Show HN: “HTTP 419 Never Gonna Give You Up” for bots

[gnyman]

I definitely agree bots are underserved, I have a few things I do to keep them entertained, ssh bots are tar-pitted to keep them connected but busy, my hope is that I occupy at least one thread of not the whole process.

For wp-login bots I serve them a nice chunk of random (generated by a fuzzer) html in the hopes that 1. It wastes abit of their bandwidth/memory and 2. it crashes their parser

In reality I guess bots nowadays are sturdy enough to not get stuck or crash but who knows, feels good to do something :-)

Tarpit instructions https://nyman.re/super-simple-ssh-tarpit/

Wp-login page https://twitter.com/gnyman/status/1181652421841436672?s=20

And I remembered another nice trick which someone else came up with, zip bomb the bots :-)

https://blog.haschek.at/2017/how-to-defend-your-website-with...

[SCHiM]

Although I think bots should be free to access the same content as humans do, I have a suggestion for your fuzzer anti-bot-spray:

It won't work on the more sturdy samples, but maybe try a GZIP bomb on https streams: https://www.infosecmatter.com/metasploit-module-library/?mm=...

[rexfuzzle]

There are some very cool ways of doing these tarpit. This for example: https://nullprogram.com/blog/2019/03/22/

[inside65]

I blocked almost all wp-login bots just using bot fight mode in Cloudflare few months ago along with some CF page rules to run an interstatial. It seems to losing effectiveness over time though, and since I do have WP-login, I wonder how I can implement something like your idea.

Maybe rename the legit login and put this in its place, but that would cause issues for redirects from the legit login link...

[Arnavion]

Every time I read about ssh tarpits I wish I had a reason to set up one in my VPS. Alas it's much easier to use the VPS provider's network access rules to block all incoming traffic to tcp/22 that isn't from my IP.

[gitgud]

> "And I remembered another nice trick which someone else came up with, zip bomb the bots :-)"

Just curious, is it legal to host a zip bomb on your website? I would think it would be classified under some kind of Cyber crime....

[zinekeller]

> I’m half joking, but if we can have HTTP 418 I’m a Teapot then there is enough room in the HTTP standard for the more useful HTTP 419 Never Gonna Give You Up error code.

Actually, there was a proposal to remove the 418 code formally, but in the end it was grandfathered in. Unfortunately, unless you have convinced a lot of people to allow 419, it would be not allowed anymore (even in a April Fools' RFC) according to the established protocol of IANA controlling the allocation of error codes, and IANA no longer allow "joke" allocations unless there was an RFC clarifying why that particular code must exists in a non-joking manner (see 451, in homage to Fahrenheit 451 but is the recommended code for a informed block). Even 418 was technically only reserved in such a way that allows it to be overridden in case that a good demonstration that 418 should be the code for that error.

[bigiain]

  HTTP/1.1 527 Railgun Error
  Server: Ballistic Research Laboratory - CHECMATE
  Date: Fri Oct 29 02:08:03 2021
  Connection: Keep-Alive-overridden
  Authorization: Rules-Of-Engagement-090624-2021-10-29
  Content-Type: uranium/depleted
  Content-Weight: 248kT equivalent

[chrismorgan]

The thing that really disappoints me is that 418 I'm a Teapot isn’t registered—instead it’s reserved as “(Unused)”: https://www.iana.org/assignments/http-status-codes/http-stat..., https://www.ietf.org/archive/id/draft-ietf-httpbis-semantics.... As it stands, I suspect (as one that’s been involved in a couple and examined more back in 2013–2014) that most even vaguely recent HTTP libraries that have some kind of status code enum or constants defined take their data from the HTTP status codes registry, with a single exception for 418 I'm a Teapot.

As far as a 419 is concerned, I’d argue that 418 is already suitable anyway as a joke alternative to the more serious 429/503: “wp-admin.php? I’m not WordPress, I’m a teapot!” (Similar style to the joke about one cow warning another about the mad cow disease in the area, and the other responding that it’s not not worried because it’s a helicopter.)

[anonymousiam]

Another good reason to have a 419 response code:

https://www.419eater.com/

https://en.wikipedia.org/wiki/419eater.com

[bradgessler]

One day I will make an IoT teapot. It will have an HTTP API that responds with a 418 and legitimize the code once and for all.

[unanswered]

IANA controls http codes only insofar as no one has told them to knock it off yet. There's no major interop risk from conflicting (200, 400, 500) codes in the way there is for other namespaces because the semantics are essentially contained only in the first digit.

[spc476]

I use 418 on my gopher server [1] to inform misinformed webbots that they're not talking to an actual webserver. It works remarkably well.

[1] gopher.conman.org

[Slade1]

If you're aware that someone is doing penetration tests on your system, but their probing isn't significantly costing you resources, wouldn't you instead just give some generic response to not clue them into you knowing their intention? There's a lot of people who basically do that with scam callers by just leading them on and wasting the scammers time.

[LinuxBender]

I used to do something along this line. If I saw a bot then I would use ACL's in haproxy to serve up some static pages from memory that contained strings their request was looking for. This of course attracted more bots. It didn't cost me anything aside from making my logs a bit more noisy, so I disabled logging for the bots. Then I found a funny side effect of shodan showing my nodes being vulnerable to many things. That was a blemish so I disabled the ACL's. In hind-sight and knowing how bot farms work it wasn't really wasting anyone's time or resources but was a fun little learning exercise.

[hyperman1]

Send them redirects to a russian governemental site. They'll take care of it

[Waterluvian]

Redirect to a honeypot as a service that utterly wastes someone’s time.

[t0mas88]

You could but it's extra work to build that into the application while you could use a generic off the shelf WAF / IDS type solution that just blocks them. Won't fully stop a targeted manual attack but it is enough to make bots move on to their next target. And it slows down any manual reconnaissance work.

[_jal]

I like the spirit of the idea, but messing with bots and script kiddies is best kept a highly local thing.

You don't need a standardized error code to signal to a red team, you can say "hi" in a number of different ways, depending on what they're poking at. And if everyone is doing the same thing to script kiddies, well, where's the sport in that?

[dmitrijbelikov]

https://en.wikipedia.org/wiki/List_of_HTTP_status_codes#Unof...

419 Page Expired (Laravel Framework) Used by the Laravel Framework when a CSRF Token is missing or expired.

[throwaway81523]

419 error is a Rick roll? Ridiculous. It obviously has to be a once in a lifetime opportunity from a Nigerian prince.

[lliamander]

HTTP 420 - Enhance Your Calm, could also be useful here if you are going to be explicitly rate-limiting the client.

[omgitsabird]

Method Failure in Spring.

"Shut The Fuck Up" in my framework.

[andrethegiant]

If it redirects then it should be in the 3xx class

[bradgessler]

I was hesitant on the redirect. It would probably be easier to demand the spec displays "Never Gonna Give You Up" in the appropriate requested format.

[willcipriano]

400's are errors caused by the client, I think that fits better.

[ufmace]

Probably shouldn't be made an official thing, but it'd be funny to do this on all the various minor manually-adminned sites out there.

[zeepzeep]

Just return random status codes that still render html on every page to troll bots.

https://www.youtube.com/watch?v=I3pNLB3Cq24

[nunez]

a part of me is definitely in favor of this, but another part of me wants to avoid turning http error codes into a meme

[dane-pgp]

No, this is turning a meme into an HTTP error code. You're thinking of:

https://i.redd.it/wmwqgt9kbop41.jpg

[DeathArrow]

Why not redirect the bot to fbi.gov and let them scan that?

[hoppla]

If the requirement is that client should follow the redirect, one should not use a 4xx status code. I think “319 never gonna give you up” is more adequate

[omgitsabird]

Laravel uses 419 as Page Expired:

https://github.com/laravel/framework/blob/a2c557a1b697c46292...

[dusted]

Superficially a fun idea..

Side efffects may include:

* Helping bot authors improve their bot so it won't be identified.

* Revealing how good you are at detecting bots.

[grodes]

I prefer to just return a 404 if I know for sure that it is a bot to try to cheat them

[ChrisMarshallNY]

I'll vote for that (but no one asked me). I usually use 418 for similar stuff.

[bencollier49]

I mean, technically, wouldn't this make bot scanning more efficient?