KiwiFlare

Kees H said:
I can't get KiwiFlare to trigger more than once per day, and I am a pretty agressive user I think, got a bunch of errors when we still had simple rate limiting. Since KiwiFlare was implemented I haven't had any issues with the Farms anymore, all pretty smooth sailing.
Click to expand...
When I switch device and start kf first time that day I get two triggers, and it works perfectly after that.
 
  • Agree
  • Like
Reactions: Woe-B-Gon (TM), Doctor Neo Cortex and Great Monkey King
Null said:
I cannot reproduce any issues. I really don't know what to tell people. The session lasts a full day. You are given a generous amount of connections and connection rate. I cannot deliberately reproduce multiple checks under any circumstances even when deliberately trying to abuse the system. There are thousands of people browsing the site and I'm seeing a handful of complaints. I really don't know what you're doing.
Click to expand...
I can't reproduce it either, even with my usual insane "open 100 pages at a time" practice.
 
  • Like
Reactions: Essay2414778, Super Dilator Duel 3D and murph
I’ve noticed if I turn my VPN off, then back on after having received the KiwiFlare a-ok for my device, the site becomes pretty much browsing-only. I’ve had ongoing issues with KiwiFlare, but if I just keep the VPN on this device then the site seems to work

Hopefully that’s useful for someone who knows what they’re talking about idk I didn’t read the thread
 
PoC wagner group said:
is kiwiflare only applicable for the farms or could you offer a ddos protection service for small sites in a similar position to kiwifarms?
Click to expand...
For now this is as far as it goes:
Null said:
If your site is US legal and you need assistance staying up, email me at jcmoon@pm.me with details. I am wondering what sites are out there that need help.
Click to expand...
 
  • Like
  • Informative
Reactions: Super Dilator Duel 3D, Doctor Neo Cortex, murph and 2 others
Null said:
I cannot reproduce any issues. I really don't know what to tell people. The session lasts a full day. You are given a generous amount of connections and connection rate. I cannot deliberately reproduce multiple checks under any circumstances even when deliberately trying to abuse the system. There are thousands of people browsing the site and I'm seeing a handful of complaints. I really don't know what you're doing.
Click to expand...

I’m able to reliably reproduce triggering the protection every page load by simulating certain devices and network conditions.

Possible reason:
- Upon loading the page for the first time, many requests are sent for each sticker / script / css / other resource.
- The user is on a low-end mobile phone / network, and navigates to another page before the aforementioned requests are returned and stored in the browser cache. (Or cache is too aggressively cleared due to memory constraints.)
- All the requests are sent again causing the protection to revoke the clearance cookie.


Steps to simulate / reproduce issue:
(Using Firefox or Tor Browser for demonstration)
- Open dev tools > Network > Top right > Change “No Throttling” to “Good 2G” (Optional).
- Tick “Disable Cache” (Optional).
- Navigate to any thread, from a fresh session.
- Wait for the challenge to be complete.
- (Optional) Copy the clearance cookie.
- After the DOM loads, but before the other resources do, click on the link to the next page (preferably before the page numbers even show up).
- The protection is either immediately triggered, or halfway through the loading of the next page.
- (Optional) Verify the same clearance cookie is sent, but rejected.
- (Optional) Verify the original clearance cookie is revoked.
- (Optional) Enable cache, allow the page to fully load and have all resources cached, and the issue should go away.


Possible solution:
- Serve static content that doesn’t stress the database separately, not counting towards protection throttling.

I don’t know if it’s the problem, especially since I don't know if it's actually exceeding the allowance (or what the allowance is), but it’s the only way I’m able to reliably trigger the check every load.

For incognito users:
Some browsers (notably Safari on iOS, but all iOS browsers are effectively Safari reskins) use a separate cookie jar for each new private tab, the check triggers since the existing clearance cookie isn’t sent from the new tab, and has nothing to do with the above.
 
xn--mck1c said:
I’m able to reliably reproduce triggering the protection every page load by simulating certain devices and network conditions.
Click to expand...
I cannot, following your exact instructions.

The issue you're encountering has been fixed. I specifically adjusted the throttling so that initial loads would not inherently surpass the authorization token.

The only thing I can imagine is that I didn't deploy this update on a specific service, so I am going to go ahead and manually rebuild and redeploy the latest code on every frontend.

This message was posted after the redeploy. If you're STILL encountering this issue, let me know.
 
  • Informative
Reactions: murph, Vecr, Romeo and 1 other person
Sometimes on loading it up the site breaks completely for ten minutes or so, with every single request requiring its own proof of work, which of course breaks all non-cached assets and the ajax functionality. Then it kind of balances out. Maybe that is the initial load with dozens of parallel requests triggering the throttling, calming down once most assets are cached? Stock iOS Safari

Edit: just scrolled up my theory is probably dumb since null fixed this exact case already. Or maybe it only triggers if you instantly go to a thread with many attachment preview images?
 
Kiwiflare is firing up on every single page load on my iPad. I’m on Brave, iOS 15.6. Cannot quote nor sticker anyone. No problems on anything else I use, including my phone.

I don't know much about web development, but for what it's worth, my iPad only has 3GB of RAM, whereas everything else I use has no less than 8GB.
 
Last edited:
  • Disagree
Reactions: Samuel Hyde
Pissmaster said:
Kiwiflare is firing up on every single page load on my iPad. I’m on Brave, iOS 15.6. Cannot quote nor sticker anyone. No problems on anything else I use, including my phone.

I don't know much about web development, but for what it's worth, my iPad only has 3GB of RAM, whereas everything else I use has no less than 8GB.
Click to expand...
I have the same problem some days. Other days it works fine. It seems like it has to do with the amount of time I stay on the front page. if I go immediately to my alerts, I get kiwiflare on every page open, can’t enlarge images, etc. But it seems like if I stay on the front page for a minute or two things go smoothly from there. Doing some experimenting to see if it continues to track.
 
  • Thunk-Provoking
Reactions: Pissmaster
What I'm wondering is why I'll often (not always) get the KiwiFlare page ~5-10 times rapidly on a new IP, but then it goes away after that. What changes between the KiwiFlare flurry and using the site normally?
 
  • Agree
Reactions: Great Monkey King
We've been under near-constant D/DoS attacks for the last few days. The system has mostly been able to handle it with some config tweaks, but the net was cast too wide, which was causing 429 errors. I've identified the problem and you should no longer see 429 errors.

Just now, I applied a small update to the KiwiFlare which should have a big change. I believe I have improved the system's ability to handle concurrency. I had observed that the CPUs were not pegged (meaning, they were well below 100% utilization), but there was another bottleneck, which I believe was poor concurrency causing all 48 cores to block when receiving thousands of requests a second.

In my local tests, I had previously been able to cause DDoS loads of 30,000+ requests before seeing issues. However, with the new improvement, I was not able to reproduce the issue with any number of requests before being bottlenecked by socket counts.


Edit: There's a very heavy attack that I'm using to experiment with config options.

Please report if you receive an Error 403, or Error 429, while using the website.
I need to know if you are using a VPN or public network as well. If you are using a VPN, please say which one.


Edit 2: There's still an on-going attack. If there's downtime, switching to European VPNs or Tor may help.
 
Last edited:
  • Like
  • Informative
  • Winner
Reactions: Pokemon Conquistador, Bungdit Din, The Jesus Lizard and 563 others
Null said:
We've been under near-constant D/DoS attacks for the last few days. The system has mostly been able to handle it with some config tweaks, but the net was cast too wide, which was causing 429 errors. I've identified the problem and you should no longer see 429 errors.

Just now, I applied a small update to the KiwiFlare which should have a big change. I believe I have improved the system's ability to handle concurrency. I had observed that the CPUs were not pegged (meaning, they were well below 100% utilization), but there was another bottleneck, which I believe was poor concurrency causing all 48 cores to block when receiving thousands of requests a second.

In my local tests, I had previously been able to cause DDoS loads of 30,000+ requests before seeing issues. However, with the new improvement, I was not able to reproduce the issue with any number of requests before being bottlenecked by socket counts.
Click to expand...
every time I see the words "DDOS retarding" I laugh my ass off.

how much seething do you suppose the word "retarding" is causing the wokefags? can we get some kind of a counter to measure it?
 
  • Like
  • Agree
  • Feels
Reactions: ICanLurkNoMore, Baguette-chan, GollyGad and 110 others
We still being fucked? Cuz me making new tabs to load threads before reading them gets me an error 429 like before kiwiflare.
It was bad these few days, after not getting it for weeks. But now it's just fuuuucked.

*:Forgot to add this is on desktop. I still get 429 sometimes, it's usually after nighttime that it starts getting fuckeddd
 
Last edited:
  • Agree
  • Like
  • Informative
Reactions: 820㎌Cap, pikachudidnothingwrong, LonelyEggRoll and 9 others
You must log in or register to reply here.
Back