I'm releasing Zant, it's an open source gateway for your tor based sites. It's made for web server's based on node.js using express. You can read more about it and find the repo here: http://hyrule4e3tu7pfdkvvca43senvgvgisi6einpe3d3kpidlk3uyjf7lqd.onion/r/ff69536c63e8092fa1357c96cea02b3f06e38b94
Well, it's pending moderation so I am not able to see it. I'm not seeing this on their website under projects so if you want to share to me directly I can take a look.
I'm releasing Zant, it's an open source gateway for your tor based sites. It's made for web server's based on node.js using express. You can read more about it and find the repo here: http://hyrule4e3tu7pfdkvvca43senvgvgisi6einpe3d3kpidlk3uyjf7lqd.onion/r/ff69536c63e8092fa1357c96cea02b3f06e38b94
Okay so viewing that and the very small source code here is where I am.
First off, I do not know what is happening with the website but it loads really badly and stays bad through all interactions but that is not a review of the code. Just wanted to say that. I also think that this is possibly AI-generated code. This is not a bad thing in my discussion with people but something to think about.
I am not a nodejs developer so someone else might know more than me. What I did notice is that all of this is in memory, so things like bans are memory only. They should be storing these things in a database or something to actually make it effective. What if the server crashes from a ddos? All information is gone. The other problem I see is the heavy use of "fingerprinting", which is flawed. I could right now spin up a server with a lot of processes to mimic users that will take every user-agent in existence and on purpose commit bad traffic. I will now be able to block out legitimate users based on the idea of the fingerprint. This is a problem with tor, but also a problem with this code.
I would ask that what is this doing that something such as the web server (maybe nginx) could not already handle? I do not think there is harm in approving the post, because new ideas are good. But I would expect the poster to defend their position is all. I think it is AI generated code, and does a very small example of ddos mitigation. It would not hold up in a real ddos situation but it would be better than nothing. I encourage these ideas but think we would have to be realistic.
First off, I do not know what is happening with the website but it loads really badly and stays bad through all interactions but that is not a review of the code. Just wanted to say that. I also think that this is possibly AI-generated code. This is not a bad thing in my discussion with people but something to think about.
I am not a nodejs developer so someone else might know more than me. What I did notice is that all of this is in memory, so things like bans are memory only. They should be storing these things in a database or something to actually make it effective. What if the server crashes from a ddos? All information is gone. The other problem I see is the heavy use of "fingerprinting", which is flawed. I could right now spin up a server with a lot of processes to mimic users that will take every user-agent in existence and on purpose commit bad traffic. I will now be able to block out legitimate users based on the idea of the fingerprint. This is a problem with tor, but also a problem with this code.
I would ask that what is this doing that something such as the web server (maybe nginx) could not already handle? I do not think there is harm in approving the post, because new ideas are good. But I would expect the poster to defend their position is all. I think it is AI generated code, and does a very small example of ddos mitigation. It would not hold up in a real ddos situation but it would be better than nothing. I encourage these ideas but think we would have to be realistic.
I get your concerns, but to explain the ai generation part, I wrote the code myself but I allow ai to rewrite it in order to clean it up and make it more readable for other people. THe reason why the bans are in memory is because it's tor based so all you would need to do is get a new circuit to get into the site, there's no reason to store it.