20% of requests for Wikimedia Commons are for one image of a flower

https://phabricator.wikimedia.org/T273741

by IfOnlyYouKnew • 5 years ago

1388 362 5 years ago

phabricator.wikimedia.org

dr_dshiv• 5 years ago

This happening now! Some suspect a failure in a CV training pipeline. Others suggest an extremely popular app with a hotlinked image.

magicalhippo• 5 years ago

If it was my site I'd replace the image with goatse and see who complains, but I guess that's a bit drastic for Wikimedia.

waheoo• 5 years ago

I'd give them a pass.

ISL• 5 years ago

Even just serving a giant blinking red X gif to 10^-6 of the requests might be sufficient.

Only 10^-6 of the "legitimate" requests would be affected, but a whole lot of the "undesireable" requests would see it...

hinkley2• 5 years ago

Tarpit the image and it will take care of itself.

Same advice I gave a w3c.org admin who was lamenting how much traffic people generate by not caching xml schemas. Yes, you have to serve the requests. But you don't have to try to serve them in 100 ms. If a human is on the other end, 1-2 seconds is just fine. If a human is not, then the human will surely notice when their batch process goes from 3 minutes to 10 minutes because it fetches the same schema 200 times.

Clewza3132• 5 years ago

It can't be a training pipeline, because the IPs are all around India.

Sample code from Stack Overflow being used by some major app is the most likely candidate. It's also possible that the image fetch call is a vestigial appendix that doesn't even display the image, which will make tracking this down extra challenging.

eli• 5 years ago

Perhaps a very inefficient “check if we have working internet access” routine.

rootw0rm2• 5 years ago

i hate it when vestigial appendices go awry. pretty sure the evidence is mounting, however

IfOnlyYouKnew• 5 years ago

Wikimedia is unique in running some of the most popular websites with open access to almost all systems. As someone who has never been on the inside of FAANG, I found it rather interesting to browse around the backend infrastructure.

See, for example, their statistics at https://grafana.wikimedia.org/d/000000102/production-logging...

ShakataGaNai• 5 years ago

Wikimedia's infrastructure is radically different than most FAANG.

In large part because 99% (+/-) of their traffic is read only. While Facebook and Google have to do heavy workloads for every click and action taken on their services, Wikimedia can cache basically everything. Allowing them to operate on a tiny fraction of the number of machines (and infrastructure) that the rest of the players do.

Retric2• 5 years ago

You can do quite a bit of processing per page load without issue. Facebook and Google just take it rather past that point into near absurdity, while still being highly profitable.

ashtonkem• 5 years ago

They also have looser latency SLAs. The only hard requirement is that a user can read back their own writes, but it’s okay if other users are served stale data for a few seconds or minutes even. This makes cache invalidation, one of the most notoriously difficult and expensive operations at large scale, much much easier.

nostrademons3• 5 years ago

Search is also largely read-only. The advantage Wikipedia has is that its traffic overwhelming goes to the head of the page distribution, so simple caching solutions work very well. Google has a pretty extreme long-tail distribution (~15% of daily queries have never been seen before), and so needs to do a lot of computation per query.

anang• 5 years ago

Wikimedia also has less incentive/drive to meticulously track every interaction on their pages. The level of tracking present on Facebook and Google has to be extremely computationally intensive.

_joe3• 5 years ago

This is indeed correct. Wikimedia overall uses less than 2000 bare-metal servers, so yes the infrastructure is tiny compared to those.

What can be interesting, I think, is that you have a completely open infrastructure that has to solve problems on a global traffic scale.

If people are interested in knowing more, I suggest you also take a peek at the wikimedia techblog, specifically to the SRE category https://techblog.wikimedia.org/category/site-reliability-eng... and the performance one https://techblog.wikimedia.org/category/performance/

dalbasal5• 5 years ago

I agree. Another (no contradiction) way of looking at this is that Wikimedia infrastructure is radically different because Wikimedia is radically different.

They need it to be a certain way in order to operate. The limitations and advantages of how software gets made. Why it gets made. The way the software works. How and why product decisions were made over the last 2 decades. What resources they have/had available. It's all a totally different game. Not surprising that different soil and a different climate grow different plants.

One of Google's early coup d'etats, when they were a strategic step ahead of the boomers, was bankrolling gmail, youtube and such. Gmail offered free giant inboxes. They got all the customers. This cost billions (maybe 100s of millions), but storage costs go down every year while the value of ads/data/lock-in and such go up every year. Similar logic for youtube. (1) Buy a leading video-sharing site; (2)bankroll HD streaming because you have the deepest pockets (3) Own online free TV entirely.

That's who Google is, good or bad. How funding works. What products get built. What infrastructure is necessary, possible, affordable. All interlinked. Wikipedia & Google were founded at the same time. Within 5 years (circa 2006) Google was buying charters and fiefdoms. Wikimedia, meanwhile, was starting to take flak for raising 3 or 4 million in donations.

It's kinda crazy that Wikipedia is comparable in scale to FAANGs when you consider these disparities.

MaxBarraclough• 5 years ago

Does it hurt their caching if you browse Wikipedia when signed in?

I recall reading HackerNews used to have that problem, unsure if it still does.

np_tedious• 5 years ago

I have, and this is is still fascinating. Got any more links you'd suggest?

tassu2• 5 years ago

https://media.ccc.de/v/36c3-73-infrastructure-of-wikipedia

dalbasal5• 5 years ago

In interviews with Jimmy Wales, he seems somewhat regretful of not having made Wikipedia a for-profit. At the least, he's fairly adamant that Wikipedia could have been Wikipedia as a for profit.

The way he structured wikipedia, from back-end infrastructure to ownership/governance structure was just the logical way of doing the project. Times were different. Online culture was different.

I don't want to overinterpret the man, or put words in his mouth... but... I got the impression that Wales thinks that if he was starting Wikipedia now, he'd just do it asd a startup and also succeed.

To me, this is almost sad. Besides being an awesome encyclopedia, wikipedia is existence proof for something of scale outside the norm. Something that isn't a corporation. A lot of things are deterministic to the structure of an organization.

For example, take the current postpostmodern war over truth and stuff: platforming/deplatforming, freedom of speech, censorship, bias, manipulation, narrative = power issues, etc. Wikipedia is at the very centre all these problems. Whatever difficulties Twitter is experiencing should be 100X worse for wikipedia. Meanwhile, Wikipedia is withstanding far better, and with far more integrity. I don't think this is a coincidence.

Dunking on wikipedia's budget/spending is popular. Meanwhile, Wikipedia uses <1% of the resources/budget of Twitter. They are operating @ >100X efficiency compared to a realistic for-profit equivalent. That's a flying shuttle.

We know that Wikipedia, Linux & The Worldwide Web are possible because they exist. We literally wouldn't know otherwise. Theory couldn't have gotten us to this knowledge. Each is existence proof for other ways of doing things. They aren't necessarily roadmaps, but I'm a big believer in existence proofs. What Jimmy made is 100X better, more important and non-inevtiable than what Zuck made. The thought that he wants to be Zuck bums me out.

nolok• 5 years ago

It would succeed the same way Quora does. Much less open, much less universal, much more user hostile, with an almost agressive way to deal with unlogged user.

In terms of financial and organisational success it would probably largely beat what it is now. It terms of benefit to humanity, it would be much worse.

Company + for profit + laws means access to information has to be much more tailored to the laws of each place. "Let's remove tianamen's article or lose your chinese license" kind of things.

I'm for one am glad for the current wikipedia we have, despite it's numerous flaws. I still donate every year, although I wish Wales could stop having it spend its money the same a startup or FAANG does.

Vinnl• 5 years ago

I can also imagine that he'd say that just because it makes him look/feel better, i.e. it's more of a sacrifice if he gave it for free while he also could've been a billionaire, than if this was the only way Wikipedia could ever have been a success.

Then again, WikiTribune was a for-profit.

BlueTemplar8• 5 years ago

Yeah, the Web was quite impressive (though we already had the Minitel), but it was Wikipedia that really blew my mind (even though we already had Encarta). (In fact I consider Wikipedia to be the Web's "killer app", even more than Google and other search engines were.)

dmurray• 5 years ago

20% of Wikipedia Commons requests to their Singapore servers (EQSIN), not globally. That's still a lot, of course.

reaperducer• 5 years ago

90,000,000 requests a day. That's some flower.

gumby2• 5 years ago

Given that they are coming from India it could be 90M single daily requests!

ceph_• 5 years ago

Would an AsterNovi-belgii-flower-1mb by any other name smell as sweet?

Havoc• 5 years ago

Clearly the bestest flower though

labster• 5 years ago

Replace it with an image saying: “If everyone who sees this flower donated 100 rupees to Wikipedia, this fundraiser would be over in 6 hours.”

BugsJustFindMe• 5 years ago

And of course, now that the image is linked in the report, I've just added an additional request for it by clicking.

Wowfunhappy• 5 years ago

With the amount of traffic its apparently getting, HN probably won't make a big impact. Plus, most of us aren't in India, and most of us have normal user agents.

tchalla• 5 years ago

Could it be the "Good Morning" like greetings on WhatsApp gone viral ?

https://www.wsj.com/articles/the-internet-is-filling-up-beca...

Clewza3132• 5 years ago

No, because the images for those are stored by WhatsApp, not hotlinked from Wikimedia.

mabedan• 5 years ago

That’s a good one! Maybe an app which generates this you’r type of image has this flower as one of their sample images in a list which it preload on startup

m4633• 5 years ago

The "traditional" way of fixing this would be a goatse.cx redirect of the image.

I'm sure there is a more enlightened fix.

mey2• 5 years ago

A permanent redirect to a non-image page (owned by Wikimedia) may achieve the same thing. Either the calling system can't support a HTML response, or it's a webview in which case you could either report an error or provide a notice. Maybe even ask for donations :)

ed25519FUUU2• 5 years ago

Or just downsample the image to a reasonable size and deal with it. Nothing inherently wrong with having a popular image.

sangnoir2• 5 years ago

...or sending that image[1] jwz sends back upon detecting HN in the referer. I bet they'll find the app in a matter of hours, or at least reduce the traffic drastically.

1. https://www.jwz.org NSFW!

bzb6• 5 years ago

This makes me wonder why the hell referer headers are still sent by major browsers, especially to third parties. I can’t think of a single reason that benefits the user.

sli• 5 years ago

All I get is a scrolling hex editor looking thing. Maybe that redirect has been disabled?

lxe• 5 years ago

Just learned that this person owns DNA Lounge (and pizza?), and is a founder (early contributor?) of Netscape and Mozilla.org. I've lived and worked in that particular area of SF for years and haven't known this.

Dylan16807• 5 years ago

I think he's the only one that uses that? Barely even worth mentioning in comparison.

murph-almighty• 5 years ago

For those reticent to click on their work computers but morbidly curious, can someone describe the image?

chrisjarvis• 5 years ago

To the people who didn't grow up with 4chan: do not search for this image, its pretty disgusting.

pengaru2• 5 years ago

4chan didn't even exist yet when goatse emerged

walrus012• 5 years ago

goatse signifiantly pre-dates 4chan

ArchOversight• 5 years ago

It's interesting that you equate goatse with 4chan! I'm old :-(

eyelidlessness7• 5 years ago

To the people who grew up before 4chan, pls don’t mention tubgirl

xwdv2• 5 years ago

what is it?

isatty• 5 years ago

Fairly sure you’d get goatse’d more often on Efnet etc back in the day

askvictor• 5 years ago

s/4chan/slashdot/

bawolff• 5 years ago

Why does it need to be fixed? The mission of wikimedia is to serve educational content.

Edit: this is a bit unfair, if its a specific app they should be convinced to cache just to avoid unfair resource usage, but hotlinking in general should not be seen as a problem

unreal37• 5 years ago

Presumably they are paying for the servers/bandwidth to support that, and that money is coming from donors.

It's a waste of donors money if someone is using this image as some kind of "is this thing on" test using hacked computers...

_joe3• 5 years ago

Any for-profit entity hotlinking Commons is unfair. Heck, they have the right to redistribute freely the image as they see fit, instead of consuming resources that are a common good.

But this goes beyond that - it's some blind check of internet connectivity for the app, and doesn't get shown to the user. We're pretty sure of that, given that with the amount of noise that task generated, if there was an app featuring that image at least one of the ~ 90M daily "views" would've been someone reading these posts.

Now, given we want to be nice, we didn't just blindly block the traffic, although making requests without user-agent is against our UA policy https://meta.wikimedia.org/wiki/User-Agent_policy

walrus012• 5 years ago

This is exactly what I used to do about 17 years ago.

peterkelly• 5 years ago

This, perhaps disturbingly, was my first thought upon reading the issue.

Things were done very differently back in the day. This problem would have been fixed real quick.

jessaustin2• 5 years ago

A red flower rather than a lavender one.

jobigoud3• 5 years ago

If it's just used internally by an app to test connectivity as suggested in another subthread, this wouldn't solve the problem.

ChrisMarshallNY• 5 years ago

Like so?

http://ascii.textfiles.com/archives/1011

BlueTemplar8• 5 years ago

Brilliant.

newsclues• 5 years ago

Example code that gets copy pasted into production app somewhere?

rovr138• 5 years ago

Possibility and linked in a couple places. They found examples

gertlex• 5 years ago

After realizing "wiki[p|m]edia" and "flower" triggered a specific image in my head I was guessing it would be a yellow flower, this one in the corner of https://www.mediawiki.org/wiki/MediaWiki but nope, more interesting than that!

doovd• 5 years ago

Same here dude. Was sad when it turned out NOT to be the yellow flower!

jakoblorz• 5 years ago

Yes OMG! Didn't expect this one

astrea2• 5 years ago

My initial thinking is it's in some flower recognition dataset.

stevefolta• 5 years ago

Or it's India's canonical non-hotdog.

bpicolo2• 5 years ago

Huh, I worked on a site with a similar issue in ~2019. A massive flood of traffic for a single site from Indian mobile apps (~15kqps at peak iirc).

I think it ended up being a sort of mobile-based botnet with a bizarre target, which luckily was deduced from some of the headers sent (they all had a random common header).

downrightmike2• 5 years ago

Saw a story recently that Indians were bringing down the internet because of sending good morning messages: https://www.wsj.com/articles/the-internet-is-filling-up-beca...

I'd bet that this is the flower of the week for them.

nso• 5 years ago

Says it's been going since last June.

smcl2• 5 years ago

What's "kqps"? It's obviously kilo-{somethings} per second, but I don't know what the {something} would be

edit: queries?

bpicolo2• 5 years ago

Yep, queries

dailypeeker• 5 years ago

15000 queries per second

m3kw9• 5 years ago

Maybe some sort of social network using it as the default profile pic and isn’t caching

blunte• 5 years ago

And now thanks to this HN post, 21% of requests are for that same flower!

HotVector2• 5 years ago

HN ain't that big

Mattwmaster58• 5 years ago

I was curious what the actual amount of requests HN would have to muster, and with a frequency of 90,000,000 reqs/day, HN would need to hit it with 4,500,000 requests.

aaron695• 5 years ago

It seems like it started on the 2020-06-09

https://pageviews.toolforge.org/mediaviews/?project=commons....

blurbleblurble• 5 years ago

Tragedy of the commons

scrps• 5 years ago

They didn't mention if the 90M requests were unique, perhaps some app doing background refresh and not caching that image?

bombcar2• 5 years ago

I had some random images on a web server years ago - and noticed that something like 99% of my traffic was one image - and searching through refers I realized I was the #1 hit on google images for robot attack cat.

Simpler times.

Tijdreiziger• 5 years ago

Can we see the image? :D

ConcreteGidget• 5 years ago

Yes, but only 10 million times.

bombcar2• 5 years ago

https://imgur.com/8MMET5V - now there are companies that can host things FOR my servants!

guessbest• 5 years ago

You got to have hotlink protection on when you are hosting memes. I've learned this the hard way, too.

globular-toast• 5 years ago

Remember when some sites would send you a shock image instead of the one you were expecting if it detected hot linking? I don't miss that.

berkes2• 5 years ago

I had a similar issue. Some 15+ years ago, an image from my blog showed up for people who searched the phrase 'Peanubutter Sex'. The image had nothing to do with peanutbutter nor with sex. My blog is SFW. It was some screenshot of KDE IIRC.

For almost a week it remained the most requested image the post on which it appeared, the most popular.

It did make me uncomfortable, though. Fearing that my rankings would plummet or so.

My takeaway is nothing new: there are weirdo's online.

kristianp2• 5 years ago

So where did the connection between "Peanubutter Sex" and your blog come from? Did you ever find out?

crazygringo• 5 years ago

I'll just be looking forward to the follow-up post on HN announcing when they figure out what the culprit was!

Per the comments, right now the top suspect seems to be the app "Josh" or another TikTok clone because of how traffic surged immediately after the TikTon ban:

https://twitter.com/bwaber/status/1358915338637873154

nos4A2• 5 years ago

Perhaps they can replace the image with an obviously wrong image (and smaller in size), and then wait for someone to complain

mlester• 5 years ago

anyone check if it's stegnography?

dane-pgp• 5 years ago

Nice idea, but if it's getting 90 million requests per day, then either there are a lot of people requesting the same message (so it's not very secret), or the few people requesting it are very forgetful (in that they have to keep re-requesting the same message multiple times per day).

I suppose the contents of the image/"message" could change every day, but presumably that would be very obvious in the edit history of that file[0], unless Wikimedia Commons were suppressing the fact that the file is constantly changing. If they are part of the conspiracy, though, you'd think they would have taken down the task from Phabricator too.

[0] https://commons.wikimedia.org/wiki/File:AsterNovi-belgii-flo...

eyelidlessness7• 5 years ago

You gotta respect the suggested approach to take preventive measures by banning requests to this individual image without a User Agent header and to try to identify who might be affected. I’m sure I’m not the only one here who would just treat it as abuse and ban without followup.

andrewmatte• 5 years ago

90M requests daily from India? I wonder if KaiOS is checking whether it's got internet access.

astrea2• 5 years ago

I wonder how much additional traffic this investigation brought said image.

mark-r• 5 years ago

Reminds me of the time Netgear routers were hardcoded with the IP address of a NTP server at the University of Wisconsin. https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse#Ne...

fomine3• 5 years ago

I also remembered accidental Snapchat's NTP pool abuse.

https://community.ntppool.org/t/recent-ntp-pool-traffic-incr...

ramraj07• 5 years ago

I'm in India now, is it possible for me to install some traffic snooper and monitor if any wikimedia requests go out? I can then install some popular apps and see if anything bites!

Wingy• 5 years ago

mitmproxy :)

batch123• 5 years ago

Superficial reversing shows that the ravn app mentioned, com.app.rcn may use the file as part of a speedtest:

com.app.rcn/smali/com/app/rcn/utils/InternetSpeedCalculator.smali: "hxxps://upload.wikimedia.org/wikipedia/commons/1/16/AsterNovi-belgii-flower-1mb.jpg"

edit: defanged the link to maybe save the wikimedia team some bytes

tomglynch3• 5 years ago

Just added this comment on the issue:

Hi all, I've been doing a bit of research into possible apps that could be causing this and found two potential culprits that I am currently investigating.

The first is Mitron TV, an Indian TikTok alternative which was made available again on the app store June 6th (https://indianexpress.com/article/technology/tech-news-techn...).

The second is Say Namaste, an Indian Zoom alternative which was launched on the app stores June 9th (https://indianexpress.com/article/technology/tech-news-techn...).

Both fall into the timeline of huge increases, have millions of users and may be using '1280px-AsterNovi-belgii-flower-1mb.jpg' to check the users internet connection - especially for Say Namaste to ensure video connectivity. I've reached out to some developers at both companies and will report back. Let me know your thoughts.

EDIT: I have also noticed the dates match the reopening after lockdown for the whole of India: "This first phase of reopening was termed as "Unlock 1.0"[13] and permitted shopping malls, religious places, hotels and restaurants to reopen from *8 June*." (https://en.wikipedia.org/wiki/COVID-19_lockdown_in_India#Unl... )

Tom

batch123• 5 years ago

Based on this, I just reversed both Android apps and am not seeing strings related to wikimedia nor asternovi. This doesn't mean it's not obfuscated somehow though. The only app I've found the strings in so far is the "ravn" app proposed by @taviso. As mentioned in the twitter thread though it doesn't seem to have the install base to cause this traffic--

tomglynch3• 5 years ago

Thanks batch12. In my edit, it could also be related to a check-in app used at public spaces in India - as it increases from the 8th of June which matches when the India-wide lockdown began to lift. Perhaps a reverse of qr code scan checkin apps in India could be useful?

catlover992• 5 years ago

I took a look at the apk and noticed this in the manifest. "com.blockeq.stellarwallet.WalletApplication" Stellar Lumens is a fairly popular crypto currency. I wonder if the app has built in support for crypto transactions. If not, maybe it's malware to mine crypto coins.

https://i.imgur.com/o8DllVd.png

thetanil• 5 years ago

As far as I know, this is also an image commonly used in machine learning tutorials for image classification of species of flowers. I don't know if the tutorials use the mediawiki source directly though. I do recognize this image though. I think it's in the SciKit Learn O'Reilly book.

dayze• 5 years ago

Sukhbir Singh just commented: Thank you everyone for the comments and suggestions. I just wanted to share that we have identified the app and will update this task tomorrow. (And yes, it is a mobile app.)

NKCSS• 5 years ago

Would be curious to get the full story :-/

audiometry• 5 years ago

it's at the bottom of the linked case.

owlninja• 5 years ago

>Thank you everyone for the comments and suggestions. I just wanted to share that we have identified the app and will update this task tomorrow. (And yes, it is a mobile app.)

Looks like we will know soon.

shp0ngle• 5 years ago

According to the comments, it's probably an Indian TikTok clone that checks internet connection by downloading the picture.

Codesleuth• 5 years ago

Now you just need to draw attention to it further by posting it in hacker news. I'm sure none of us are curious to immediately see the picture.

Zaheer• 5 years ago

What's the right way to solve for this generally? A CORS policy wouldn't be effective since it's not a browser requesting the image.

Ayesh2• 5 years ago

It's likely that the consumer doesn't even display that image. It's probably a dry 1mb download test.

Most indian ISPs, even mobile ones are extremely cheap to not matter a 1mb.

speedgoose• 5 years ago

If the image is not displayed and the stack can handle a lot of tcp connections, perhaps a reverse http slowloris attack : you send the image response headers as slow as you can to keep the tcp connection open but to make the receiver waste its time.

If it's a speed test, they will eventually use another image.

jacquesm8• 5 years ago

At the height of the browser wars I once woke up to Microsoft hotlinking a small button for downloading our software from the MSN homepage. I tried to reach someone there for hours but nobody cared enough to do something about it. The image was small (no more than a few K), but the millions of requests that page got were enough to totally kill our server.

Finally, I replaced the image on there with a 'Netscape Now' button. Within 15 minutes the matter was resolved.

snoshy• 5 years ago

The old school response, weaponized without being inappropriate.

rattray2• 5 years ago

That's hilarious!

Did they continue to link to your software after that? (I'm curious - what was your software?)

jacquesm8• 5 years ago

Yes, they did, they actually thought it was quite funny. They even cached the actual download once they realized we wouldn't be able to deal with that either. The software was the first version of the public peer-to-peer webcam software I wrote:

http://web.archive.org/web/20000510010712/http://www.camarad...

rdescartes• 5 years ago

One of my friends used the same strategy to block DDOS from China : just put "Falun Gong" on there and it was resolved instantly.

himinlomax• 5 years ago

I remember someone doing that with the goatse picture. The hotlinker was pissed and all sorts of amusing drama ensued.

thaumasiotes• 5 years ago

One of my friends used the same strategy to block DDOS from China : just put "Falun Gong" on there and it was resolved instantly.

...because attacks from China are horrified at the thought of disrupting Falun Gong?

panpanna• 5 years ago

According to the article IPs downloading this image come mostly from India.

So replace it with the pakistani flag to solve the problem (or start WW3)

aembleton2• 5 years ago

Back around 2002, I had a pdf icon on my website. It got deep linked by a few others but the number one source of traffic came from the website of a lawyer who specialised in intellectual property. There was something on there about how it was illegal to deep link.

I was tempted to replace with goatse but I think I just changed it to a screenshot of his website saying that it was illegal to deep link.

It soon got changed.

jacquesm8• 5 years ago

That's a neat example of recursion :)

gumby2• 5 years ago

Even though it's not illegal!

lobf• 5 years ago

I honestly don't understand the issue- he linked to a specific page? What's the problem?

failrate• 5 years ago

We used something like this technique back in the Flash days. Sites would straight up steal your games, so one defense was to have the game grab its sprites from a server local endpoint. Thieving sites would get either no graphics or deliberately corrupted graphics.

emag• 5 years ago

Around...2005? 2006? I discovered someone had deep-linked to an image on work's webserver, where I was admin (being one of the few who knew Linux).

Instead of just outright replacing the image, I set up rules in Apache to check the referer, and if it was our site, serve the correct image. Anyone else, it served up something...questionable.

Problem solved.

Lutzb• 5 years ago

In the early 2000s a friend of mine was an active seller on ebay. He shot his own product pictures and professionally designed the description pages. Soon enough his content was stolen by competing shops, hotlinking the images from his server.

Ebay didn't care. So obviously the only option was to create a script that would randomly change the images to something unpleasant (think early 2000s rotten internet content).

Good times.

rburhum• 5 years ago

so what is the app? I felt like I read a full blown novel, and the last sentence with the conclusion is missing!

Liquid_Fire• 5 years ago

we have identified the app and will update this task tomorrow

I guess we will find out tomorrow.

z3t4• 5 years ago

Just replace the image... what app/site is this? Email me at my@mail.com

andi9992• 5 years ago

Title is misleading. It is 20% of requests to the eqsin cluster located at Changi airport.

tassu2• 5 years ago

It isn't _at_ the airport, that's just the closest airport. The WMF names its clusters with the initials of the data center vendor and the closest airport's code.

andi9992• 5 years ago

True. Hahaha

wiz21c• 5 years ago

FTB (from the bug) :

You could even serve another image in its place to this UA, with some text and an email address to contact. You'd probably find out pretty quickly what it is from users of that mysterious thing. A throwaway email address is probably best

Really good idea :-)

simonebrunozzi2• 5 years ago

Here's the flower in question [0].

[0] https://upload.wikimedia.org/wikipedia/commons/thumb/1/16/As...

danparsonson• 5 years ago

Posting the very link they're trying to reduce traffic on doesn't seem like a very helpful thing to do

smcl2• 5 years ago

They were trying to figure out the root cause of a sudden uptick of millions of requests being made for a given image with no user agent or referer, presumably with a view to notifying the app responsible or figuring out a workaround.

A few thousand requests from clearly identifiable as coming from browsers and with a referer header from news.ycombinator.com would not exactly interfere with this and in the grand scheme of things isn't a huge burden in terms of network traffic.

simonebrunozzi2• 5 years ago

I bet everyone on HN would have wanted to take a look eventually.

Donckele• 5 years ago

“ Thank you everyone for the comments and suggestions. I just wanted to share that we have identified the app and will update this task tomorrow. (And yes, it is a mobile app.)”

kayxspre• 5 years ago

I remember that MediaWiki installation allowed the configuration that essentially permits the use of Commons files, albeit in that case, the file will be downloaded and cached in the Wiki's own server [1].

That being said, though the image wasn't hotlinked directly, they expressed concerns of DDOS and the possible costs the Foundation has to incur from each load (they even pointed out that it's "fair and reasonable" to point donation link to them).

I would be interested to see how the licensing issue will be handled, though. The photographer licensed this photo as GFDL/CC BY-SA 3.0 [2], and hotlinking may break the term of these licenses.

1: https://www.mediawiki.org/wiki/InstantCommons

2: https://commons.wikimedia.org/wiki/File:AsterNovi-belgii-flo...

mitchs• 5 years ago

Heh, a popular consumer electronics product a room mate worked on shipped an update that used example.com as a connectivity test. Apparently they were on pace to rack up $20k/month in server costs. At least their user agent made it obvious who to contact.

V-2• 5 years ago

"Please avoid adding drive-by comments such as "hello from Hacker News" to this task as they are not helpful. Thank you"

Why would anyone do such stuff is, as usual, beyond me...

PS. "First!"

calibas• 5 years ago

999 out of a 1,000 people know better, but when there's thousands of people...

tyingq• 5 years ago

The funny thing is, the first instance of that in the thread wasn't "hello from hacker news". It was a "hello to hackernews" from an engineer on the WikiMedia team. https://phabricator.wikimedia.org/T273741#6813995

Dumbdo• 5 years ago

And that comment was removed by the author a few minutes ago.

vultour• 5 years ago

Even more curiously, the person that did that registered an account and put up a profile picture (I assume of himself), just for that comment...

aquadrop• 5 years ago

It's not 20% of all requests, it's 20% of media requests to one of the clusters (it's said in the issue description) There are 5 clusters.

rozab• 5 years ago

This page someone noticed is very interesting.

https://newshimalaya.com/2021/02/09/%E2%9A%93-t273741-invest...

I was sure I'd seen this website before, and sure enough, it's scraping and rehosting almost everything that's posted on HN...

bottled_poe• 5 years ago

Nothing unusual here, just run of the mill online copyright violation.

BlueTemplar8• 5 years ago

Yeah, here's the unusual one :

http://n-gate.com/

fariss• 5 years ago

can this be some sort of botnet checking whether a host is connected to the internet or not?

navotgil• 5 years ago

Well... posting it here will only increase the number of requests and will make the investigation harder

ct520• 5 years ago

Well I hope they implement some good caching

ip26• 5 years ago

145kB for a connectivity check, ouch. This is a poster child for why many apps guzzle so much data.

(On a 500MB/mo plan you start noticing)

blakesterz• 5 years ago

They did figure it out, a popular chat app in India (they won't name yet) fetches the image but does not display it.

https://phabricator.wikimedia.org/T273741#6815828

airhead969• 5 years ago

Those goddamn white Hare Krishnas are in the airport again, handing out flowers no one wants.

Also: What's your vector, Victor?

Razengan• 5 years ago

Please avoid adding drive-by comments such as "hello from Hacker News" to this task as they are not helpful. Thank you.

Ironic. Dang could save himself from spam, but not others.

kazinator• 5 years ago

I would suggest that we start banning requests for this image without a UA

Why on Earth would you do anything like that, instead of just renaming the image so the URL stops working (and banning the old URL unconditionally?)

20% of requests for Wikimedia Commons are for one image of a flower

Related Stories