so recently my server has unintentionally been inside a DDoS of my own making. any smaller webserver i point my domain at becomes instantly crippled. let me explain the situation...

so i make minecraft mods, right. well, at one point, i made this library mod called CICADA, that has a bunch of shared utilities i use. this is pretty common practice

then once i had that, i realized, hey! why not make a funny thing in this library mod that gives my own minecraft character a cape when anyone sees me! that would be kinda neat.

it couldnt just be simply hardcoded though of course, so i had a genius plan. i would put a simple "api" of sorts up on github pages that would have directories for all the players that i want to have capes. the mod can do a quick http request in the background, and if it doesnt return a 404, load the cape from the png thats returned to display on the player

now you might wonder, this is a perfect idea is it not? how could this possibly have caused any issues? ...yea i think you can roughly guess where this went

for the github pages thing, i used the one domain i had available at the time:
enjarai.dev. now, you may notice that this currently hosts my personal website. which is no longer on github pages.

when i made this migration, i realized something quite concerning. my mods are
popular.

my servers cpu was consistently pinned at 100% over 4 cores, and i was getting...
checks notes thousands of GET requests a second. 24/7. neither me nor my server were very happy about this as you might imagine

for quite a while, i've honestly just kinda... put up with this. there didnt seem to be anything i could do, short of just not using my domain or migrating back to github, neither of which i wanted

its been getting worse and worse though, my disk is filling up with access logs within literal hours after clearing them (so i had to disable those) and im running out of bandwidth quota on my VPS every month. something needs to change

so i shared my problem with a bunch of friends last night, and we brainstormed the hell out of this. after a lot of ideas, including potentially sending malformed PNGs to crash people's games and force them to update the mod (which turned out not to be feasible), i landed on a pretty decent solution i think

everyone using an old version of CICADA will now see this cape. on every single player

i really hope this works, cause if not, im kinda out of ideas

will keep yall posted
@enjarai hi everyone the crash png was my idea. as for the feasibility, i suspect it's possible to make a png that has ~4000x compression ratio without using http compression, so it's not completely infeasible
@enjarai well, not actually 4000x compression. the compression would actually be pretty terrible at 125x ideal compression, but it would cause the game to try to allocate a buffer that's 4000x the size of the png file
@enjarai for context you can usually achieve 1000x ideal compression with zlib deflate streams, which a huge black rgba png file would hit