#iocaine — Public Fediverse posts

oh lol, those are the iocaine URLs. Some crawler started getting thru iocaine, but still requesting its URLs.

Maybe I can set something up to auto-ban IPs that fetch these? nginx stuff is way past me, but good chance to learn I guess.

Also would be nice to ratelimit #iocaine, as it's exhausting nginx's resources by serving so much poison. Seems to be unsupported (for now) though without affecting Forgejo itself: https://git.madhouse-project.org/iocaine/iocaine/issues/159#issuecomment-4219

oh lol, those are the iocaine URLs. Some crawler started getting thru iocaine, but still requesting its URLs.

Maybe I can set something up to auto-ban IPs that fetch these? nginx stuff is way past me, but good chance to learn I guess.

Also would be nice to ratelimit #iocaine, as it's exhausting nginx's resources by serving so much poison. Seems to be unsupported (for now) though without affecting Forgejo itself: https://git.madhouse-project.org/iocaine/iocaine/issues/159#issuecomment-4219

oh lol, those are the iocaine URLs. Some crawler started getting thru iocaine, but still requesting its URLs.

Maybe I can set something up to auto-ban IPs that fetch these? nginx stuff is way past me, but good chance to learn I guess.

Also would be nice to ratelimit #iocaine, as it's exhausting nginx's resources by serving so much poison. Seems to be unsupported (for now) though without affecting Forgejo itself: https://git.madhouse-project.org/iocaine/iocaine/issues/159#issuecomment-4219

Iocaine leads to a lot of bot traffic to the maze. Some crawlers also seems to get through Iocaine and then crawl Codeberg or other Iocaine-protected Forgejo instances. For this reason, I don't want to deploy Iocaine in front of Codberg.

My proposed solution would be making Codberg only accessible to logged-in users and having an unauthenticated landing/explore site.

That site would allow you to

• browse the list of repos
• read READMEs-see project details (contributors, issue stats, licenses, activity)
• read project's documentation

But commit history, file browsing and (for now also issues) wouldn't be accessible without logging in.

What do you think about this?

#codberg #cod #forgejo #iocaine

Iocaine leads to a lot of bot traffic to the maze. Some crawlers also seems to get through Iocaine and then crawl Codeberg or other Iocaine-protected Forgejo instances. For this reason, I don't want to deploy Iocaine in front of Codberg.

My proposed solution would be making Codberg only accessible to logged-in users and having an unauthenticated landing/explore site.

That site would allow you to

• browse the list of repos
• read READMEs-see project details (contributors, issue stats, licenses, activity)
• read project's documentation

But commit history, file browsing and (for now also issues) wouldn't be accessible without logging in.

What do you think about this?

#codberg #cod #forgejo #iocaine

Iocaine leads to a lot of bot traffic to the maze. Some crawlers also seems to get through Iocaine and then crawl Codeberg or other Iocaine-protected Forgejo instances. For this reason, I don't want to deploy Iocaine in front of Codberg.

My proposed solution would be making Codberg only accessible to logged-in users and having an unauthenticated landing/explore site.

That site would allow you to

• browse the list of repos
• read READMEs-see project details (contributors, issue stats, licenses, activity)
• read project's documentation

But commit history, file browsing and (for now also issues) wouldn't be accessible without logging in.

What do you think about this?

#codberg #cod #forgejo #iocaine

The AI DDoS is now targeting my Forgejo server with... a very strange attack. These are all getting past #iocaine. The ASNs appear to be quite diverse. What's going on?

The AI DDoS is now targeting my Forgejo server with... a very strange attack. These are all getting past #iocaine. The ASNs appear to be quite diverse. What's going on?

The AI DDoS is now targeting my Forgejo server with... a very strange attack. These are all getting past #iocaine. The ASNs appear to be quite diverse. What's going on?

Could we as a community move from being defensive into #offensive re internet #scraping?
Sth more offensive beside
- poisoning their datasets using #nepenthes or #iocaine
- proof-of-work #anubis
- jpeg / zip bombs https://en.wikipedia.org/wiki/Zip_bomb

Is anyone working on some offensive strategies?

Could we as a community move from being defensive into #offensive re internet #scraping?
Sth more offensive beside
- poisoning their datasets using #nepenthes or #iocaine
- proof-of-work #anubis
- jpeg / zip bombs https://en.wikipedia.org/wiki/Zip_bomb

Is anyone working on some offensive strategies?

Could we as a community move from being defensive into #offensive re internet #scraping?
Sth more offensive beside
- poisoning their datasets using #nepenthes or #iocaine
- proof-of-work #anubis
- jpeg / zip bombs https://en.wikipedia.org/wiki/Zip_bomb

Is anyone working on some offensive strategies?

the blog is still being hogged by the bots, I had to put a hard limit of 1 request/second + some room for short bursts (like when your browser loads a webpage).

last night the noise of the fan in the mini PC could be heard from my room (few meters away, behind a thin door), the machine running the proxy in front of the blog is a tiny x86_64 machine around 7 years old and it was getting really hot.

#selfHosting #iocaine

the blog is still being hogged by the bots, I had to put a hard limit of 1 request/second + some room for short bursts (like when your browser loads a webpage).

last night the noise of the fan in the mini PC could be heard from my room (few meters away, behind a thin door), the machine running the proxy in front of the blog is a tiny x86_64 machine around 7 years old and it was getting really hot.

#selfHosting #iocaine

the blog is still being hogged by the bots, I had to put a hard limit of 1 request/second + some room for short bursts (like when your browser loads a webpage).

last night the noise of the fan in the mini PC could be heard from my room (few meters away, behind a thin door), the machine running the proxy in front of the blog is a tiny x86_64 machine around 7 years old and it was getting really hot.

#selfHosting #iocaine

I am listening to this podcast. There are some clever concepts included with Iocaine.

Open Source Security: #Iocaine poisons bots with Gergely Nagy

Episode webpage: https://opensourcesecuritypodcast.libsyn.com/iocaine-poisons-bots-with-gergely-nagy

Media file: https://traffic.libsyn.com/secure/opensourcesecuritypodcast/2026-01-iocaine-algernon.mp3

I am listening to this podcast. There are some clever concepts included with Iocaine.

Open Source Security: #Iocaine poisons bots with Gergely Nagy

Episode webpage: https://opensourcesecuritypodcast.libsyn.com/iocaine-poisons-bots-with-gergely-nagy

Media file: https://traffic.libsyn.com/secure/opensourcesecuritypodcast/2026-01-iocaine-algernon.mp3

I am listening to this podcast. There are some clever concepts included with Iocaine.

Open Source Security: #Iocaine poisons bots with Gergely Nagy

Episode webpage: https://opensourcesecuritypodcast.libsyn.com/iocaine-poisons-bots-with-gergely-nagy

Media file: https://traffic.libsyn.com/secure/opensourcesecuritypodcast/2026-01-iocaine-algernon.mp3

Well, I set up #iocaine on my Git forge yesterday (with Nam-Shub of Enki), and figured out how to get stats from it. It's served half a gigabyte of poison in just half a day, with 250k requests from anthropic.

However, a friend was successful in asking chat chippitty what's on the website, so I guess something somewhere is misconfigured.

However, https://git.allpurposem.at is no longer serving hundreds of bots per minute, just a few now :)

Well, I set up #iocaine on my Git forge yesterday (with Nam-Shub of Enki), and figured out how to get stats from it. It's served half a gigabyte of poison in just half a day, with 250k requests from anthropic.

However, a friend was successful in asking chat chippitty what's on the website, so I guess something somewhere is misconfigured.

However, https://git.allpurposem.at is no longer serving hundreds of bots per minute, just a few now :)

Well, I set up #iocaine on my Git forge yesterday (with Nam-Shub of Enki), and figured out how to get stats from it. It's served half a gigabyte of poison in just half a day, with 250k requests from anthropic.

However, a friend was successful in asking chat chippitty what's on the website, so I guess something somewhere is misconfigured.

However, https://git.allpurposem.at is no longer serving hundreds of bots per minute, just a few now :)

I may have stumbled into an AI blog post explaining how to get started with iocaine.
It's the very first time I see useful slop, despite the galactic irony.

(will not share the link, don't bother asking)

#noAI #iocaine

I may have stumbled into an AI blog post explaining how to get started with iocaine.
It's the very first time I see useful slop, despite the galactic irony.

(will not share the link, don't bother asking)

#noAI #iocaine

I may have stumbled into an AI blog post explaining how to get started with iocaine.
It's the very first time I see useful slop, despite the galactic irony.

(will not share the link, don't bother asking)

#noAI #iocaine

iocaine configured!
we have:
netbsd - caddy - iocaine

if you check https://blog.masto.bike, you should see a regular site.
if you install a User-Agent spoofer'[1] and use something like "Perplexity" or "ClaudeBot" you will see absolute gibberish and multi-lingual nonsense.
It is amazing.

[1]https://webextension.org/listing/useragent-switcher.html

#netBSD #iocaine #resistAI

iocaine configured!
we have:
netbsd - caddy - iocaine

if you check https://blog.masto.bike, you should see a regular site.
if you install a User-Agent spoofer'[1] and use something like "Perplexity" or "ClaudeBot" you will see absolute gibberish and multi-lingual nonsense.
It is amazing.

[1]https://webextension.org/listing/useragent-switcher.html

#netBSD #iocaine #resistAI

iocaine configured!
we have:
netbsd - caddy - iocaine

if you check https://blog.masto.bike, you should see a regular site.
if you install a User-Agent spoofer'[1] and use something like "Perplexity" or "ClaudeBot" you will see absolute gibberish and multi-lingual nonsense.
It is amazing.

[1]https://webextension.org/listing/useragent-switcher.html

#netBSD #iocaine #resistAI

@gairdeachas A few months ago I was feeding these crawlers with #iocaine. They have been very greedy and aggressive. I hope I polluted their databases enough to have an impact.

@gairdeachas A few months ago I was feeding these crawlers with #iocaine. They have been very greedy and aggressive. I hope I polluted their databases enough to have an impact.

@gairdeachas A few months ago I was feeding these crawlers with #iocaine. They have been very greedy and aggressive. I hope I polluted their databases enough to have an impact.

EDIT : Résolu.
le problème venait que la partie POST n'est pas prise en compte dans l'upstream qui redirige vers iocaine et le renvoi d'une erreur 500 est "normal".
Je l'ai bypass en ajoutant le code 500 aux error codes qui permettent d'accéder au fallback

dites les gensss, j'ai un problème avec #iocaine que je viens de mettre en place.

Ca marche nickel sur les pages, par contre, la moindre requête POST (par exemple : login sur gitea) renvoie une erreur 500 du reverse (nginx).

J'ai toujours le même message : invalid URL prefix in ""


J'ai suivi la méthode d'intégration là :

iocaine.madhouse-project.org/documentation/3/reverse-proxies/nginx/#integrating-iocaine


Du monde qui saurait m'aider à comprendre ce qui se passe ?

EDIT : Résolu.
le problème venait que la partie POST n'est pas prise en compte dans l'upstream qui redirige vers iocaine et le renvoi d'une erreur 500 est "normal".
Je l'ai bypass en ajoutant le code 500 aux error codes qui permettent d'accéder au fallback

dites les gensss, j'ai un problème avec #iocaine que je viens de mettre en place.

Ca marche nickel sur les pages, par contre, la moindre requête POST (par exemple : login sur gitea) renvoie une erreur 500 du reverse (nginx).

J'ai toujours le même message : invalid URL prefix in ""


J'ai suivi la méthode d'intégration là :

iocaine.madhouse-project.org/documentation/3/reverse-proxies/nginx/#integrating-iocaine


Du monde qui saurait m'aider à comprendre ce qui se passe ?

EDIT : Résolu.
le problème venait que la partie POST n'est pas prise en compte dans l'upstream qui redirige vers iocaine et le renvoi d'une erreur 500 est "normal".
Je l'ai bypass en ajoutant le code 500 aux error codes qui permettent d'accéder au fallback

dites les gensss, j'ai un problème avec #iocaine que je viens de mettre en place.

Ca marche nickel sur les pages, par contre, la moindre requête POST (par exemple : login sur gitea) renvoie une erreur 500 du reverse (nginx).

J'ai toujours le même message : invalid URL prefix in ""


J'ai suivi la méthode d'intégration là :

iocaine.madhouse-project.org/documentation/3/reverse-proxies/nginx/#integrating-iocaine


Du monde qui saurait m'aider à comprendre ce qui se passe ?

@glitc_ You might want to look at #Iocaine among others:

https://opensourcesecurity.io/2026/2026-01-iocaine-algernon/

@heiseonline Gut, dass sie sich die Mühe machen. #iocaine ist gegen Bots viel effizienter.

#fuckai

@heiseonline Gut, dass sie sich die Mühe machen. #iocaine ist gegen Bots viel effizienter.

#fuckai

#iocaine is just not happy, but not giving me any errors. Been following the nixos install instructions and I'm not understanding what is wrong.
Systemd service goes straight to failed.
journalctl doesn't show anything interesting
Running manually (with the exec command from the systemd config) returns immediately with no output

Wir alle: …
Claudebot: Schlürft sich die Inhalte vom Iocaine auf meinem Server rein.

Noch jemand ein bisschen Text von
https://blog.numerfolt.de/Linksmultiplikation-K%C3%BCnstleratelier/Geisterspiels-Oberseminars/Magazinschacht/Fernsehschaltstellen-Postvertrags/reliefbedingter/Wohnfl%C3%A4chen-F%C3%BCrwortes/afrikainteressiertes-desselben/geschmackvollstem/Unterhaltsschuldnerinnen/hierhergeh%C3%B6renden-unwissenschaftlicherer/

Nein, das ist nicht aufrufbar, aber es enthält unter anderem Sätze wie:
„Prejudice in favour of size was about three acres, there were several bad cases were in a hostile hot fusion establishment the excuse that.“

Und nein, das ergibt keinen Sinn xD
Das ist iocaine von madhouse project am Werk…
#iocaine #selfhosted