I get they're DDoS; but take the mask off, and arn't they just the AI monied interests that fund the FSF? and a lot of them are just active inference, eg, the user is trying to ask about something and the AI monied interests setup a web scraper to go and get that data.

Just seems like no one wants to call out the hand that feeds them in a human centipede that's best described as the torment nexus.

Can you elaborate on who these interests are precisely?

Firewalld had a similar issue up until recently as well.

Weird message to include in AGPLv3 licensed software (which explicitly allows people to use software however they like, regardless of their beliefs or feelings).

What I can see is a fairly clear indication that they do not want contributions from people whose politics differ from theirs. I would also question whether government funding of a project with political policies about who can participate is appropriate. The political stance is also rooted in a particular culture so is unwelcoming to people from other cultures.

Of course people can political views and preferences, but they presumably have some aim in mind when making that statement in the README. What is that aim?

Because you can have preferences while not restricting legal rights.

This is the same FSF that in the past has refused contributions from people whose politics include "I would like this software to run on my windows/apple/other proprietary platform". They're extremely political.

"If the point is to promote Free Software, we do ourselves a disservice by making our Free Software work better on a proprietary system than a Free system. Let's include this support when it works on the Free platforms as well."

FSF is political, but only about Free Software. Their goal is to promote it, and I think RMS has shown very clear thinking in this regard. I don't love the decision/outcome (someone did work to make something better and it was rejected), but I get it in service of the larger goal.

To flip the pschology, you could imagine a world where Emacs did way more awesome stuff on Windows and Mac, and the ensuing HN discussion where the obvious snipe appears a dozen times: "lol they keep talking about free software but their own products work better on windows lol".

They won't take contributions not aligned with their goals but won't block you from sharing your contributions in the spirit of free software.

Because of sealioning, among other things. If you aren't familiar with the term, please look it up. You're doing it right now. This post, and your reaction are textbook sealioning.

I don't see how that's related to the topic or issue being discussed though. If you're a maintainer you decide when to shut down a discussion. Someone is annoying/creepy/difficult and wants a feature? Let them fork it, eod. Every escalation afterwards is basically just trolling or harassment.

The GPL variants are the antithesis of politically neutral.

The GPL "tolerates" conflicting political opinions, which used to be closer to the norm and thus not political.

Other than that, there is no expectation of political stance.

Only in the current ultra-modern age, has politically neutral devolved to meaning that you must agree with me on 99.99%.

Of course people can have their preferences, but presumably that reaction implies "gay/trans anti-colonialist" ought to be a problem for some "political/cultural" groups?

What is the aim of that?

My read is that the authors are signalling their community is a "safe space". I don't think they're trying to exclude particular cultures, trigger people, or otherwise cause problems.

    grep -m1 -E ^Tot /proc/net/fib_triestat ;ip route | grep -Fc blackhole
    Total size: 56735  kB
    426951

I'm most concerned about blocking innocent users, currently I use Cloudflare to block known bad ASNs using a list I found on GitHub.

The only IP's that come and go are the Tor 30 day blocklist and a couple FireHOL attackers from a repo though I will sometimes leave the last entries live until reboot. I do not really need to block tor but I use this silly blog as a testing ground. Tor and some known abusers come from a git repo I refresh periodically.

The data-centers, VPS providers, CDNs, known botnets are perma-banned. For my hobby nodes I personally find this acceptable. I would not do this in a professionally managed data-center. There are better methods for those cases especially for B2B corporate arrangements. Regardless of what daemons I run I never have external dependencies that need to be accessed from my node or from the client with exception of stratum-1 time servers.

I do have to periodically update the CIDR blocks for given ASN's. I have not automated this but I probably should some day. It's not hard to automate, I am just excessively "efficient". I was told to stop calling myself lazy, but I am.

Methods 2, 3 and 5 are the ones I talk about here. [1]

[1] - https://nochan.net/b/Internet-Crap/20260606-How-To-Block-Som...

The only real solution to bots is making users log in. And even then you have to fight registration bots.

That's why I eventually let those go usually after a kernel update and the git repo for FireHOL gets updated often. The kernels get updated often. I only perma-ban the data-centers which is fine for my silly blog and probably for some peoples hobby sites. People can chose which methods to apply, how to apply them or which ones to skip entirely.

Excellent username btw. Those SNL Celebrity Jeopardy episodes are unforgettable. [1]

[1] - https://www.youtube.com/watch?v=bEghu90QJH4

Try:

  ip route add src ${net} blackhole

Peace of mind? Fair enough but I'd be more wary about blocking legitimate users. VPS providers are often used for VPNs etc.

A playground to test things. A place for bots and their kin to report themselves to me so that I can use this information for sites I actually want to protect a little bit. A place to share some ideas with a small handful of like minded people.

Blogs are throw away for me. After some time I delete the VM and edit articles offline for 6 to 18 months and then put them back up on another domain when there may be a need to share some old articles. This method disjoints the archive sites.

https://www.gnu.org/philosophy/javascript-trap.html

Users can't consent to running a page's javascript the way they can consent to running a program they've intentionally downloaded, so it's effectively "non-free" regardless of license.

https://anubis.techaro.lol/docs/admin/configuration/challeng...

I guess for the meta refresh challenge it's less "proof of work" and more "proof of patience".

Won't, they call it malware: https://www.fsf.org/blogs/sysadmin/our-small-team-vs-million...

My experience is that modern web scraping had no obvious pattern, since it is proxied through many IPs. The last time a server was failing to handle the pressure, we decided to temporarily ban IPs from some Asian regions. How does the FSF decide to ban an IP?

Why do they use iptables + ipset instead of nftables? Is there a technical reason or is it just legacy? AFAIK, Nftables is more performant, and IMO simpler. And it has native sets, see https://wiki.nftables.org/wiki-nftables/index.php/Sets

This is something we've been forced to do at work, a LOT. Some weeks it's Huawei Cloud, Tencent, and Alibaba. Other weeks it's all China Telecom. We're using Anubis where possible, but a lot of it is just whack-a-mole with residential proxies. I looked at Datadome and HUMAN, but they would be hundreds of thousands a year at our traffic scale, and I suspect may also have false positives. We abandoned CrowdSec for that reason as well.

I'd love to find a decent k8s native solution to this problem.

I can confirm. DataDome has been making my life a living hell. It thinks my phone is a bot, so I can no longer use PayPal and other quasi-monopoly services while on the go. DataDome will reliably block me on the first request.

Fuck DataDome.

I identify features (which can be expressed as firewall rules) from log data; I write totals to a temporary store (Redis). I have periodic tasks which scan the temp store for patterns which exceed thresholds. When that occurs, fail2ban creates the appropriate rules. This occurs in depth and in concentric rings.

Et tu?

Do you have a blog post about your automated fail2ban rule generation?

Last year I blocked basically all of Brazil. No problems. Who knew?

It's no more of a botnet than ProtonVPN for example. Apps intentionally added the Popa SDK to their apps as a monetization method. This allows apps without ads and tracking to be financially viable. I would expect FSF to support apps being able to move off of monetization schemes that depend on tracking people so it is disappointing for them to put such alternative monetization technologies in a negative light.

The existence of an app brings users value, else they wouldn't use it.

Popa is an illegitimate and botnet[1] that no end user knowingly/willingly uses.

1: https://krebsonsecurity.com/2026/07/fbi-seizes-netnut-proxy-...

and I doubt these apps are really Free versions - do they support user modifications and access to the code? If they did support the four freedoms maybe the fsf would have something positive to say to balance it out?

I pay for some software services. The services I pay for have a billing page (or a donation page) and I pay via the banking system

I rigorously block every ad, every tracker, every thing that does "monetization"

The evil period of trying sneaky ways to generate money is, I am optimistic, coming to an end.

If you want my money, ask me. If you must have my money, demand it. If you are sneaking around "monetization" I will do everything I can to stop you.

You got a genuinely free, to you, app.