I’m confused what is even gain from them doing this?
3 Likes
The Patreon plugin has caused some… anger… amongst a certain group of people who want to take the code from paid Patreons and share it with everyone. Even if a game is set to private, if someone has the link, they have access to it–the Patreon plugin put a stop to that, and it really made some people mad. So they attacked the server right after it went into play. Every now and then they do it again.
This recent attack was from bots and scripted scrapers, from what I can tell. There were three countries, in particular, that were hitting it. And I’m talking 7k hits in 10 minutes from one IP, with others hitting it between 4000-5000 times in ten minutes. Between 1 am and 8 am, there were over 1 million access attempts, according to the logs. The server couldn’t deal with the constant hits.
I made some DNS changes to try to head it off. And am going to alter the back end code so, even if people are trying to hit it that often, the server can deal with it without PHP going berserk.
21 Likes
So peeved overreaction to Patreon plugins started this… that’s well no it’s not really surprising now that I think about it. I don’t like Patreon exclusive stuff either but I ain’t entitled or crazy enough to hack and use bots to attack an entire site that I enjoy visiting.
8 Likes
Hello, not so much a bug report or request, I wanted to ask what exactly was that Patreon plugin and what it did and/or changed for the site and its users.
2 Likes
The patreon plugin allows authors to restrict access to their private demo (usually for early access and/or bonus content etc etc) so that it’s solely accessible by their supporters.
A lot of authors tend to just use a different url for their private demos but they can be accessed if you have the correct link.
The Patreon plugin allows for more protection against piracy by requiring users to have their Patreon linked to their cogdemos account to verify they actually paid for it.
(I could be missing a few things or wrong about something but I’m pretty sure that’s the jist of it.)
4 Likes
Just checked and the websites up for me, although it does a security check when I load up so maybe it’s related to that?
3 Likes
I get Cloudflare’d every other load (makes playing demos a bit challenging but not that different from just being prepared for my connection dropping on page load I’m used to) so I would imagine it’s related to that.
9 Likes
Patreon try reading COGDemos but after a few clicks not loading to the next page- try several others Interactive Fiction the same, not working.
3 Likes
Is issue fixed? Site is still working very slowly. The server save and load pop ups are taking long time to come up
2 Likes
Yes, cloudflare must think you’re a bot. I will turn down the paranoia level a bit and see if I can unblock you. Can you PM me your IP and general location? To stop the bleed yesterday, I ended up blocking a few countries in their entirety, and you may be in one of them. 
It is somewhat fixed. I did what I could to get it semi-functional again, but had to lock things down more than I’d like, and it’s affecting functionality. The server is still being attacked constantly (and Cloudflare, bless its heart, is blocking genuine users like @tmaty while letting some actual bots through because those bots aren’t on its stupid list and I have yet to find a way to block them, because my robots.txt on the server itself is still letting them through 
).
I will turn down the paranoia level and see what happens. It may crash again, and if it does, I’ll turn it back up until the dev can take a look at a problem I found in the code last night.
Long story short: hammering the server is causing the DB to be hammered, too, due to the autosave function (create/destroy) tied into the back button. Also, prior to yesterday, caching was done in the DB (yes, that’s stupid). I fixed that, but it didn’t fix the problem. To fix the way the autosave works requires a code change I’m not comfortable making (read: I know damned well I’d break it), so I would rather the dev fix it, instead of me making things worse and then him having to clean up my mess.
Anyway, I’ll drop the paranoia level and we’ll see what happens. I am working today, so I don’t have time to mess with it much, but PM me if it gets worse. Or drop it here and I will probably get the email about it.
19 Likes
sorry the site’s been having so much trouble! just so you know, it’s basically completely given up loading on my end: i keep getting a 504 Gateway time-out error.
7 Likes
LOL, not you blocking the whole of South Africa.
And thanks, I seem to be back in again.
But best of luck with the bot-thing, honestly it’s much appreciated.
and it seems like it was actually the cloudflare thing
3 Likes
Good!
I actually found an issue that cloudflare caused with the backend code…
The last time the server was attacked, I turned on throttling for the /play route–no more than 30 hits per minute from the same IP. That was all well and good until I got Cloudflare as the middle man…
It was passing its own IP address to the back end, which meant… all hell broke loose. That’s why @LiliArch was constantly having to see the dumb Cloudflare screen pop up. It should’ve been doing that for her IP for her, but it was doing it for Cloudflare’s IP, so it thought she was hitting a lot more times than she was.
I added some code to the back end to deal with proxies and it seems to be faster now. It’s registering the correct IPs, so the throttle isn’t kicking in. Regardless, I turned the throttle off on the /play route just to be safe. I’m still getting hammered by bots, but it has slowed it down to a more manageable level, and PHP isn’t freaking out about needing ten trillion children to function properly. I’m still going to have the dev look at the code, because I think it’s hammering the DB far more than it should.
Sorry for the mess. In trying to fix the problem, I made more of a problem with what I had done before! Hopefully, it’s more stable now.
12 Likes
Actually more ridiculous than that: instead of the Cloudflare screen popping up, I’ve been getting the eternally-stuck-on-load when a new scene file should be loaded, and the only way to get past is to refresh the page, at which point Cloudflare does its not-a-bot-check. So I at least assume it’s been hanging due to that, but at a point of the file-delivery where the check isn’t actually served to the browser.
5 Likes
That… actually helps. I’m thinking cloudflare is screwing with some things. My husband just told me he can play a game, but the stats screen takes forever to load. Looking in the logs to see if I can find where the bottleneck is with scene changes and stats (which changes the txt file the game accesses).
8 Likes
Good luck! It’s not like I haven’t been used to saving every other page, since I’ve had the eternally-loading-on-scene-change due to my internet connection dropping at a critical moment for ages, but Cloudflare is admittedly complicating things there.
2 Likes
Yeah, Cloudflare helps in one respect, but it has created bizarre bugs, too. I just tested the scene changes and viewing stats–if you’re click happy, everything is fine and dandy. If you let it stew a bit…. then you get stuck in spinning hell. My guess is some kind of caching issue (I moved it from DB to file, so it may not like that) or mismatch between what Cloudflare is doing and what the code is doing. I will take a look after work.
5 Likes
I have noticed on Nexus that Cloudflare tends to want to re-check your not-a-bot status if you haven’t been loading a page for a few minutes, so it may be the same thing happening in here, since going through a scene file - especially if you’re reading and not only skimming! - may take a while, and you generally from what I understand actually don’t load anything until switching scene files.
I’m going to play something and see how it’s behaving now, I haven’t tested after your latest update.
2 Likes
you and the dev are so beautiful and gorgeous for dealing with this so promptly. thank yall for working so hard 
9 Likes