Tartarus (formerly KiwiFlare) / Proof-of-Work Feedback and Grievances

  • 🏰 Deploying update to the Tatarus security page. If you encounter issues, post here.
  • Want to keep track of this thread?
    Accounts can bookmark posts, watch threads for updates, and jump back to where you stopped reading.
    Create account
Sneaky lurker said:
It's stuck on a challenge loop.
Click to expand...
I also get this issue while phoneniggering on Safari - infinite "Challenge expired or invalid. Retrying..." until it 403s, turning my phone into a mini Elliot Dong-Gone. The conditions to achieve this are quite predictable. It happens when I have the Farms open on a tab and Safari kills it to save memory. When I come back to the tab, the page reloads and it will probably hit a challenge loop. Refreshing the page fixes it inconsistently, otherwise it 403s.
 
Iodine said:
I also get this issue while phoneniggering on Safari - infinite "Challenge expired or invalid. Retrying..." until it 403s, turning my phone into a mini Elliot Dong-Gone. The conditions to achieve this are quite predictable. It happens when I have the Farms open on a tab and Safari kills it to save memory. When I come back to the tab, the page reloads and it will probably hit a challenge loop. Refreshing the page fixes it inconsistently, otherwise it 403s.
Click to expand...
I'm using brave. The solution for me was to enable third party cookies.
 
Hello, will source be released for this? I've been trying to update RuSneedChat for a few weeks now, and I'm kinda at the end of what can be accomplished from 1-sided poking of tartarus.
 
Sperg_rancher said:
Hello, will source be released for this? I've been trying to update RuSneedChat for a few weeks now, and I'm kinda at the end of what can be accomplished from 1-sided poking of tartarus.
Click to expand...
Tartarus itself provides the algorithms in 3 different languages. It took me maybe an hour to hook it into a shell script with curl to be able to scrape the MATI site for the transcription project(Sorry Null, the shitty wordpress not sending Last-Modified means it still pulls down the html every time). I can't imagine it's that hard in a "Real" language.
 
DavidS877 said:
Tartarus itself provides the algorithms in 3 different languages. It took me maybe an hour to hook it into a shell script with curl to be able to scrape the MATI site for the transcription project(Sorry Null, the shitty wordpress not sending Last-Modified means it still pulls down the html every time). I can't imagine it's that hard in a "Real" language.
Click to expand...
no, that was easy.
The hard part is using the token for cross-stack operations. If your TCP/IP + TLS + HTTPS signature does not match the solver exactly, tartarus rejects tokens. Good luck taking a token from your HTTP library and using it with your WS library (what's that? you pinned your OpenSSL version in both? don't matter, token rejected, NEXT!)
 
Sperg_rancher said:
no, that was easy.
The hard part is using the token for cross-stack operations. If your TCP/IP + TLS + HTTPS signature does not match the solver exactly, tartarus rejects tokens. Good luck taking a token from your HTTP library and using it with your WS library (what's that? you pinned your OpenSSL version in both? don't matter, token rejected, NEXT!)
Click to expand...
I'll just assume the user agents and everything match and you've turned on debug to make sure all the headers line up and it's something stupid in how ws(s) vs http(s) is calling OpenSSL.
 
DavidS877 said:
I'll just assume the user agents and everything match and you've turned on debug to make sure all the headers line up and it's something stupid in how ws(s) vs http(s) is calling OpenSSL.
Click to expand...
I thought so too, so I switched both to RusTLS (rust-native implementation of TLS), and it would appear that they both call in more or less the same way..- in fact I can get https://tls.peet.ws/api/all to match ja4s between the two.. I think there's some other ingredient though in tartarus.
In any case it's 99% a misconfiguration somewhere... I'm not sure where to look now as to where specifically.
 
Null said:
A big discovery with this project is that not all servers are made equally and our diverse topology causes a lot of fucking headaches in terms of understanding why certain servers shit themselves.
Click to expand...
Out of curiosity, does Tartarus have server resource or concurrency issues? During a side project I came across an esoteric, hand-rolled PoW server implementation, built for high concurrency and fault tolerance. Tartarus is running very snappy these days, if you already beat this issue then nevermind.
 
Harvey Danger said:
Out of curiosity, does Tartarus have server resource or concurrency issues? During a side project I came across an esoteric, hand-rolled PoW server implementation, built for high concurrency and fault tolerance. Tartarus is running very snappy these days, if you already beat this issue then nevermind.
Click to expand...
it was resources at the time i wrote that.
 
Null said:
There is still rate limiting, but when you go over the limit, you will be presented another DDoS retarding page instead of a 429 error that will last several minutes.
Click to expand...
Are there any plans from you to adopt anonymous rate-limit credentials going forward, by any chance? I predict wide adoption for this in the coming years.
 
Null said:
Never heard of it but on its face it looks like mainstream adoption of the PoW systems that Haproxy-prot/KiwiFlare and then TrannyNubis popularized.
Click to expand...
If it gains truly mainstream appeal, I can see a future in which browsers (*edit2: actually I'm retarded. Not browsers, third party services.) generate these tokens and whatever service (tartarus in this case) does bot detection based on associated token metadata (i.e. how many times a token was used in the past X minutes across the same/different websites). Should be reasonably straightforward to truly prevent DDoS after that. Assuming I understand the protocol correctly

Edit: In this case, throttling would happen for instance if a token is requested but none is given (attackers theoretically wouldn't have the ability to generate infinite signed/attested tokens), or if a token is requested and a token is given, but that token is past whatever rate limit.
 
Last edited:
Last edited:
It is in-development security software so it's not public at the moment.
 
Seems to me that to be a DDOS provider... well, to block them is going to require strong partnerships with upstreams.

Trying to tank a DDOS by buying a bigger port is just going to be a race.

On the other hand, if you can partner with Equinix(as an example, I'm sure they won't talk to you) and get them to give you an API where as you detect compromised IPs you send a message and they just start dropping that IP at their edge. It would be to their benefit so it's not transiting their network to whichever POP(s) you're hosted in. I'm sort of assuming the carrier grade routers in use could handle a block list in the thousands of records. Obviously an extension of that is to help them make sure the API targets adding the block rules only at the edge routers being impacted. And then code to clear the blocks, possibly using the drop counters on the edge routers to see when that bot is no longer causing problems.
 
I suppose this is more of a XenForo issue than a Tartarus issue, per se, but I just finished writing a long post less than 5 minutes ago, hit "Post Reply" instead of "Preview" since it was markup-free text, and it discarded my post because my Tartarus token had expired. I reloaded the page and, after solving a Tartarus challenge, found that the last autosave only had about 20% of the post. I was already used to the annoyance of occasionally having to refresh in order to set a bookmark or like a post after a couple of silent failures, but losing 80% of what I wrote stings a lot more. As a workaround, I'll start copying posts and pasting them into a text editor before attempting anything, so that I can paste it back in if anything goes wrong, but it would be nice if there were some sort of way for client-side Javascript to detect expired tokens and either solve the challenge without going to a Tartarus screen, or at least popping up a dialog to let you know to either refresh to bookmark or like, or else open another tab to solve the challenge in if you were trying to post.
 
Been getting a lot more "failed to submit solution" errors on mobile.

Figured the PoW difficulty target might've been cranked up due to the DDoS and it's too much for my poor old phone.

Lately, though, it gives me the error, and then upon reload immediately gives me the requested page like the challenge was successfully completed.
 
Tartarus seems a bit doolally at the moment. It keeps wanting to recheck my browser every couple of minutes, and the PoW fails first time round every time. However upon refreshing, instead of attempting the PoW challenge again, the forum carries on as if nothing happened... for about a minute. Then rinse and repeat.

Tested this on both Firefox and Brave, does the same thing irrespective of which browser I use.

nvm seems to have resolved itself
 
Last edited:
@Null

Hey boss could you maybe ratchet down Tartarus a wee bit? I can't get through to the site on either my phone or my tablet, I just get stuck . And I do most of my best posting on the shitter.

please?
 
Hey guys. I tried finding the source code for Tartarus but it didn't seem to be available. This page says there's a repo here, but the URL 404s. Anyway, my understanding of Tartarus from what I was able to gather by looking at the network tab of the browser and from some pages I found online about it indicates that it supports sha256 and argon2 for proof of work. Neither of these seems ideal imo. Argon2 is memory hard and ASIC resistant but places a computational burden on the verifier that sha256 doesn't, which I assume is why you're not using that already, and sha256 is easily verified but parallelizes very well even with a shitty GPU.

I propose and have built a demo of a similar system to Tartarus but which uses cuckoo cycling. It's memory hard, doesn't favor GPUs, and is trivially verifiable, so seems to check all the boxes that you'd need to to improve this system. The tl;dr of how it works under the hood is that the server sends you a seed which your browser uses to generate a bipartite graph with a given set of edges between its nodes. From that, the browser first trims edges that don't fit into a viable cycle, then, with the nodes and edges that remains, randomly jumps between them until it finds a cycle such that you take N steps from a given starting point and end up back at the same starting point.


The main downside here, I think, is just that this isn't really all that battle-tested. It's used by a handful of very small cryptocurrencies as their proof of work but it is not clear to me how effective this would be against dedicated psychotic trannies. I've personally been trying for a while to optimize solving speed to claim some of the open bounties John Tromp has put out, but I'm just one autismo, after all

If this interests you let me know and I can either upload the source for this, or help implement it into Tartarus directly if you've got a repo you can add me to

I originally posted this in the "talk to staff" section, but nobody seems to have viewed the thread, so I'm posting it again here in hopes that it helps with the recent DDOS issues.
 
You must log in or register to reply here.
Back
Top Bottom