because they release this software (a game mod) to end-users whose IPs are the ones hitting the endpoints. As far as I understand, anyway. I'm currently analyzing the log files to find out how many unique IPs the requests are coming from.

@Gargron

Honestly you dont have to justify yourself to me. I dont think your decision was bad per se. Just criticizing the harsh language which didnt seem fitting to me. Even if we agreed it isnt a DDoS you'd be justified in blocking them, all good.

@mkljczk@mstdn.io @xorowl@mastodon.technology @jimpjorps

@Gargron @freemo @mkljczk @xorowl @jimpjorps or, put differently:

Is it distributed? Yes.

Does it potentially lead to denial of service (through resource exhastion)? Yes.

Sounds about right.

@rysiek

I cant speak to Gargron's setup but I think most setups would be able to handle 3400 RPM on the outbox without even batting an eye.

Also by that logic if too many people start using mastodon clients on their phone or desktop then that is a DDoS since enough of them are distributed and would lead to resource depletion.

@Gargron @mkljczk@mstdn.io @xorowl@mastodon.technology @jimpjorps

@freemo @rysiek @Gargron @mkljczk @xorowl @jimpjorps According to https://github.com/citizenfx/fivem/pull/757#issuecomment-873238836 it was 4,000 requests *per second*. That would make most instances cry.

@tek @freemo @rysiek @mkljczk @xorowl @jimpjorps Sorry, that's one zero too many from me. 400 req/s. Corrected.

@Gargron @freemo @rysiek @mkljczk @xorowl @jimpjorps Ah, OK. That's still nontrivial.

@tek

then I misread it, that is on the high side.. though depends how many users were doing it. I would imagine mastodon clients in general produce more requests per second than that collectively but we wouldnt call those a DDoS... I dunno we are arguing semantics though, does it even matter what we call it?

@Gargron @rysiek @mkljczk@mstdn.io @xorowl@mastodon.technology @jimpjorps

@freemo @tek @Gargron @mkljczk @xorowl @jimpjorps probably not all that much. You were the one who started debating the language used, though.

@rysiek

I mentioned that DDoS was a bit harsh.. I didnt actually expect anyone to debate it and turn it into a huge thing. I guess I forgot I was on the internet :)

@tek @Gargron @mkljczk@mstdn.io @xorowl@mastodon.technology @jimpjorps

@freemo @tek @rysiek @mkljczk @xorowl @jimpjorps For comparison, average mastodon.social traffic is 200 req/s. I don't think it matters what we call it though. In my view it's a denial-of-service when it impacts performance due to unintended use, though maybe you could expand that to intended use as well. While the individual endpoints are intended to be used, it is the frequency with which they are retrieved that is unintended.

@Gargron

Agreed. It seems to me this is just a poor implementation that is "rude" and pings the endpoint **way** too much and they were too lazy (or didnt know enough) to add the appropriate caching. Call that what you will, it isnt important. But either way they made a error.

@tek @rysiek @mkljczk@mstdn.io @xorowl@mastodon.technology @jimpjorps

@freemo @Gargron @mkljczk @xorowl @jimpjorps he did mention 24000rpm (400rps) before.

Also, it's not 3400rpm, it's 3400rpm from a single small group of users. With all other requests being handled, that might be enough to create issues.

And finally, if the admin of an instance says this is too much, it's too much. If they want they can run their own servers, instead of getting high on their entitlement.

@rysiek

I already said in my first response he is entierly justified in blocking whoever he wants, for any reason, and this is as good as any. So we are in agreement.

@Gargron @mkljczk@mstdn.io @xorowl@mastodon.technology @jimpjorps

@rysiek @freemo @Gargron @mkljczk @xorowl @jimpjorps Question: Why use AP if you're just reading anyway? Why not use the RSS feed provided by each account and then (through caching) respect the TTL (https://www.rssboard.org/rss-specification#ltttlgtSubelementOfLtchannelgt) value?

@mattskala

I have no objection to his politeness.

@mkljczk@mstdn.io @xorowl@mastodon.technology @jimpjorps @Gargron