Back in the naughties PCLinuxOS was at #1 and people suspected them of cheating. I'm sure some people do try to game it, but there's plenty of organic and bot traffic to compete with.
Besides, I think the popularity thing's kinda backwards - I'd never visit Ubuntu or Fedora because I know what they are, but I'll be clicking on something novel out of curiosity.
As far as I know I made it up, but I stand ready to be surprised!
Distro watch rankings are just which page gets the most hits. Get a bunch of different IPs to load LemmyLinux and it'll be number one (and then actual people will click on it to see what it is and why it's number one).
How can I test if my phone uses hardware decoding for AV1?
Thinking there must be another way, I switched to Haproxy.
Hang on, weren't you on Haproxy already? Or do you mean you switched your attention to Haproxy? (If not, what were you in before?)
As others have said, blocking incoming stuff as high up as possible is definitely the right way, and Cloudflare is the right place for you. It's interesting that this bot wasn't caught by Cloudflare, I wonder who runs it.
I feel a company that big would write a more competent bot, but I also wouldn't be too astonished.
I was kinda hoping for another story about some clever compression bomb or similar to slow up the bot - after all, if it's hammering this little site it's surely doing the same to others, even if they haven't noticed yet. After the robots.txt was ignored I was sure, but I guess this mature, restrained response is probably the correct one *discontentedly kicks can down sepia street*
I went with Fedora on my VPS because I was also planning to use rootless Podman. Quadlets and running everything through systemd with SELinux enabled is working pretty well for me.
And are bugs harder to find than carefully hidden backdoors? No-one noticed the code being added and if it hadn't have had a performance penalty then it probably wouldn't have been discovered for a very long time, if ever.
The flip side to open-source is that bad actors could have reviewed the code, discovered Heartbleed and been quietly exploiting it without anyone knowing. Government agencies and criminal groups are known to horde zero-days.
Maybe millions of potential eyes, but all of them are looking at other things! Heartbleed existed for two years before being noticed, and OpenSSL must have enormously more scrutiny than small projects like xz.
I am very pro open source and this investigation would've been virtually impossible on Windows or Mac, but the many-eyes argument always struck me as more theoretical/optimistic than realistic.
Hmm, not really. It's only because it nerd-sniped someone who was trying to do something completely unrelated that this came to light. If that person has been less dedicated or less skilled we'd still probably be in the dark.
Same, I had to ad-block some custom elements on YouTube ages ago because they kept covering the screen with "related videos" whenever I paused to read something.