Christian Haschek, an Austrian developer, writes about Raspberry Pi projects, security, self-hosting, and unusual experiments like heating a home with crypto mining.
HN links it for practical projects like the SSH-based comment system, zip bombs against bots, and mining crypto to heat a home.
I definitely agree bots are underserved, I have a few things I do to keep them entertained, ssh bots are tar-pitted to keep them connected but busy, my hope is that I occupy at least one thread of not the whole process.
For wp-login bots I serve them a nice chunk of random (generated by a fuzzer) html in the hopes that 1. It wastes abit of their bandwidth/memory and 2. it crashes their parser
In reality I guess bots nowadays are sturdy enough to not get stuck or crash but who knows, feels good to do something :-)
Tarpit instructions https://nyman.re/super-simple-ssh-tarpit/
Wp-login page https://twitter.com/gnyman/status/1181652421841436672?s=20
And I remembered another nice trick which someone else came up with, zip bomb the bots :-)
https://blog.haschek.at/2017/how-to-defend-your-website-with-zip-bombs.html
https://rom-o-matic.eu/ is a broken link.
https://blog.haschek.at/2020/the-perfect-file-server.html is made obsolete by SmartOS, which does the exact same thing, in addition to offering Triton (enterprise web GUI for virtual systems), OpenZFS (end-to-end data protection, ease of administration), zones (full-blown, running-at-the-speed-of-metal virtual UNIX servers), DTrace (for production-safe, real-time, deep machine state instrumentation and inspection), Bardiche (for building firewalls), FireEngine / Crossbow (high-performance TCP/IP stack for building virtual switches and routers) and imgadm(1M) / vmadm(1M) (for virtual server provisioning and software management), and last but not least, a reference implementation of the NFS V4 protocol.
When I started playing around with Raspberry Pi I had the problem that I had to re-solve problems I had solved before but couldn't remember quite how and had to re-google everything.
So I started my blog to document how I did it. This and work stories made it semi popular.
I added an email list last year and got a few thousand people signed up. Now I'm really concious about what to blog about or when I blog about something I am very hesitant to send the new post out to my subscribers. So that impacted me in a slightly negative way
https://blog.haschek.at
If you're reasonably certain that the request is being made by a malicious bot, you could try responding with a ZIP bomb [1] if HTTP 1.1 or newer is being used and the bot accepts compression. It can cause problems for several browser engines.
[1] https://blog.haschek.at/2017/how-to-defend-your-website-with-zip-bombs.html
This was the best blog I ever noticed on this topic,an Australian using exhaust air from their miners to pre-heat incoming air to their heat pump. TL;DR - it's worth it.
https://blog.haschek.at/2021/how-i-heat-my-home-by-mining.html
Not sure if your post is sarcastic but if not it already exists: https://blog.haschek.at/tools/bomb.php
Usually aimed against bots though: https://hackaday.com/2017/07/08/dropping-zip-bombs-on-vulnerability-scanners/