14

I just clicked the sidebar link to the blog and got a big warning without much explanation.

This is happening for anything directed to the http://blog.stackoverflow.com

screenshot

network

The title of the page is Attention Required! | CloudFlare

What's going on here?

  • I'm investigating this. – Tom Limoncelli Nov 3 '14 at 22:33
  • Can you post your IP address? A website like whatismyip.com will tell you what it is. – Tom Limoncelli Nov 3 '14 at 22:45
  • @TomLimoncelli, thanks for the info. I do work for a big organization with hundreds of users all sitting behind the same IP address. I'll fill out the captcha, which I presume can read my IP, so it can learn more about potential user profiles. Thanks again. – KyleMit Nov 3 '14 at 23:44
  • 1
    @Sha Tom gonna get many repz :D – nicael Nov 5 '14 at 23:06
  • 1
    @nicael yup, he surely deserves it (but shhhh, don't tell him - want it to be a pleasant surprise ;-)) – Shadow The Curly Braced Wizard Nov 5 '14 at 23:07
  • @Sha not only he ;) I mean, not only he workz on thiz problem. – nicael Nov 5 '14 at 23:07
25
+500

I'm Tom Limoncelli from Stack Exchange's SRE team. We're testing a new anti-DoS system. First we've deployed it on the blogs; over time we'll deploy it on other Stack sites as we shake out any problems. What you are seeing is part of that.

"DoS" means a Denial of Service attack. For example, someone configures thousands of machines to hit a website in an attempt to overload it. These automated attacks are done by robots or simply "bots". A collection of bots is called a "botnet".

Why would someone attack Stack Exchange? We can only speculate. However, there is now a blackmarket that will provide "botnet services" for anyone with money, thus it is shockingly easy to attack a website you dislike. Where do botnets come from? Most computer viruses subvert machines and turn them into bots. In other words, that coworker of yours that disabled their anti-virus software may be unknowingly part of a botnet.

An anti-DoS (Denial of Service) system detects if many requests are coming from the same IP address. If such behavior is detected, it presents a "captcha" to the user to prove that they are human and not a bot.

If you saw this message, the system thinks you are a bot. No offense. Chances are you aren't a bot. There may be multiple people sharing your IP address. For example, at most companies all PCs appear to be behind the same IP address. Alternatively, there is a chance you are part of a botnet, so you should make sure you're running an updated anti-virus system.

Since the system we are using is new, the problem may also simply be that it is too sensitive. We're adjusting it find the right balance of sensitivity and protection.

What should you do? After verifying that your PC is running good anti-virus software, fill out the captcha form. That will prove you are a human and let you into our site. More importantly, it will help train our anti-DoS system, which makes it smarter and less prone to false positives.

Feedback about our new system is appreciated, especially since it is new and still in test mode.

  • Isn't this from Cloudflare? – Jeff Atwood Nov 16 '14 at 5:38
  • Jeff: yes that's who we are testing at this time. – Tom Limoncelli Nov 17 '14 at 13:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .