Userscripts.org

I think we are through the worst..

there are some scripts who set their updaters to check every 10 ms for updates (probably thinking setTimeout/setInterval took seconds instead of milliseconds).

I've added a layer of defense that adds rate limiting and should hopefully protect us.

I must sleep. I have a presentation tomorrow morning at work at 8am :(

Thanks for the great work!

I'm used to handling 100-200 dynamic req/s -- but 100x as much is much harder to do on a budget.

Wow... how stupid people can be. Thanks Jesse!

Thanks Jesse... you beat your estimate. :) Rest well.

Are you blocking or removing ill-behaving scripts like that?

Is there a way we can educate them better? Like, for instance, ask/force them to use the auto-updater that was produced earlier?

Thanks very much for the time and effort you put into this site. The downtime just highlighted how very useful it is :)

Wow. Even checking for updates every 10 seconds is extreme. 10 minutes even seems unnecessary. My scripts check just once a day.

Thanks Jesse... I was about to go crazy.

edit: adapted the userscripts updater

i think you need to implement something which checks to see if a new script submission has a reference to userscripts.org/scripts/source/*.user.js and either reject it or flag it for inspection before making it available.

@Jesse Andrews,

I just had to click the install button 3 times in DOMNotify just to get one of my scripts updated and installed... 503 Service Temporarily Unavailable... Between the update notice and the actual click was about 15-20 seconds or so... I am running a few extra scripts that do meta.js calls and one that does a HEAD request to the user.js which might be the catalyst for USO triggering the failure. Anyhow... more incentive (up to several now ;) for adding @uso:unlisted yet so I don't have to do a HEAD call? ;) Thanks :)

That would give lots of false positives I'm afraid. Just checked one of mys scripts, I have two lines like this:

var UPDATE_CHECK_URL = 'http://userscripts.org/scripts/source/27106.meta.js';
var INSTALL_URL = 'http://userscripts.org/scripts/source/27106.user.js';

This would trigger the code for moderation and would require someone to check that it behaves.

But on the other hand, if that someone would be the scriptwriter himself.
It should probably open up a new page where I have to check a box saying "My script does not reference itself to check for updates".

So maybe some sort of self-check could be in place?

Photodeus wrote:
I have two lines like this:

Photodeus wrote:
So maybe some sort of self-check could be in place?

Photodeus wrote:
But on the other hand, if that someone would be the scriptwriter himself.
It should probably open up a new page where I have to check a box saying "My script does not reference itself to check for updates".

1nfected wrote:
But that would still leave the door open for miscreants/careless/lazy ppl.

Marti wrote:

1nfected wrote: But that would still leave the door open for miscreants/careless/lazy ppl.

True but they'd be immediately unlisted because they double accepted a TOS if they slip... This issue is affecting even the major updaters now since the caching isn't quite tweaked. Sir Jesse could draw his blade and cast off the demons... sorry... imagination running away today ;)

1nfected wrote:
but what about the ppl who'd have already installed it before it got unlisted?

@Jesse Andrews,
Something I've also just noticed is when a RSS feed is being updated it fails script execution. I have about 30ish items from USO and that prevents any script that is doing an HEAD request and even installation of new scripts because the "Pain and Rate limiting" thinks it's being attacked... Might want to exclude or loosen up the RSS feeds from the equation as well as the HEAD requests.