lucastech

Looks cool, how do you integrate it into your agent to keep the context in sync?

pretty crazy to see these sorts of worms, I think it's probably a good thing that we start to examine the "supply chain" of open source software and figure out ways to prevent this sort of attack.

Timing was definitely smart on the part of the attacker, heading into Thanksgiving in the US means a lot of people in vacation mode, probably not even realizing this is happening right now.

This should really be front page here

This is awesome, I've used offload media for years, but they've been getting more and more annoying about their plugin trying to convert to using their cdns and upgrading to their premium plugin.

I've wanted to explore R2 (I use S3/Cloudfront today) and this looks like a great way to do so!

I wrote about this back in July when this "gang" first started hitting some sites I host: https://wxp.io/blog/the-bots-that-keep-on-giving

they use a mixture of colo (M247, Datacamp, HostRoyale, Oxylabs, etc) and international residential. I suspect the latter are where those residential app proxies come into play (bright SDK, etc). Oxylabs is also a well known proxy provider, which makes me think they're the gateway into all of these IPs.

Definitely interesting times to try and host a web server!

Yeah, there are some botnets I've been seeing that are much more stealthy, using 900-3000 IP's with rotating user agents to send enormous amounts of traffic.

I've resorted to blocking entire AS routes to prevent it (fortunately I am mostly hosting US sites with US only residential audiences). I'm not sure who's behind it, but one of the later data centers is oxylabs, so they're probably involved somehow.

https://wxp.io/blog/the-bots-that-keep-on-giving

Meta Ireland is just as bad, I've noticed a lot of Tencent from SG.

I wrote about this a few weeks ago, because it really is quite insane.

I wish AWS would curtail abuse from their networks. My hope is to build some tools to automate detection and reporting of this sort of abuse, so we can force it into AWS's court.

https://wxp.io/blog/abuse-from-amazon-ip-networks-never-end

I remember dealing with a large credential stuffing attack at a marketplace right after we announced our series B ~2018. We developed some tools to keep them out through pattern matching, but it was not easy and it took some time to develop those tools.

Best companies to work with were spycloud.com and sift.com.

spycloud actually specializes in identifying leaked credentials, which are what attackers use in the credential stuffing list they go through, so you could identify "stuffable" credentials prior to the attack happening, which is nice.

sift was great at helping to just identify fraud in general, so if an account did quietly get compromised, we could identify it before the transaction was finalized.

I've been trying to track down the source of 500+ IPs that routinely hit websites that I'm hosting. Definitely interested in hearing if anyone else has experience this as well. Cloudflare does not appear to block this type of attack

I have to say, Visual Basic 4.0 changed my life when I was introduced to it at the age of 12. I had written Basic before that, but being able to build drag and drop create a GUI on top of my code was what really hooked me on programming. I built and sold my first desktop application at 14 that I wrote by myself in VB6 and used VB6 for all of my jobs through 21 when I had to upgrade a VB6 application to C#.net.

I often harp on how much I wish someone would build a simple GUI for the modern desktop or web environment, instead of spending ages fighting css and javascript for even the most basic layouts. Visual Basic just removed all of the complexity, nothing filled that gap before VB or after VB. Sadly, even VB these days is a mess ever since winforms stopped being the primary target interface.

Thank you for what you built, I've been writing code for 26 years now as a direct result of it.

I really like this idea. I've wanted to build something to bring startup/remote work people in my area together for a while. I bought a few domains but couldn't figure out the hook. Smart idea to build it as part of the HN userbase, since that is the userbase you want for something like this!

Great work

You would probably appreciate the Nomad List community: https://nomadlist.com

This feels very timely, as I just encountered it yesterday.

The steps I took were:

1. backup production before making any changes

2. import the production backup locally

3. test the script locally, QA the result to ensure desired outcome

4. repeat 2-3 until you feel confident that you're able to consistently get what you need from the script

5. wait until a low volume time for your platform (if possible), run a backup, import and test 1 more time locally, apply the change in production

However, after doing this, a coworker noticed something we had missed when QAing the data. As a result I had to revert the changes, I had a rollback query ready to restore the modified records.

As part of the planning for this, I added a new column to the table in question to track if/when a fix was made to the record. This allowed me to identify the records which were modified to roll them back. While this isn't always practical, it made sense long term for our situation.

A secondary option I've used in the past is exporting the table to be updated and then writing a simple script with the modifications necessary to generate the SQL to update each record individually. I've then used the same script and export to build a revert update query as well just in case something unexpected comes up.

At the end of the day, make sure you're backing up before any changes, plan ahead in case of unexpected errors so that you can revert quickly to avoid downtime instead of scrambling when it goes wrong. Test it a few times locally (change + revert) to try and sort out the issues prior to applying them in production.

edit: formatting

I agree that MS has done a terrible job at making their tools simple. I started programming using VB6 in 2002 and it was the easiest thing around. This simplicity still exists if you're trying to do winforms, but is gone if you try to do anything else.

If you're just starting out I'd recommend Win Forms + C#. WPF and all of the other gui options are insanely difficult for reasons I still haven't understood.

I made a quick video to show you how to create the app and get a simple hello world together. The drag and drop interface is great. Unfortunately virtualbox didn't record the mouse cursor (I am on OSX) so it's not as clear to follow as I had hoped.

https://wxp.io/visual_studio_winforms.webm

TenSpot.com | Senior Backend Engineer | Remote | United States Only | Full-time

Skills: 3+ years of Django experience (required), Postgres, Flask (legacy API), React/TypeScript frontend (if interested in fullstack).

Who we are: Ten Spot is the workforce engagement platform that connects distributed teams through social interactions. Our platform replicates the relationship journey between colleagues that historically happened in person, virtually. We are a remote team of engineers working to bring remote teams together!

Who you are: You’ve been building Python web API's for 4+ years and are comfortable jumping into new repositories, identifying impactful architectural changes, breaking down large projects into smaller pieces and delegating to parallelize efforts. Performance of any code that goes to production is critical. You enjoy mentoring coworkers in how to approach challenging tasks, reviewing PR’s to continuously improve the project, and don’t hesitate to reach out when you have questions. Collaborating with the team to reach consensus on important changes is key. You appreciate the value of thorough unit testing in a growing codebase.

email/apply: lucas at tenspot.com [hiring manager]

I always wonder why these systems are so poorly built, especially when I hear about how much is spent to build them.

Nice work on the script though, maybe they'll spend $10mm next year to add in the feature natively

Fitspotwellness.com | Frontend Engineer | Remote (North America Timezones Only) | Full-time | 3+ years of React experience (required), Redux, Python backend (if interested in fullstack). SCSS/HTML, Styled-Components experience is a plus.

Looking for self starters who are passionate about building products and care about UX.

email: lucas at fitspotwellness.com

OBS is great! Huge thanks to everyone who's maintained it over the years.

As a side note, I'm trying to figure out how to do live streaming with less intense CPU requirements. My use case is effectively trying to use a Macbook Air to stream high quality video (720p, 30fps). Is there any way I could stream the video raw and encode it on a VPS somewhere? Or is there just a very real hurdle of needing a beefy CPU for any live streaming?

I've looked at WebRTC a bit, but can't seem to find much in terms of how to broadcast it in a 1 to many (like Twitch, Vimeo, etc) when using WebRTC. Mux.com at least allows you to do that if you have an RTMP source stream, but I can only find web based libraries that require Flash to stream.

Is there some HTML5 camera broadcasting solution that I'm missing? Some kind of VPS software for turning WebRTC into RTMP? I'd appreciate any direction I can get on this!

Thanks

https://www.Outdoorsy.com is an Austin, Texas based company which launched the first international peer-to-peer Recreational Vehicle rental platform. Our platform handles availability scheduling, payment processing, communication, insurance, roadside assistance and more all built in. Our rapidly growing user base has taken us from the United States to Canada, Australia and New Zealand.

Our engineering team is a small group of self-starting developers who are motivated by making an impact on the lives of our users, both financially for our owners or experientially for our renters.

----

Title: Senior Backend Engineer | Remote (US preferred) | Fulltime

Stack: Golang (REST) / Postgres / Elastic Search

Buzzwords: Scaling / Refactoring / Architecture / TDD

Full Job Desc: https://www.outdoorsy.com/pdf/backend.jd.2019-01-02.pdf

----

Title: Senior Frontend Engineer | Remote (US preferred) | Fulltime

Stack: Ember 2.16+ (Ember-data + Rehydration + Fastboot) / QUnit + Mirage / SCSS / NPM

Buzzwords: UX / Performance / DDAU Components / Addon maintenance / Mobile First

Full Job Desc: https://www.outdoorsy.com/pdf/frontend.jd.2019-01-02.pdf

----

Apply: engineering@outdoorsy.com

[No recruiters or consulting firms please]

Where are they based? NY area?

I think this data speaks about the most popular languages for users of that service, I'd be curious about how many people are in their sample size. Percentages just aren't very descriptive in that sense :) Cool information though, I'm still always shocked when I see how popular Java is. Glad to see Python is slightly more popular though!

People are always afraid of what they don't understand, but to think that prosecuting or punishing people for helping prevent malicious people from finding these types of bugs is just ignorant. No ones code is perfect, and it often takes dozens of eyes before issues like this are found.

The longer people are punished for helping, the worse our "cyber security" will digress moving forward.

I went with Bootstrap, I'm not much for front end design so I just scraped together what I could as quickly as I could :)

I'd love to get feedback from other HNers about this! Thanks!