ryguy wrote:Steve Sokolowski wrote:
I know that MiningRigRentals retries too often when someone uses invalid password arguments from a rental, and they have a limited number of IP addresses. I think that causes other renters to be banned if someone else was using an invalid username or password.
Doesn't that seem like a serious logic issue (and potential vector for malicious activity)? If this is true, then someone could intentionally rent a rig from MRR with bad credentials and get anyone that is renting there (or at least on that IP from MRR) to be banned from your pool. Why would you not just ban the connection with the bad credentials instead?
This isn't just a problem with MiningRigRentals; anyone who uses a shared connection can do that to other customers. Next week, we'll be aggressively submitting abuse reports to more ISPs.
There are a few customers who have submitted support tickets about this issue. I responded that the only choice was for them to switch hosting facilities, because the hosting provider did not respond to the abuse report filed against the other customer who was causing too many invalid authentication attempts on the same IP address. The only way to reasonably block traffic is to drop it at the router, because it takes too much CPU to process authentication requests, and both the good and the bad customers come from the same address.
Comcast, for all everyone has to say about their customer service, takes abuse reports seriously. We got three of their customers disconnected already. One of my goals over the next week is to go through all the addresses who are wasting resources and getting the residential customers disconnected who are calling checkPassword on the website or authorize on the mining server millions of times. I'm sure their husbands or wives or kids will be happy to learn they now can't get Internet service because they are running software to log into mining servers every millisecond.