Live data from Hacker News

High-performance .NET by example: Filtering bot traffic

alexandrnikitin.github.io

11–20 of 54 posts

Re: High-performance .NET by example: Filtering bot traffic

#11
post #6

I'd probably store cached results for Dictinary > allowed, notAllowed; where int == length of the user agent. This should probably be blazing fast as well instead of keep doing those lookups.

A FST seems like a good fit for this problem. I believe it will be much more compact than the Aho-Corasick algorithm trie structure. Depends on the size of the dictionary.

I have that feeling too. But I found it harder to implement, especially with fallback failure references.

Re: High-performance .NET by example: Filtering bot traffic

#12
post #6

I'd probably store cached results for Dictinary > allowed, notAllowed; where int == length of the user agent. This should probably be blazing fast as well instead of keep doing those lookups.

I doubt that exactly that will work. There are tens of thousands of different UAs (maybe 100K). Perhaps some kind of tiny (few CPU cache lines) cache for most popular UAs could help. But again: measure, measure, measure :)

Publish your test set and I can look at it :)

Re: High-performance .NET by example: Filtering bot traffic

#15

Earlier quoted context omitted.

A FST seems like a good fit for this problem. I believe it will be much more compact than the Aho-Corasick algorithm trie structure. Depends on the size of the dictionary.

I have that feeling too. But I found it harder to implement, especially with fallback failure references.

I'd look for a library and not write one from scratch. Lucene [1] and OpenFST [2] are great implementations. I haven't used C#, so I don't know if bindings exist or not.

Also you may find this talk useful [3] (Particularly slide 11).

Great write up by the way. Really thorough on the benchmarking!

[1] https://lucene.apache.org/core/4_1_0/core/org/apache/lucene/...

[2] http://www.openfst.org/twiki/bin/view/FST/WebHome

[3] https://www.slideshare.net/lucenerevolution/text-tagging-wit...

Re: High-performance .NET by example: Filtering bot traffic

#16

Blocking access based on arbitrary user agent strings is a really bad idea. Every single bad bot will avoid known user agent strings or pretend to be Google, so you're only blocking well behaved ones. Plus there's thousands of browser versions out there, so there's a very good chance you're blocking some users for no reason. The proper way to do this is to block by IP, based on behavior. Block IPs slowing down the si…

> Every single bad bot will avoid known user agent strings

If I was writing a bot, I would set user agent to some well known and very popular value, i.e. newest Chrome on Windows, or something like that.

Re: High-performance .NET by example: Filtering bot traffic

#18

Rather than block on UA, just add some honeypots. An invisible link. Any bot that pulls that page gets blocked as scrapers tend to pull all links from the page and follow. Use the robots.txt to ban the pulling of specific pages. Bots 99% of the time ignore robots, so if they pull it: block Check how quickly pages are pulled. If passes a threshold: block

I've seen bot traffic claiming to be recent versions of Firefox from residential IPs in the Ukraine pulling robots.txt. Sometimes this is one of the few clues to go on.

Re: High-performance .NET by example: Filtering bot traffic

#19
post #13

Excellent post showing how to correctly improve code w.r.t. performance using the scientific method: hypothesis, measuring the baseline, change, measuring effect with real tools, real code. Thanks for sharing!

I also found it an interesting post in that it kind of inadvertently proves that for most situations you shouldn't optimise to this extent.

Meaning, yes, the OP got impressive performance improvements but the code is also completely unreadable and utilises unsafe code sections which could expose you to security problems/memory leaks/memory corruption. Not to mention they've recreated and will need to maintain an in-house version of the Dictionary class.

Their first optimisation (from Enumerator to List and Any() to Count()) are something every codebase could use. Most of their other optimisations make the code a maintenance minefield.

Plus programmers are expensive. Hardware is cheap. Why spent time on harder code to write that's also harder to maintain in the medium to long term when instead you could just throw money at hardware and call it a day? Just food for thought, not really a criticism in and of itself.

PS - Please don't take this post too seriously. I am not really being critical, just playing devil's advocate. I actually enjoyed the linked article a lot.

Re: High-performance .NET by example: Filtering bot traffic

#20
post #13

Excellent post showing how to correctly improve code w.r.t. performance using the scientific method: hypothesis, measuring the baseline, change, measuring effect with real tools, real code. Thanks for sharing!

I also found it an interesting post in that it kind of inadvertently proves that for most situations you shouldn't optimise to this extent. Meaning, yes, the OP got impressive performance improvements but the code is also completely unreadable and utilises unsafe code sections which could expose you to security problems/memory leaks/memory corruption. Not to mention they've recreated and will need to maintain an in-h…

I wonder if good VCS could solve this problem. For instance, if he documented each step with comments/commits in the code as well as he did for this blog post, it would be easy to go back and see not only why he did what he did, but the much more readable (albeit less performant) original code.

It seems like most git guis are pretty commit-focused. I'm not sure of any way to do it in the command line (though it must be possible) but it would be nice to highlight a section of code in your IDE and have git give you a history of just those lines (or that function) as far back as you want to go.

Post reply on HN