Claude ex machina

I’ve been self-hosting part of my Internet footprint for over a decade. This website, my mail system, a personal wiki, my code repositories, you name it. I do this for two reasons: to be in control of my own data, and to learn by doing. After all:

“For the things we have to learn before we can do them, we learn by doing them.”

– Aristotle, The Nicomachean Ethics

My services are generally steady, as I’m not doing anything overly complicated. I run the stable release of Debian in a tiny virtual machine, and use packages from the official archives with unattended security upgrades. However, every now and then I have to deal with some instability. This is fine; it’s part of the trade-off of self-hosting.

The last adventure I had with service instability relates to this website. About a week ago I wanted to publish an article, and uploading it felt sluggish. This is rare, as I was publishing plain text, so it was a bunch of kilobytes at most. Shortly after, the whole server went down. No website, no code repositories, no remote access.

This was a strange event, as this server has been stable for years without any major maintenance required. Certainly, these incidents have a habit of popping up at the worst moments when I can’t be bothered, so I simply connected to the server provider and rebooted the virtual machine. Naturally, a few days later the same problem came back to haunt me.

I’ve debugged my fair share of problems throughout my computing life. After all, I keep systems reliable for a living. I could already smell the soil coming out of the rabbit hole I was about to get into. That’s not how I wanted to spend my weekend, so I did what’s nowadays natural in these situations: I started up an LLM assistant. Claude, in this case.

As a precaution, I don’t give LLMs direct access to my servers. Instead, I prepare debugging scripts that I can analyze and run at my own pace, and then I share the results with the assistant. After a few iterations with this approach, I understood the root cause. My web server and code repositories were being bombarded with requests. And, unsurprisingly, the requests were coming from automated web crawlers. The amusing part: the most abusive requester was ClaudeBot. In other words, my instance of Claude ratted Anthropic’s ClaudeBot out.

I have, of course, hardened my server configuration since then. These crawlers can be instructed to skip parts of, or all of, the website. My web service will now degrade early instead of hoarding all the memory of the server. The firewall will block any requester that makes multiple connections in a brief period of time. These are common defense mechanisms that have been around for years, but were not necessary for small websites with barely any traffic.

The web has become a more aggressive space. For better or for worse, the genie is out of the bottle.