Botspam apocalypse

First, of course, you have cloudflare and recaptcha, which are free and very efficient, as the author say.

But even if you don't want to use them (some of my services don't), most bots are very dumb:

- require JS, and you lose half of the web ones

- silly tricks like hidden input fields in forms that worked in 2000 still work in 2022. Use a bunch of them, and you can yet again halve the bot traffic.

- many URL should have impossible to guess paths. E.G: just changing the /admin/ url to a uuid in django or the /wp-admin/ in wordpress, you save so many requests.

- bots are usually not tailored to your site, meaning if you require JS, you can actually embed anti-bot measure in the client code and they will work. E.G: exponential backoff + some heavy calculations if too many fast consecutive ajax requests.

- fail2ban + a few iptables rules (mitigate syn flood, etc) will help

- varnish + redis gets you very far to shave excess dummy traffic

It's not great, but it's not an apocalypse.

Unless you are under targeted attack.

Then it sucks and you die.

So the second browser is the solution. But then the site will do all the bad things that I wanted it not to do in the first place. Like serving terrible French results instead of good English ones, or assuming Firefox doesn't work based on UA while their site work fine with it. And of course track me to death, sell my data, and so on.

The only solution that works is to chose services you pay money for: they have your card, so they know you are not a bot. For years now, I have been suspicious of anything free. But it doesn't solve the tracking problem.

But there is a solution: the website team should get their act together and remove the "first come first served" aspect altogether.

Do you, citizen, want to register? Cool - leave your e-mail and we'll call you. Is the service optional? Then we'll pick at random from the pool of applicants and e-mail them. Is the service mandatory? Then sign up and we'll call you once you reach the top of the queue. Add a quick ID/credit card/whatever check on top (like good concert venues do), regular e-mail updates to let people know they haven't been forgotten, and you're done.

Any second year CS student could write such a system. The difficult part is accepting that the current approach doesn't work and looking for alternatives.

Although, surprisingly, I host such a service, and while it gets a constant stream of random hits, they're a minor nuisance. Probably because it's just the back end for a web page, and nobody bothers to target it specifically. Random web browsing won't find it, and the API will just return an error if called incorrectly. Even if it is called correctly, it has fair queuing on the service, so hammering on it from a small number of IP addresses won't do much.

That did happen once. Someone from a university was making requests at a high rate and not even reading the results. I noticed after a month, and wrote to their department chair, which stopped the problem.