Nice post! Seeing that you integrating with 2 different services, I'm wondering if you looked at other, more integrated, options? Mapbox, HERE and LocationIQ (shameless plug) are options that offer geocoding and maps.
@dbatten, LocationIQ team member here. We have a new API backed by a new geocoding engine that uses additional datasets (OA, GNAF, etc) currently in final stages of BETA. Could you shoot us an email at [email protected] and you can try it out. This should give you rooftop accuracy in a number of countries (US for sure) and street level accuracy in most others.
"So today, on the first day of our Birthday Week celebration, we make it official for all our customers: Cloudflare will no longer terminate customers, regardless of the size of the DDoS attacks they receive, regardless of the plan level they use. And, unlike the prevailing practice in the industry, we will never jack up your bill after the attack.
Doing so, frankly, is perverse.
We call this Unmetered Mitigation. It stems from a basic idea: you shouldn't have to pay more to be protected from bullies who try and silence you online. Regardless of what Cloudflare plan you use — Free, Pro, Business, or Enterprise — we will never tell you to go away or that you need to pay us more because of the size of an attack.
Cloudflare's higher tier plans will continue to offer more sophisticated reporting, tools, and customer support to better tune our protections against whatever threats you face online. But volumetric DDoS mitigation is now officially unlimited and unmetered."
Update: I sent an email to the email on that script. And the person at the other end replied and mentioned that he/she is doing it for extra pocket money and was only mining on the server.
We aren't going to pursue any legal charges, might even pay the person a bounty for pointing out this vulnerability.
I'd like to thank all of you, with special mention to some folks over at reddit for all your help!
We were able to get in touch with the hacker and he told us he was just mining and not stealing stuff. We're still cleaning the whole system; might even pay him/her a bounty for this though.
Yes, it's a Redis vulnerability (caused by bad config on our part) in one container where the firewall was down.
Strange thing if we run 'top' from the main host, all containers running redis say 'statd' as their user; inside the container the user showed 'redis'. We removed nfs and all related files, and now it shows a user ID number. Is this something we should worry about?
