Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (nike.apache.org: domain of pid@pidster.com designates
 209.85.215.182 as permitted sender)
References: <70C3D7FF9B194C1587F273ADE1623698@HP6910P>
 <-8374468888202311141@unknownmsgid>
 <A11B65D6015C49A0832B6AD82B735E7A@HP6910P> <516BD58F.2060207@pidster.com>
 <2AFD2E9D75D24E1FB992619D3549F388@HP6910P> <516BE951.7000106@pidster.com>
 <516C2133.8090703@ice-sa.com> <516C262F.6040007@ice-sa.com>
 <CAHjMPQzf=rBtjPSeo1+6KBv+sMGdQ9eW0c7m0ki3COvO6TrXmQ@mail.gmail.com>
 <516C359F.4030506@ice-sa.com> <20130416152152.GE13819@IUPUI.Edu>
 <516D7E93.5020006@ice-sa.com>
 <CAG6aRdWapRh+WDwH926Q8FxV7-o-k1cWA8UKyFS2UGHe452Fag@mail.gmail.com>
 <8000842584522301737@unknownmsgid>
 <10884071.5855.1366137501706.JavaMail.mobile-sync@vemw20>
From: =?UTF-8?B?UMOvZCBzdMOocg==?= <pid@pidster.com>
In-Reply-To: <10884071.5855.1366137501706.JavaMail.mobile-sync@vemw20>
Mime-Version: 1.0 (1.0)
Date: Tue, 16 Apr 2013 19:43:01 +0100
Message-ID: <-3567947474235942048@unknownmsgid>
Subject: Re: Tomcat access log reveals hack attempt: "HEAD /manager/html
 HTTP/1.0" 404
To: Tomcat Users List <users@tomcat.apache.org>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On 16 Apr 2013, at 19:38, "Andr=C3=A9 Warnier" <aw@ice-sa.com> wrote:

> P=C3=AFd st=C3=A8r wrote:
>> On 16 Apr 2013, at 17:58, chris derham <chris@derham.me.uk> wrote:
>>
>>>> Or, another way of looking at this would be that for every 40 servers
>>>> scanned without a 404 delay, the same bot infrastructure within the sa=
me
>>>> time would only be able to scan 1 server if a 1 s 404 delay was implem=
ented
>>>> by 50% of the webservers.
>>> This assumes that the scanning software makes sequential requests.
>>> Assuming your suggestion was rolled out (which I think is a good idea
>>> in principal), wouldn't the scanners be updated to make concurrent
>>> async requests? At which point, you only end up adding 1 second to the
>>> total original time? Which kind of defeats it.
>>>
>>> Again I'd like to state that I think you are onto a good idea, but the
>>> other important point is that some (most?) of these scans are run from
>>> botnets. These have zero cost (well for the bot farmers anyway). My
>>> point is even if the proposal worked, they don't care if their herd is
>>> held up a little longer - they are abusing other people
>>> computers/connections so it doesn't cost them anything directly.
>>>
>>> Sorry but those are my thoughts
>>
>> I tend to agree. Effort will just be expended elsewhere, and that's
>> assuming this would have enough of an impact to be noticed.
>
> Say that it would be easy to implement this in Tomcat, and that we do not=
 collectively
> find good reasons not to do so, and that it does get implemented.
>
> Then I pledge that my next move would be to bring this similarly onto the=
 Apache httpd
> list (using the Tomcat precedent as an introduction of course (=C3=A0 la =
"hey guys ? those
> smart Tomcat developers have just had a great idea etc..")).
>
> I haven't checked the actual numbers yet, but I would imagine that betwee=
n Apache httpd
> and Tomcat, we're talking of a significant proportion of the overall webs=
ervers, no ?

Only if you can get them updated in a timely fashion.
And only if the default setting is 'on'.


p

> Alternatively of course, still if there are no definite arguments against=
 it, but the
> Tomcat developers are not interested, I could go to the Apache list anywa=
y. And then they
> might be the first to introduce this great feature.
>
> Or maybe I'll just patent it, and then sell the patent to the makers of t=
he third
> most-popular webserver..
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org