See here
I’m sorry for not simply copying the text. There is some bug, and Firefox apparently does not paste my clipboard. Essentially someone is rather smart in free-riding the public instances from the cloud instead of simply setting up a cloud instance.
Presumably there is no easy way to identify the culprits, if only to try and bring them into a dialogue?
Have you discussed this with the cloud providers?
Thank you for the feedback.
This is a first response to keep the service available. There is indeed no reliable way to get in touch with people within short time. Part of the idea of starting a thread here in addition in the status page is to make people aware of the situation, both those users that wonder why the service got brittle and those that currently over-use the service.
Things I have in the log files are amongst other things the referrer and the user agent, and both are not set to anything significant here.
It can even be that it is not a strictly coordinates use and rather an amorphous group in the sense of a modified slashdot effect. A large and inefficient approach posted on a popular channel about Pokemon Go or so could absolutely end up like what happens now.
The idea behind the eight week window is to revive the branch for the GDPR to use OSM usernames to distribute resources. That would be somewhat reliable to get a contact.
But I will also pursue further the road of contacting the cloud providers. If this goes anywhere I will report progress at appropriate times.
The prime objective right now is ensure that the service remains available to the general public.
Sollte das Thema nicht wichtig genug sein, es global anzupinnen, damit möglichst viele es lesen?
I’m still not happy with the degree of unavailability, and I’m sorry for the inconvenience it causes.
In the peak yesterday I’ve spent some time to understand patterns: there is for example a suddenly spiking interest in adiff for as far back as 2011 exclusively from a provider in Singapore. Someone using the user agent ProspectionScript/1.0 (``+contact@example.com``) (with has zero Google hits for me) looks for POIs in France in an extremely cumbersome way. Both eat up each the equivalent of about one CPU core. Other patterns exist, and it apparently is not a good idea to play whack-a-mole. In total the difference is not much more than five CPUs, but that is the delta between used by stable and annoyingly congested.
I continue to plan to introduce some kind of OSM user account based fast lane in the weeks after the SotM-EU. Details to follow then.
I think a lot of our volunteer maintained services running on donated ressources are abused too much and this is getting worse and worse.
We had to restrict usage of OSM-FR tile services and write a clear usage policy to point abusers to.
One of the requirements should at least be to have a valid referer and/or user-agent to discriminate usage. Any request without those should be rejected.
I’m dealing with that on our nginx proxy.
Do you have something similar ?
this or tyrannical blocks on missing/bad user agent/referrer would be great!
These can still be easily spoofed by anyone who’s remotely tech-savvy
so should filter out LLM-grade scripts which are most likely to be DDOSing by accident