Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Botspam apocalypse

memex.marginalia.nu

Post reply on HN
Print view View original

11–20 of 358 posts

Re: Botspam apocalypse

#11

Post by TekMol »

Crypto currency mining could be the solution.

If one request to the site generates more revenue than it costs in resources, the bot problem is solved.

The author says that he is getting 15 bot requests to his site per second. That is about 36 million requests per month. How much does it cost to serve those? $1000 would seem high.

$1000/36M = $0.00003 per request.

How long would a crypto currency, that is suitable for mining in the browser, need to be mined before $0.00003 is generated?

If it turnes out it is a few seconds or so, the solution would be nicely user friendly. A few seconds of CPU time for access to the site. No ads needed to finance the site.

It is kind of telling, that Bitcoin started as a spam blocker. The original "hashcash" use case was to use proof of work to prevent email spam.

Re: Botspam apocalypse

#12

Post by x-complexity »

nneonneo wrote: post #10
x-complexity wrote: post #4

> The other alternatives all suck to the extent of my knowledge, they're either prohibitively convoluted, or web3 cryptocurrency micro-transaction nonsense that while sure it would work, also monetizes every single interaction in a way that is more dystopian than the actual skull-crushing robot apocalypse. In the interest of practicality: There's a way to go the web3 route without being laden with transactions: - Min…

Do you mint one new NFT per site? Then you impose an excessive burden on users per new site they visit. Do you mint one NFT per address? If blocking only applies to the one site, a malicious operator can just spam the next site using that address - after all, they own tons of addresses and have many sites to spam, and they can surely spam for at least a bit before getting caught (per site and per address). If blockin…

In all honesty, there's limited tooling to resolve the botspam issue: There's nothing special about a human that a curated algorithm/botfarm can't sufficiently mimic. No technology is the panacea to this solution.

The only way out is to increase the costs for bots to such an extent that it becomes costly for them to operate. The methodology for performing this is still up for debate, but tracking of some form will have to exist (be it publicly-collated or privately-monitored or some blend of both).

Re: Botspam apocalypse

#13

Post by Nextgrid »

> The only ones that can survive the robot apocalypse is large web services. Your reddits, and facebooks, and twitters, and SaaS-comment fields, and discords. They have the economies of scale to develop viable countermeasures, to hire teams of people to work on the problem full time and maybe at least keep up with the ever evolving bots.

I only agree when it comes to the system resources that can keep up with bots. When it comes to fighting spam, these services often do a terrible job because 1) their business model benefits from higher user & engagement numbers and 2) their monopoly status affords them to retain users even if their experience is degraded by the spam, something a small site often won't be able to do.

Re: Botspam apocalypse

#14

Post by unglaublich »

jart wrote: post #8

This kind of botspam is usually pretty easy to address with redbean using the finger https://redbean.dev/#finger and maxmind https://redbean.dev/#maxmind modules. The approach I usually recommend people isn't so much ip reputation, which can be unfair, but rather it allows you to find evidence of clients lying to you. For example, if the User-Agent says it's Windows with a language preference of English, but the TCP…

What keeps bots from just fixing their acts and reporting correct info instead?

Re: Botspam apocalypse

#15

Post by kazinator »

In the 1980's, we kept anklebyters off dial-up BBSses with a simple technique: voice validation. To join the forum, you had to fill an application first, which included your real name and phone number. The sysop would give you a call for a quick chat, and then grant you access if you didn't seem like a twit.

This would be entirely practical for some small-time operator trying to run a forum off residential broadband, while impractical for the reddits, facebooks and twitters.

Re: Botspam apocalypse

#16

Post by Nextgrid »

paulmd wrote: post #2

> They're a major part in killing off web forums, and a significant wet blanket on any sort of fun internet creativity or experimentation. > The only ones that can survive the robot apocalypse is large web services. Your reddits, and facebooks, and twitters, and SaaS-comment fields, and discords. They have the economies of scale to develop viable countermeasures, to hire teams of people to work on the problem full ti…

There are (at least) 2 kinds of spam - "technical" spam such as bots hammering the web service with requests and consuming resources, and the commonly-accepted definition of spam where bots post promotional or other obnoxious content.

I feel like the article here talks more about the first kind. I do agree with your solution for the second kind of spam though.

Re: Botspam apocalypse

#17

Post by BiteCode_dev »

jart wrote: post #8

This kind of botspam is usually pretty easy to address with redbean using the finger https://redbean.dev/#finger and maxmind https://redbean.dev/#maxmind modules. The approach I usually recommend people isn't so much ip reputation, which can be unfair, but rather it allows you to find evidence of clients lying to you. For example, if the User-Agent says it's Windows with a language preference of English, but the TCP…

My laptop is lying all the time. I change my UA, preferred language, my ip, mac and so on, because of tracking, terrible dev assumptions and personal preferences.

Yet, I'm a very good web citizen.

Because of this, I often have to solve the same captcha many times before it thinks I'm human.

Re: Botspam apocalypse

#18

Post by jart »

unglaublich wrote: post #14
jart wrote: post #8

This kind of botspam is usually pretty easy to address with redbean using the finger https://redbean.dev/#finger and maxmind https://redbean.dev/#maxmind modules. The approach I usually recommend people isn't so much ip reputation, which can be unfair, but rather it allows you to find evidence of clients lying to you. For example, if the User-Agent says it's Windows with a language preference of English, but the TCP…

What keeps bots from just fixing their acts and reporting correct info instead?

What's stopping them from clubbing you with a monkey wrench? With bots, to answer your question, it'd probably take another standard deviation in the IQ of the person using it. So you've ruled out all the script kiddies in the world by default. The purpose of this game isn't to have a perfect defense, which is impossible, but rather to make the list of people who can mess with you as short as possible.

Re: Botspam apocalypse

#19

Post by riscy »

x-complexity wrote: post #4

> The other alternatives all suck to the extent of my knowledge, they're either prohibitively convoluted, or web3 cryptocurrency micro-transaction nonsense that while sure it would work, also monetizes every single interaction in a way that is more dystopian than the actual skull-crushing robot apocalypse. In the interest of practicality: There's a way to go the web3 route without being laden with transactions: - Min…

> Mint a fixed-cost non-transferrable NFT to an address, with ownership limit of 1 per address. - Use SIWE (sign-in with Ethereum) to verify ownership of address & therefore NFT. - If malicious behaviour is detected, mark the NFT as belonging to a malicious actor at the server's end & block the account. - Require non-malicious-marked NFTs in order to use the site/app.

In the real world that's called a paywall. Just requires users have an email address (wallet address) and proof of payment (NFT). Web3 contributes nothing but a different lingo for the existing concepts, yet has all of the same problems: nobody likes paywalls.

Post reply on HN