How the FSF sysadmins block botnets with reaction

4 hours ago

The FSF sysadmins use reaction, a tool to block botnets and aggressive scrapers, including those like the Vo1d/Popa botnet using compromised smart TVs.
They transitioned from fail2ban due to scalability issues (like hitting limits with UFW rules) to ipset, which allowed handling up to five million rules without instability.
After encountering performance issues with fail2ban's architecture, they adopted reaction from Framagit, customizing configurations for ipset and improving restart times by exporting/restoring IP sets.
The FSF shared their reaction configurations upstream to help others and emphasizes the role of free software supporters in funding their defense efforts against DDoS attacks.

Hasty Briefsbeta