# I am the Watcher. I am your guide through this vast new twtiverse.
# 
# Usage:
#     https://watcher.sour.is/api/plain/users              View list of users and latest twt date.
#     https://watcher.sour.is/api/plain/twt                View all twts.
#     https://watcher.sour.is/api/plain/mentions?uri=:uri  View all mentions for uri.
#     https://watcher.sour.is/api/plain/conv/:hash         View all twts for a conversation subject.
# 
# Options:
#     uri     Filter to show a specific users twts.
#     offset  Start index for quey.
#     limit   Count of items to return (going back in time).
# 
# twt range = 1 30
# self = https://watcher.sour.is/conv/2rxkcca
@abucci / @abucci Any interesting errors pop up in the server logs since the the flaw got fixed (_unbounded receieveFile()_)? 🤔
@abucci / @abucci Any interesting errors pop up in the server logs since the the flaw got fixed (_unbounded receieveFile()_)? 🤔
@prologic Have you been seeing any of my replies?
@prologic I don't know if this is new, but I'm seeing:


Jul 25 16:01:17 buc yarnd[1921547]: time="2024-07-25T16:01:17Z" level=error msg="https://yarn.stigatle.no/user/stigatle/twtxt.txt: client.Do fail: Get \\"https://yarn.stigatle.no/user/stigatle/twtxt.txt\\": dial tcp 185.97.32.18:443: i/o timeout (Client.Timeout exceeded while awaiting headers)" error="Get \\"https://yarn.stigatle.no/user/stigatle/twtxt.txt\\": dial tcp 185.97.32.18:443: i/o timeout (Client.Timeout exceeded while awaiting headers)"


I no longer see twts from @stigatle at all.
@stigatle @prologic testing 1 2 3 can either of you see this?
@abucci yeah I can see it :)
@stigatle Sweet, thank you! I've been shooting myself in the foot over here and want to make sure the situation is getting fixed!
@abucci Seems to be okay now hmmm
@abucci Seems to be okay now hmmm
@abucci Oh 🤣 Well my IP is a known subnet and static, so if you need to know what it is, Email me 😅
@abucci Oh 🤣 Well my IP is a known subnet and static, so if you need to know what it is, Email me 😅
Out of interest, are you able to block whole ASN(s)? I blocked the entirely of teh AWS and Facebook ASN(s) recently.
Out of interest, are you able to block whole ASN(s)? I blocked the entirely of teh AWS and Facebook ASN(s) recently.
@prologic @abucci my /tmp is fine now, no avatars there. I have to drive my daughter to a birthday party now, but I keep things running and I'll check when I get back.
@stigatle no problems 👌 one problem solved at least 🤣
@stigatle no problems 👌 one problem solved at least 🤣
Hey so.. i just got an email from my ISP saying they will terminate my service. Did i break something @abucci ?
@abucci Just making sure you're seeing @xuu's twt, in case he's still on your blacklist:

> Hey so.. i just got an email from my ISP saying they will terminate my service. Did i break something @abucci ?
>
> – https://txt.sour.is/twt/oohzbqa
@xuu For what reason?
he emailed my ISP about causing logging abuse. This is the only real ISP in my area, its gonna basically send me back to dialup.
@xuu wow, not cool.
> We received the abuse report below regarding network abuse from the IP address indicated.
> On researching I see that HTTPS (tcp 443) traffic is continuing and originating from you NAT IP address 100.64.x.x
> This was further found to be originating from your firewall/router at 192.168.x.x (MAC D8:58:D7:x:x:x).
> This abuse is continuing and constitues a violation of [ISP] Acceptable Use Policy and Terms of Service.
> Please take action to identify the source of the abuse and prevent it from continuing.
> Failure to stop the abuse may result in suspension or cancellation of service.
>
> Thank you,
> We received the abuse report below regarding network abuse from the IP address indicated.
> On researching I see that HTTPS (tcp 443) traffic is continuing and originating from you NAT IP address 100.64.x.x
> This was further found to be originating from your firewall/router at 192.168.x.x (MAC D8:58:D7:x:x:x).
> This abuse is continuing and constitues a violation of Senawave's Acceptable Use Policy and Terms of Service.
> Please take action to identify the source of the abuse and prevent it from continuing.
> Failure to stop the abuse may result in suspension or cancellation of service.
>
> Thank you,
> We received the abuse report below regarding network abuse from the IP address indicated.
> On researching I see that HTTPS (tcp 443) traffic is continuing and originating from you NAT IP address 100.64.x.x
> This was further found to be originating from your firewall/router at 192.168.x.x (MAC D8:58:D7:x:x:x).
> This abuse is continuing and constitues a violation of \n Acceptable Use Policy and Terms of Service.
> Please take action to identify the source of the abuse and prevent it from continuing.
> Failure to stop the abuse may result in suspension or cancellation of service.
>
> Thank you,
@abucci Can you please check if you reported @xuu's IP address 162.211.155.2 on mistake and let his ISP know that this was some false alarm? They're monitoring his traffic to your server and treating this as continued abuse. :-(

(His twts have been synced to your yarnd by yarnd's gossip protocol.)
Xuu has shutdown his pod now, probably to avoid losing connectivity.
FWIW I'm still trying to find the the cause of the mult-GB avatars that both @stigatle and @abucci 's pods were both teying yo download. The flaw has since been fixed in the code but I'm still trying to investigate the source 🤞
FWIW I'm still trying to find the the cause of the mult-GB avatars that both @stigatle and @abucci 's pods were both teying yo download. The flaw has since been fixed in the code but I'm still trying to investigate the source 🤞
Also FWIW this is all my fault for writing shitty vulnerable code 🤣 So blame me! I'm sorry 🙏
Also FWIW this is all my fault for writing shitty vulnerable code 🤣 So blame me! I'm sorry 🙏