121–130 of 172 posts
Earlier quoted context omitted.
What I do is simply check if CF-IPCountry header == "T1" and block those from being able to register accounts. T1 is Tor.
Do the same on the login page. You have to stop the bots from trying to brute force user accounts and passwords.
Earlier quoted context omitted.
Furthermore, as an expat living in Russia at the moment, it is quite surprising to one day be in an EU country and able to access any wide variety of sites, and the next day get a friendly message from Роскомнадзор telling me this website has been blocked for my protection or some other non-sense. I'm not involved in politics enough for it to be something very dangerous for me -- it's just non-sense things I want to…
For those wondering, "Роскомнадзор" is Russia's "Censorship Agency", Roskomnadzor[1]. If you are wondering, why is there a Censorship Agency in a country whose Constitution explicitly bans censorship[2], well... Let's just say it's not the first time in our history. Probably not the last. [1] https://en.wikipedia.org/wiki/Federal_Service_for_Supervisio... . [2] https://en.wikisource.org/wiki/Constitution_of_Russia#Ar…
But a lot of things that agencies like Роскомнадзор do are simply because it made someone a quick buck somewhere down the line. Many of my friends/colleagues work for businesses run by old men who are more interested in 10,000 rubles now than 100,000 rubles in a week. The decisions that Роскомнадзор and other government entities makes rarely have much more of a thought process beyond a simple "well, we wanted X". When the Telegram ban came into effect and folks outside of Russia were flabbergasted by Russia's choice to just block major parts of AWS, people came up with the most outrageous of theories as to what was happening. The simple and more accurate truth was probably that whoever made the decision at Роскомнадзор to do the blocks neither thought about the implications of such a decision nor had the technical knowledge to really understand it, and those underneath this person likely didn't have the will or inspiration to care, hence why the block is so trivial to bypass (like all the other blocks)
Like with many countries, a lot of old political methodology has to die off before Russia can really step forward, and while that is happening, it's why projects like Tor are essential for providing unmitigated access, whether it is a malicious block (Telegram) or a senseless one. That so many US companies just have a straight up IP block on all things Russia doesn't help to advance the situation past this stage at all.
I fully get the pain of a "bothersome captcha" but as a website operator (who's sites are behind cloudflare), there is a balancing operation. How much of the traffic out of Tor is legitimate, and how much is spammers, attackers and other script kiddies? For me, the answer is "very little legitimate". A better request for Cloudflare websites would be to put the CAPTCHA's just on actions that need protection. Reading a…
As a website operator too I don't see spammers, attackers and script kiddies from tor network with valid user agents (tor browser or mainstream up to date browsers). The worst I see in that traffic is very few people trying to post/upload something anonymously, but mostly it's just people trying to access a few pages anonymously. Bots and scrappers for some reason use fake user agents in tor network and just get 403s…
Earlier quoted context omitted.
Why not add a checkmark like this: "[ ] I support dictatorship and want to live under a dictatorship. I don't believe in freedom of speech or expression on any subject, even banal everyday subjects. For all subjects, I oppose freedom of the press, freedom of speech, and the right to read anonymously or express anonymous opinions, regardless of content. If in America, I oppose the fourth amendment ('[t]he right of the…
Wow, you just went way beyond the deep end. The mental gymnastics here is Olympic-level.
so in my sibling comment I suggested that all Tor users could be blocked, while making it clear that the operator does not support their rights.
I fully get the pain of a "bothersome captcha" but as a website operator (who's sites are behind cloudflare), there is a balancing operation. How much of the traffic out of Tor is legitimate, and how much is spammers, attackers and other script kiddies? For me, the answer is "very little legitimate". A better request for Cloudflare websites would be to put the CAPTCHA's just on actions that need protection. Reading a…
I fully get the pain of a "bothersome captcha" but as a website operator (who's sites are behind cloudflare), there is a balancing operation. How much of the traffic out of Tor is legitimate, and how much is spammers, attackers and other script kiddies? For me, the answer is "very little legitimate". A better request for Cloudflare websites would be to put the CAPTCHA's just on actions that need protection. Reading a…
It's not just Tor. This also affects VPN users. It has affected me. I wouldn't call my use of a VPN for privacy as "illegitimate."
If they observe that a high fraction of visitors from AWS / VPN / Tor exit IPs are attackers, they will add countermeasures.
i've often had more luck passing these captchas randomly selecting 4 boxes from the grid than trying to answer it intelligently. for example it often asks to select a sign -- does the signpost count? only 50% of the time... similarly, it might ask to select cars. does a bus count? there is no consistency, presumably because the training data is ambiguous. does it deter spam? yes, of course. so would a 404.