About the scraping incident and moving forward

First of all, sorry to leave you hanging about this topic for so long but I wasn't able to make enough free time to address the issue until now. There's really not much more to say about it, when I pointed you to the OPS news about their own incident in the update of the previous announcement it pretty much covered what was needed to be said. Still, there are a few details specific to us worth mentioning.

What happened?

On November 15th an unwelcomed guest tried and succeeded in downloading all of our torrents, which went unnoticed until the ghost leeching event that started on November 25th. It went unnoticed for so long because there were no monitoring tools for it and the measure that would have helped to slow down the bad actor... wasn't in place.

Back when VHSTapes was active I developed a torrent download rate limiter feature for its custom codebase, but when that site imploded, for security reasons, I decided to consider that instance radioactive and start from a clean, unmodified codebase, deciding to port my feature later, but I never did. I'll admit, this was a big blunder on my part. It sucks and I got nothing more to do but to sigh deeply and take the steps necessary to avoid something like this from happening again.

And just to confirm, to the best of my knowledge the same guys that hit OPS were also responsible for the attack here. They appear to only have come for the content and not user information, as far as I know.

What's next?

Now that the torrent download rate limiter is actually implemented, the probability of a similar attack repeating has gone way down but there's still more that can be done to really secure that aspect, and in the coming weeks I'll be working towards that. And while rudimentary, we also now have a way to keep an eye on ongoing scraping attempts, with further work to be done to better monitor such abuses.

What these new measures mean for you is that you are now limited to a certain number of torrent downloads per hour, depending on your user class. We've tried to strike a fair balance but lower classes may feel a bit restricted. Users of the Nostalgic Newcomer class can download 6 torrents per hour, Retro Rookies can download 12 per hour, Classic Collectors 24/hour, Analog Aces 36/hour, Monochrome Masters 48/hour, and Vintage Virtuosos 60/hour.

What's our current status?

I gather most should have already noticed that it's been a few days since the tracker is up and running again and downloads are re-enabled as well, so it's back to business as usual.

You can download and seed torrents again.

If you haven't taken any of the steps mentioned in the update of the previous announcement (changing client IP/port) I would still recommend you do it, just in case.

That's practically all I wanted to say, but before I ended it here I would like to say again that I'm sorry about what happened, I never should have let it happen and I hope it never happens again.

~astro