Maybe you can limit the times per hour that a single IP address can
download something from your web site.
For example max 50 download per file per hour for a single IP address.
This prevents current and future abuses...
---
Marco Bambini
http://www.sqlabs.net
http://www.sqlabs.net/blog/
[EMAIL PROTECTED] wrote:
But lately, there have been so many problems coming from
win98 and moz4 that I'm thinking of banning all traffic
that self-identifies as such in the User-Agent string of
the HTTP header.
Thoughts anyone? Are there less drastic measures that might
be taken to
| Last night, a single user (or, at least, a single IP address)
| in China that self-identified as running windows98 and
| Mozilla 4.0 attempted to download sqlite-3.3.12.tar.gz
| 24980 times and sqlite-source-3_3_12.zip 25044 times
| over about a 5 hour period, sucking up significant
| bandwidth
[EMAIL PROTECTED] was heard to say:
Thoughts anyone? Are there less drastic measures that might
be taken to prevent this kind of abuse?
Frankly, I can't imagine someone sitting in China in front of a Win98 box and
hitting the download button 25044 times. I guess this is scripted, and they
On Tue, 30 Jan 2007 12:58:01 +, [EMAIL PROTECTED] wrote:
Last night, a single user (or, at least, a single IP address)
in China that self-identified as running windows98 and
Mozilla 4.0 attempted to download sqlite-3.3.12.tar.gz
24980 times and sqlite-source-3_3_12.zip 25044 times
over about
You could adapt this ruleset used to block ssh bruteforce attacks:
( quoting from http://www.la-samhna.de/library/brutessh.html )
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set \
--name SSH -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -m recent --update --seconds
60
[EMAIL PROTECTED] wrote:
Thoughts anyone? Are there less drastic measures that might
be taken to prevent this kind of abuse?
Headers can always be forged as to browser and OS. Attackers will
eventually figure it out and then you're back to the drawing board
again. As tempting as this
Hi,
I'm starting with SQLite and I would like to know if it is possible to
create user-defined data-types through the following SQL command: create
type MyType ... ?
In fact, I need it to map a database with an object-oriented model, so
that I could manage the objects in a ResultSet like it
On Tue, 30 Jan 2007, Mark Richards wrote:
Returning a link that expires in an email to the requester is a method
that works nicely. It does require some programming and maintenance, but
would be a nice gatekeeper.
Rather than this, I support the idea of an image with letters and digits
in
Mark Richards [EMAIL PROTECTED] wrote:
Headers can always be forged as to browser and OS. Attackers will
eventually figure it out and then you're back to the drawing board
again.
Everybody seems to assume that the problem is an attack. I
say that you should never attribute to malice
My server has been under heavy attack in the past few hours and I am
also looking for a way to lock out abusers. I am thinking of making a
change to tcpwrappers to identify abusers and place them on the deny
list. I want to permit mobile users to access services like POP3 but to
deny an
It may not be as innocent as you suspect. There are well organized
hacking schemes in China, with Chinese Government support in some cases.
One of these may have been practising on your site. The header is not
conclusive evidence of its origin.
[EMAIL PROTECTED] wrote:
Mark Richards
On Tue, 30 Jan 2007, [EMAIL PROTECTED] wrote:
Everybody seems to assume that the problem is an attack. I say that you
should never attribute to malice what can be explained by simple
stupidity.
In this context, Richard, I think your original idea of blocking the OS
and/or antique version of
Would not adding verification cause a problem for those include the
downloading of sqlite in bash/make files of certain apps.
Lloydie T
- Original Message -
From: Rich Shepard [EMAIL PROTECTED]
To: sqlite-users@sqlite.org
Sent: Tuesday, January 30, 2007 2:50 PM
Subject: Re: [sqlite]
Jef Driesen wrote:
Do I need to use sqlite3_close if the call to sqlite3_open indicated an
error? The documentation for sqlite3_open says An sqlite3* handle is
returned in *ppDb, even if an error occurs. So I assumed the answer is yes.
But if I try this code (on a non-existing file and no write
Sqlite is flexible in typing. You can create user defined types just by
declaring them in your SQL which creates tables. Thereafter the API
will return the declared type and the actual type so that you can
process it appropriately.
Jerome CORRENOZ wrote:
Hi,
I'm starting with SQLite and I
Jef Driesen wrote:
[EMAIL PROTECTED] wrote:
Jef Driesen wrote:
I did. sqlite3_close is called automatically for SQLITE_NOMEM, but not
for other cases. So I guess sqlite3_close is still needed. But then it
shouldn't return an error, or am I wrong?
I don't think any error other than
[EMAIL PROTECTED] wrote:
Something stupid like that. Maybe somebody can have a look
at the HTTP reply headers that www.sqlite.org issues and point
out any problems.
http://validator.w3.org/ reports a couple of minor problems (missing character
encoding, no DOCTYPE and a couple of spurious /p
[EMAIL PROTECTED] wrote:
Everybody seems to assume that the problem is an attack. I
say that you should never attribute to malice what can be
explained by simple stupidity.
I agree, it is quite probably an unintentional attack.
So my question is really more like this: Who will get upset
I am having a problem updating a table in one of two attached
databases. What I want to do is indicate in one table whether a name is
listed in a table in the other attached database. I am sure it is
simple but I can't get the UPDATE criteria to work properly.
Any help would be appreciated.
Roger Miskowicz wrote:
I am having a problem updating a table in one of two attached
databases. What I want to do is indicate in one table whether a name is
listed in a table in the other attached database. I am sure it is
simple but I can't get the UPDATE criteria to work properly.
Any
On Tue, 2007-01-30 at 12:58 +, [EMAIL PROTECTED] wrote:
Last night, a single user (or, at least, a single IP address)
in China that self-identified as running windows98 and
Mozilla 4.0 attempted to download sqlite-3.3.12.tar.gz
24980 times and sqlite-source-3_3_12.zip 25044 times
over
... or just a bug in the downloader. Imagine a disk full or
final-rename failure, which pongs back up to the download agent
which schedules a retry.
Some kind of banning, or rate limiting mod to the server side
seems like the right solution to me. This kind of problem
must have come up
what's the most reliable method for checking the size of the jounal
file for a database? is there anyway to flush that or sync it during
testing? i tried using stat() on the jounral file but under windows
it sometimes reports the jounral file having size 0 even though I know
it's not empty.
Shane Harrelson [EMAIL PROTECTED] wrote:
what's the most reliable method for checking the size of the jounal
file for a database? is there anyway to flush that or sync it during
testing? i tried using stat() on the jounral file but under windows
it sometimes reports the jounral file having
Hello all,
Question in a nutshell: My compiler can't handle typedef long long
(sqlite3.h) --- Is there a workaround?
Long Version:
I have built version 2.8.17 on my box. Did some limited testing
seems to work so far. Now I got 3.3.12. I did the usual untar,
configure, make.
On 1/30/07, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote:
Shane Harrelson [EMAIL PROTECTED] wrote:
what's the most reliable method for checking the size of the jounal
file for a database? is there anyway to flush that or sync it during
testing? i tried using stat() on the jounral file but
[EMAIL PROTECTED] wrote:
Hello all,
Question in a nutshell: My compiler can't handle typedef long long
(sqlite3.h) --- Is there a workaround?
There was an include file in /usr/include/sys, which is called xlong.h.
Inside there is a long note about how it addresses 64 bit expressions. I
Shane Harrelson [EMAIL PROTECTED] wrote:
Before I commit a transaction, I'm trying to measure the size of the
journal file to determine typical resource usage for my application.
The journal file for 1000 inserts on an empty database is much smaller
(as far as I can tell) then the journal
[EMAIL PROTECTED] wrote on 01/30/2007 02:42:11 PM:
[EMAIL PROTECTED] wrote:
Hello all,
Question in a nutshell: My compiler can't handle typedef long long
(sqlite3.h) --- Is there a workaround?
There was an include file in /usr/include/sys, which is called xlong.h.
Inside there
* Terry Jones:
Given 50K attempts in 5 hours, this is either a bug somewhere or it's
automated, likely the latter.
I've seen broken proxies which acted as accidental traffic amplifiers.
It's not necessarily a deliberate attack.
[EMAIL PROTECTED] wrote:
I probably should ask my question this way: What is the *safe* method for
32 bit machines to build Sqlite 3.3x?
Safe is relative. I know of a few companies that use the technique
I outlined earlier. But I have never personally tested a 32-bit build
so I cannot say
I fix computers for customers during evenings and weekends and I have
only have 2 customers (so far) using Windows 98. Nearly everyone, even
the many seniors among my clients, use Windowx XP and/or OS X.
I feel that banning Win 98 machines is therefore appropriate. Serious
developers wouldn't
Jerome CORRENOZ [EMAIL PROTECTED] wrote:
I'm starting with SQLite and I would like to know if it is possible to
create user-defined data-types through the following SQL command:
create type MyType ... ?
No.
Igor Tandetnik
I can see now what the trouble is if I do the SELECT without the INSERT OR
REPLACE (shortened):
select
t1.PATIENT_ID,
g2.ENTRY_ID,
g2.READ_CODE,
g2.TERM_TEXT,
g2.START_DATE,
g2.ADDED_DATE,
g2.NUMERIC_VALUE,
g3.ENTRY_ID,
g3.READ_CODE,
g3.TERM_TEXT,
g3.START_DATE,
g3.ADDED_DATE,
g3.NUMERIC_VALUE,
I've read through numerous discussions here about comparing values with null,
and how SQLite functions work with null values, and I thought I understood.
Now it seems appropriate to use the max(col1, col2) function to find the latest
of two dates (integer Unix times), and some rows will contain
There is no entry when I execute the below, yet the update acts as if
all is OK yet nothing is updated (works same if beginTransaction and
commit is uncommented).
What is interesting is that the reverse (eg INSERT attempted first works OK.
My concern (other than I what to know why it doesn't
--- RB Smissaert [EMAIL PROTECTED] wrote:
I can see now what the trouble is if I do the SELECT without the INSERT OR
REPLACE (shortened):
Can't suggest anything without seeing the schema for all the tables
involved and any unique indexes related to those tables.
It should work. Perhaps you're
Hi,
I just joined the newsgroup and started using SQLite.
I have a few questions related to SQLITE_BUSY and other error codes:
1. What API calls could return SQLITE_BUSY?
2. if the DB file already exists, to check the status of
sqlite3_open(...), should I only check if it returns SQLITE_OK?
Try setting sqlite3_int64 to just int and compiling with
-DSQLITE_32BIT_ROWID=1. That might work.
--
D. Richard Hipp [EMAIL PROTECTED]
So apparently your compiler cannot cast a double to type xlong_t.
That's because I did the earlier xlong stuff by hand. I can try your above
When the date was Tuesday 30 January 2007 16:53, [EMAIL PROTECTED] wrote:
So my question is really more like this: Who will get upset
if www.sqlite.org ceases to function for win98 users?
You can definitely answer this question based on server's logs but still,
banning users based on OS/UA
When the date was Tuesday 30 January 2007 03:29, P Kishor wrote:
On 1/29/07, Clark Christensen [EMAIL PROTECTED] wrote:
Puneet,
How about make doc? If you have TCL, that seems to generate the
HTML output in ./doc. If you don't, I'd be happy to send it to you.
Thanks Clark. I had, and
when i try to insert a row into a table that has a UNIQUE constraint
on a column, and I get the SQLITE_CONSTRAINT result code because i'm
inserting a duplicate value, is there anyway to determine the rowid of
the conflict?
looking at the internals of the VDBE, i found that the rowid of the
Your INSERT OR REPLACE statement is in error.
You have fewer columns in your SELECT clause than are specified
in your INSERT column name list. You should have seen an error like
this in SQLite version 3.3.12:
SQL error: X values for Y columns
Assuming PATIENT_ID is the sole unique key for
[EMAIL PROTECTED] wrote:
Thoughts anyone? Are there less drastic measures that might
be taken to prevent this kind of abuse?
It will take a little bit of work, but one solution is to start
throttling traffic for the relevant parties, increasing the throttling
the more they seem to abuse your
Jay Sprenkle wrote:
On 1/24/07, Jef Driesen [EMAIL PROTECTED] wrote:
Do I need to use sqlite3_close if the call to sqlite3_open indicated an
error? The documentation for sqlite3_open says An sqlite3* handle is
returned in *ppDb, even if an error occurs. So I assumed the answer is
yes.
I
John Stanton wrote:
This might help with Win32.
http://msdn2.microsoft.com/en-us/library/aa387694.aspx
That function is only available on Vista, but it includes a pointer to
CryptGenRandom which is on all Windows versions including Windows CE -
CE doc at
On 1/30/07, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote:
Thoughts anyone? Are there less drastic measures that might
be taken to prevent this kind of abuse?
A couple of people here mentioned CAPTCHA's. This is sort of the standard
for preventing automated abuse (intentional or
The basic rule is that the result of any comparison involving a
NULL value (including comparing against another NULL) is NULL.
See the following for the details:
http://www.sqlite.org/nulls.html
Dan.
On Tue, 2007-01-30 at 16:41 -0800, Clark Christensen wrote:
I've read through numerous
49 matches
Mail list logo
