[03:58] heh, someone went and made another LP http://www.breakingnewsnews.org/ [04:11] bigjools: err... [04:12] and it's not using SSL [04:19] That's not another LP. [04:19] That's a sed over LP. [04:19] bigjools: It's much weirder than that [04:20] It's the live site AFAICS. [04:20] Yeah, that [04:20] Except s/Launchpad/Breakingnewsnews/ [04:20] wtf [04:20] huh yeah I wondered why it had the same bugs [04:20] bigjools: How did you find it? [04:20] Appeared in a Google search [04:21] which is a little worrying [04:21] Oh. [04:21] This isn't you trolling us? :) [04:21] Look at the whois on that domain. [04:21] heh I know [04:21] not even I would go to that trouble to troll you [04:22] What on earth. [04:22] oh of course it's a Queenslander. [04:22] this isn't that nutjob we had to ban I wonder ... [04:22] My initial thought was amhnews, indeed. [04:22] The entire domain is aliased. [04:22] bigjools: is Nobby Beach a real place? [04:23] http://qastaging.breakingnewsnews.org/ [04:23] http://blog.breakingnewsnews.org/general/launchpad-news-august-2015 [04:23] rings a bell [04:23] wgrant: WTF! [04:23] only in Australia would you have a place called Nobby Beach. [04:23] There's a place in England called Bell End [04:23] oh dear [04:23] http://pqm.breakingnewsnews.org/ doesn't work :( [04:23] I used to live near a place called Minge Lane [04:25] I'm increasingly convinced it is amhnews, as it's so inexplicable and has news in the name. [04:25] amhnews is the master of things that make no sense at all but appear not to be trolling. [04:26] He's been gone for like a year now, though. [04:26] I am sure a redirect can be placed in the Canonical Apache configs [04:26] seems like the work of a rogue, and somewhat confused AI. [04:26] redirect to goatse? :) [04:28] Also if you're logging request headers, maybe check for others... [05:30] It also inserts iframes into the pages it serves, and strips LP's JavaScript. [05:32] (And does other reprocessing of the "pass through parser and back" kind) [05:56] bigjools: blocking requested [05:56] eek [05:57] thanks cjwatson [05:57] I think I've got about as much as I can out of logs [05:58] are you logging request urls? [05:58] yes [05:58] well, paths, not URLs [05:58] ah - I was thinking you can block where the requested site is not launchpad.net [05:58] no, it's a proxy [05:59] oh, ok [05:59] it's requesting launchpad.net as far as we're concerned [05:59] jeez, that's evil [05:59] and then filtering (and caching) the results and returning them [05:59] if it weren't requesting launchpad.net or similar then our Apache would say nope [05:59] (not that I've actually checked but that seems highly likely) [06:00] the original request header is in the browser request header still? [06:00] I don't see why they'd do that [06:00] unless the proxy is munging that too [06:01] this is going to be more like a client/server pair than a legitimate proxy [06:01] it will be making its own requests constructed based on the ones it receives [06:01] right [06:01] what on earth is someone's motivation for that I wonder [06:01] my ticket title includes the string "incomprehensibly weird" [06:02] :) [06:04] (I can certainly tell it's making its own requests to at least some extent, based on User-Agent) === mup_ is now known as mup