Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Botspam apocalypse

memex.marginalia.nu

Post reply on HN
Print view View original

41–50 of 358 posts

Re: Botspam apocalypse

#41

Post by efitz »

BiteCode_dev wrote: post #31

It's not that bad. First, of course, you have cloudflare and recaptcha, which are free and very efficient, as the author say. But even if you don't want to use them (some of my services don't), most bots are very dumb: - require JS, and you lose half of the web ones - silly tricks like hidden input fields in forms that worked in 2000 still work in 2022. Use a bunch of them, and you can yet again halve the bot traffic…

Also, attackers are rarely going to try to guess your URLs - they’re going to find them via Google or Shodan, or, if you’re a good rest citizen, via “//“

Re: Botspam apocalypse

#42

Post by s1k3s »

Animats wrote: post #39

What's hard to do now is host a lightly used but broadly interesting service that doesn't require a login. Although, surprisingly, I host such a service, and while it gets a constant stream of random hits, they're a minor nuisance. Probably because it's just the back end for a web page, and nobody bothers to target it specifically. Random web browsing won't find it, and the API will just return an error if called inc…

Yes, this is why I plan to take down my hobby projects. And it's not only bots, real people do it as well. Apparently some people have a passion for screwing up other people's work. Some even email me afterwards asking for money to disclose a bug they found.

Re: Botspam apocalypse

#43

Post by prox »

onefuncman wrote: post #28
JohnJamesRambo wrote: post #25

What is the reason behind bots spamming marginalia? What’s the motivation? What do they gain? I always wonder about these things.

I want to run a honeypot for doing more research on bots and the economics for them, but I get bogged down quickly in the planning stages. I should just start with a vulnerable wordpress site or something.

Wordpress is perfect for this. The amount of bots trying to get in is insane. Like up to 80 login tries on some days for a small potato website.

There are also some vulnerable plugins still out there if you actually want them to hack it.

Re: Botspam apocalypse

#44

Post by s1k3s »

kazinator wrote: post #15

In the 1980's, we kept anklebyters off dial-up BBSses with a simple technique: voice validation. To join the forum, you had to fill an application first, which included your real name and phone number. The sysop would give you a call for a quick chat, and then grant you access if you didn't seem like a twit. This would be entirely practical for some small-time operator trying to run a forum off residential broadband,…

I guess it's a different time and it also depends on who's your target audience. Some people go crazy if you ask for their email address. Phone numbers and calling is a big no-no.

Re: Botspam apocalypse

#45

Post by jart »

paulmd wrote: post #2

> They're a major part in killing off web forums, and a significant wet blanket on any sort of fun internet creativity or experimentation. > The only ones that can survive the robot apocalypse is large web services. Your reddits, and facebooks, and twitters, and SaaS-comment fields, and discords. They have the economies of scale to develop viable countermeasures, to hire teams of people to work on the problem full ti…

> it costs 10 bux to register an account, if you're a nuisance your account is banned and you pay 10bux to get back on.

You've highlighted its biggest tradeoff which is that it creates an economic incentive to ban people. The only way to make more money, is to have more rules and culture for ostracizing people. It would have been smarter of Something Awful (since that's the site we're talking about) to charge $4/month or something.

Re: Botspam apocalypse

#46

Post by BiteCode_dev »

jart wrote: post #38
BiteCode_dev wrote: post #33

Earlier quoted context omitted.

The first solution isn't practical (so many services to manually find a mail to send a message to, then interact with a human that might not even exist), and if you do, they don't whitelist you. I tried. Either they don't answer, or have "no way to have a specific whitelist for a single user in our system". So the second browser is the solution. But then the site will do all the bad things that I wanted it not to do…

Yes I understand the desire for capitalism rather than surveillance capitalism, but that's a derailment. The OP appears to be someone who just wants to build something cool and share it with other human beings. In that case, it's really helpful to be able to have a free practical way to address abuse. Would you really tell someone like the OP to stop expressing themself and shut down their service and put a paid one…

I understand all causes and consequences of this problem, and I'm not implying there is an easy solution, only underlying that using "the user is lying" will lead to frustrating false positives.

Re: Botspam apocalypse

#47

Post by sparkling »

BiteCode_dev wrote: post #31

It's not that bad. First, of course, you have cloudflare and recaptcha, which are free and very efficient, as the author say. But even if you don't want to use them (some of my services don't), most bots are very dumb: - require JS, and you lose half of the web ones - silly tricks like hidden input fields in forms that worked in 2000 still work in 2022. Use a bunch of them, and you can yet again halve the bot traffic…

Very nice list of countermeasures. I agree that doing these small things like hidden input fields really go a long way.

I would add to that:

- block signups/comments from known throwaway email domains

- block known datacenter IP ranges, at least for POST requests. Honestly on our sites 50% of spam was coming from AWS EC2 IPs

- use a proxy/vpn/bot detection service like https://focsec.com

Re: Botspam apocalypse

#48

Post by krageon »

jart wrote: post #22
BiteCode_dev wrote: post #17

Earlier quoted context omitted.

My laptop is lying all the time. I change my UA, preferred language, my ip, mac and so on, because of tracking, terrible dev assumptions and personal preferences. Yet, I'm a very good web citizen. Because of this, I often have to solve the same captcha many times before it thinks I'm human.

I don't doubt it. Given how rare people like you are, I'm sure a good citizen like you would also be perfectly fine sending an email to the service asking to be whitelisted, or having a second browser that isn't your daily driver for situations like this that doesn't try to obfuscate its identity by behaving like a bot.

I won't lie, if you make an asshole system that bans me for doing perfectly normal things that make the internet work I'm going to assume I don't want to interact with it anyway.

Re: Botspam apocalypse

#49

Post by krageon »

unglaublich wrote: post #14
jart wrote: post #8

This kind of botspam is usually pretty easy to address with redbean using the finger https://redbean.dev/#finger and maxmind https://redbean.dev/#maxmind modules. The approach I usually recommend people isn't so much ip reputation, which can be unfair, but rather it allows you to find evidence of clients lying to you. For example, if the User-Agent says it's Windows with a language preference of English, but the TCP…

What keeps bots from just fixing their acts and reporting correct info instead?

Nothing. Once this sort of fingerprinting becomes common the common bot frameworks will bypass it.

Re: Botspam apocalypse

#50

Post by jart »

krageon wrote: post #48
jart wrote: post #22

Earlier quoted context omitted.

I don't doubt it. Given how rare people like you are, I'm sure a good citizen like you would also be perfectly fine sending an email to the service asking to be whitelisted, or having a second browser that isn't your daily driver for situations like this that doesn't try to obfuscate its identity by behaving like a bot.

I won't lie, if you make an asshole system that bans me for doing perfectly normal things that make the internet work I'm going to assume I don't want to interact with it anyway.

Then what would you propose that's better?
Post reply on HN