Add monitoring for common spam patterns #1678
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
We've noticed some common patterns in recent spam attacks. While our response time on these has been ok, we can look for some of these common patterns and page whoever is on-call earlier than we'd otherwise notice. The exact patterns we look for is considered sensitive information, and thus not in the repo and should not be discussed publicly. Note that I've opted to look for crates that are likely spam, rather than volume. Volume is more likely to have false positives, and is better handled by more aggressive rate limiting. This assumes that we consider a spam attack to be something we always want to page for. Since we have better coverage of someone watching discord most hours, we could alternatively have this post in a private channel, and let whoever is awake determine if it's worth paging over. If someone does get paged, it's assumed that this will get resolved either by them taking action to remove the crates, or if the crate is legitimate, by updating the config vars to remove that pattern.
|
Can you privately share the patterns you're thinking of setting these environment variables to initially? |
|
What do you think about also adding a check to monitor the count of crates where |
|
@bors r+ |
|
📌 Commit fb3da01 has been approved by |
bors
added a commit
that referenced
this pull request
Apr 1, 2019
Add monitoring for common spam patterns We've noticed some common patterns in recent spam attacks. While our response time on these has been ok, we can look for some of these common patterns and page whoever is on-call earlier than we'd otherwise notice. The exact patterns we look for is considered sensitive information, and thus not in the repo and should not be discussed publicly. Note that I've opted to look for crates that are likely spam, rather than volume. Volume is more likely to have false positives, and is better handled by more aggressive rate limiting. This assumes that we consider a spam attack to be something we always want to page for. Since we have better coverage of someone watching discord most hours, we could alternatively have this post in a private channel, and let whoever is awake determine if it's worth paging over. If someone does get paged, it's assumed that this will get resolved either by them taking action to remove the crates, or if the crate is legitimate, by updating the config vars to remove that pattern.
|
☀️ Test successful - checks-travis |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We've noticed some common patterns in recent spam attacks. While our
response time on these has been ok, we can look for some of these common
patterns and page whoever is on-call earlier than we'd otherwise notice.
The exact patterns we look for is considered sensitive information, and
thus not in the repo and should not be discussed publicly.
Note that I've opted to look for crates that are likely spam, rather
than volume. Volume is more likely to have false positives, and is
better handled by more aggressive rate limiting.
This assumes that we consider a spam attack to be something we always
want to page for. Since we have better coverage of someone watching
discord most hours, we could alternatively have this post in a private
channel, and let whoever is awake determine if it's worth paging over.
If someone does get paged, it's assumed that this will get resolved
either by them taking action to remove the crates, or if the crate is
legitimate, by updating the config vars to remove that pattern.