Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Recreation.gov

recreation.gov

Post reply on HN
Print view View original

51–60 of 205 posts

Re: Recreation.gov

#51

Post by carty76ers »

peterangular wrote: post #25
rbritton wrote: post #14

Not reCAPTCHA, please. It’s horrendous in any environment that blocks any real amount of tracking. Rate limiting would solve the bot issue without inconveniencing regular users.

As someone with lots of anti-anti-botting knowledge - both are ineffective. Even if it's a "global rate limit" I'll find out the value (never ran into someone randomizing it) and jump on the web request faster than anyone else RIGHT as it comes up. With CAPTCHAs I'll bypass with a solving service and/or computer vision if it's easy, or even just get past the noCAPTCHA solutions with primed browser instances from cred…

> But don't kid yourself - that would not solve botting at all.

What would solve it? Or rather, what is the best defensive measure these days?

Re: Recreation.gov

#52

Post by ben174 »

reagan83 wrote: post #18
ben174 wrote: post #16

I worked in the bot defense space for quite some time, and it’s insane how much of the bot efforts were dedicated to getting camping spots. I’m happy to see this being recognized because I had many summers ruined because I couldn’t just get my old favorite camp spot.

Can you elaborate? This sounds interesting...

I don’t think it was some crazy bot net trying to make money off camping slots. It’s simply a bunch of Silicon Valley nerds that figured out how to automate the booking system for the most desirable camping spots in the bay. But a few of them got greedy I think. Not sure why.

One of my coworkers wrote a bot and shared it around the company. Not sure how far that bot spread but I’m sure other people did the same.

And by bot I mean a pretty trivial selenium script. The parks really should have had better defenses.

Re: Recreation.gov

#53

Post by svdr »

peterangular wrote: post #25
rbritton wrote: post #14

Not reCAPTCHA, please. It’s horrendous in any environment that blocks any real amount of tracking. Rate limiting would solve the bot issue without inconveniencing regular users.

As someone with lots of anti-anti-botting knowledge - both are ineffective. Even if it's a "global rate limit" I'll find out the value (never ran into someone randomizing it) and jump on the web request faster than anyone else RIGHT as it comes up. With CAPTCHAs I'll bypass with a solving service and/or computer vision if it's easy, or even just get past the noCAPTCHA solutions with primed browser instances from cred…

So what does help against bots?

Re: Recreation.gov

#54

Post by gitgud »

peterangular wrote: post #25
rbritton wrote: post #14

Not reCAPTCHA, please. It’s horrendous in any environment that blocks any real amount of tracking. Rate limiting would solve the bot issue without inconveniencing regular users.

As someone with lots of anti-anti-botting knowledge - both are ineffective. Even if it's a "global rate limit" I'll find out the value (never ran into someone randomizing it) and jump on the web request faster than anyone else RIGHT as it comes up. With CAPTCHAs I'll bypass with a solving service and/or computer vision if it's easy, or even just get past the noCAPTCHA solutions with primed browser instances from cred…

> But don't kid yourself - that would not solve botting at all.

Surely capatcha's and rate limiting raises the bar for people botting.

It couldn't make it any worse right?

Re: Recreation.gov

#55

Post by jachee »

peterangular wrote: post #25
rbritton wrote: post #14

Not reCAPTCHA, please. It’s horrendous in any environment that blocks any real amount of tracking. Rate limiting would solve the bot issue without inconveniencing regular users.

As someone with lots of anti-anti-botting knowledge - both are ineffective. Even if it's a "global rate limit" I'll find out the value (never ran into someone randomizing it) and jump on the web request faster than anyone else RIGHT as it comes up. With CAPTCHAs I'll bypass with a solving service and/or computer vision if it's easy, or even just get past the noCAPTCHA solutions with primed browser instances from cred…

I like how the sibling comments all expect an abuser to reveal how to prevent their abuse.

To paraphrase Sinclair: It is difficult to get a man to divulge how to prevent something, when his salary depends on his not preventing it.

Re: Recreation.gov

#56

Post by kortilla »

jachee wrote: post #55
peterangular wrote: post #25

Earlier quoted context omitted.

As someone with lots of anti-anti-botting knowledge - both are ineffective. Even if it's a "global rate limit" I'll find out the value (never ran into someone randomizing it) and jump on the web request faster than anyone else RIGHT as it comes up. With CAPTCHAs I'll bypass with a solving service and/or computer vision if it's easy, or even just get past the noCAPTCHA solutions with primed browser instances from cred…

I like how the sibling comments all expect an abuser to reveal how to prevent their abuse. To paraphrase Sinclair: It is difficult to get a man to divulge how to prevent something, when his salary depends on his not preventing it.

That’s not a paraphrase of Sinclair. Sinclair’s saying is about people not understanding something that conflicts with their income.

Refusing to give away a secret has absolutely no overlap with Sinclair’s saying.

Re: Recreation.gov

#57

Post by Semaphor »

xur17 wrote: post #43
big_chungus wrote: post #27

Earlier quoted context omitted.

The reason I hate recaptcha: it's not just a rate-limit for one site, but for the entire web. Run a google dork? You'll have to find three more fire hydrants the next time you're signing up for a service. Install an ad blocker? Six more fire hydrants. Log out of google? Twelve more. Heaven forbid if I _actually_ scrape something. Hitting one site harder than an average user shouldn't force me to fill out captchas on…

Yeah, I'm getting incredibly frustrated with it as well. I block tracking on the web, so I'm constantly doing multiple pages of free identification for Google. If I were building a bot for a site that uses captchas, I'd just use one of the many paid services that solve captchas. Last I checked, it was ~$0.003 per solve, hardly a blocker. To be honest, I wish I could easily use one of these solvers in my normal web br…

As someone who actually needs/wants to visit about 50% of the recaptcha-using sites: Do the audio challenge. Type something close, the audio challenge barely cares what you type, it has fewer repetitions than the image challenge and is just generally easier.

Re: Recreation.gov

#59

Post by mortdeus »

kristopolous wrote: post #40
xxpor wrote: post #35

Earlier quoted context omitted.

Found this: Duration of the performance-based contract will be three and a half years, with a total potential value of $128 million. It provides for additional options of up to 10 years. https://gcn.com/Articles/2004/08/09/USDA-awards-contract-for... Sooooo yeah.

The fetish we have with trying to private sector everything is a financial disaster. We can pay people to build it directly, it's ok. There doesn't need to be an unaccountable greased palm making $100 million in the background through some "public-private partnership". If the contractor makes a profit we pay more. If instead the government makes a profit, we pay less (see public banking for an example). Kinda funny h…

The government makes a profit? How does that work?

Re: Recreation.gov

#60

Post by mortdeus »

xxpor wrote: post #29

Lol at the copyright notice at the bottom. I notice the app is made by Booz Allen Hamilton. It's a shame we have to farm this stuff out to contractors and not use the USDS or 18F.

The last time the government tried to build a website inhouse.... Well we all know how funny that was. Ahh the good ol' days. Good times. Welp back to grind.
Post reply on HN