Cloudron Demo

[User123456]

looks like there is either a problem or there is an attack on the instance.

[girish]

Some person with the ip 212.92.231.206 is spamming reboot requests Not sure what they get out of this childish behavior

[subven]

@girish said:

212.92.231.206

Thats actually from UA/Mykolaiv, an active war zone which was bombed just yesterday. Perhaps someone simply let their AI run wild, which isn't such an unlikely scenario these days.

Regardless of this very strange coincidence, it should be possible to block a few more of Cloudrons admin endpoints that could impair the functionality of the demo instance.

[necrevistonnezr]

@girish said:

Some person with the ip 212.92.231.206 is spamming reboot requests Not sure what they get out of this childish behavior

It’s pretty well-known behavior. Non-commercial request-spamming (e.g., low-level DoS/flooding) is typically process-driven rather than goal-driven. The combination of arousal (sensation seeking), gratification (instant feedback), and low deterrence (low perceived risk) trigger the behavior, even without monetary or investigative objectives.

We all know the gratification aspect from „social“ media —> „Likes“ and „Views“ fuel the whole economy.

e.g.: https://journals.sagepub.com/doi/10.1089/1094931041291295

[robi]

Fail2ban failed to ban

[girish]

I have disabled some of this functionality in the demo now.

[Teiluj]

In passing, I noticed a few times in a recent past the cloudron demo server name and footer having been changed to some unpleasant (some might say offensive) wording.
Not sure how you want to approach this - just though I'd mention.

[girish]

@Teiluj yeah, I have noticed that too. We don't want to lock it too much either (app location, footer, usernames, group names, etc - lots of scope to put offensive things).

[User123456]

@girish In the demo, one of the characters is vandalizing things. He keeps creating spam containers.

[User123456]

@girish @nebulon @james and again, there were all apss deleted and replaced by others with funny photo and name.
Please act immediately.

[Lanhild]

@User123456 the demo being a demo is by nature very publicly accessible, making it prone to things like this. Unfortunately, there's not very much the team's able to do without locking a lot of the features, which in turn would make the demo unpleasant.

[joseph]

yeah, it really is complicated to lock down the server entirely. We considered re-imaging the server every night, but this will leave it open until that time. Only thing I can think of is maybe to have some cron job run analyze the current list of apps and various images via an LLM.

[User123456]

@joseph Can I find out and block the address of this?

[joseph]

@user123456 Good catch, looks like the eventlog is not showing the source IPs anymore! cc @girish

[girish]

@user123456 I have begrudgingly moved our demo instance to a totally different domain https://my.cloudron-demo.com . This way cloudron.io won't take a reputation hit for any misuse.

As for the real abuse itself, I am afraid nothing much we can do apart from sit it out

[User123456]

The user is still active at the new URL.

[User123456]

something is not right on the demo server if I have a container instrument that will be deleted after a short time or there will be an error

[jdaviescoates]

@User123456 it's not at all clear what issue you are reporting. Please elaborate so the Cloudron team can try to assist you.

[User123456]

No matter what I install, it's gone after 5 minutes, except for the webmail. Either there is a prankster on the loose or there is something wrong, no matter what I install.

[jdaviescoates]

@User123456 or it could be just resets every 5 mins?