Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Botspam apocalypse

memex.marginalia.nu

Post reply on HN
Print view View original

131–140 of 358 posts

Re: Botspam apocalypse

#131

Post by BiteCode_dev »

SyneRyder wrote: post #75
BiteCode_dev wrote: post #31

It's not that bad. First, of course, you have cloudflare and recaptcha, which are free and very efficient, as the author say. But even if you don't want to use them (some of my services don't), most bots are very dumb: - require JS, and you lose half of the web ones - silly tricks like hidden input fields in forms that worked in 2000 still work in 2022. Use a bunch of them, and you can yet again halve the bot traffic…

> First, of course, you have cloudflare and recaptcha, which are free and very efficient, as the author say. Recaptcha has been almost useless, in my experience. If you read the spam logs, you'll quickly learn about the spam software they (claim to) use to bypass Recaptcha, because that's what they end up promoting. I started tagging in logs if Recaptcha had validated on messges, and sure enough these spam posts had…

Those are very specific bots, recaptch will stop a lot of casual ones. Most of them in fact.

Re: Botspam apocalypse

#132

Post by BiteCode_dev »

raverbashing wrote: post #96
efitz wrote: post #41

Earlier quoted context omitted.

Also, attackers are rarely going to try to guess your URLs - they’re going to find them via Google or Shodan, or, if you’re a good rest citizen, via “/ /“

Any website gets probed for wp-admin.php etc, even if you don't use WP

In fact, if someone is probing for wp-admin, you should insta ban them, no matter the site.

Re: Botspam apocalypse

#133

Post by JimWestergren »

I am running a website builder with > 20K sites. I use open contact forms without captcha. What worked for me is to use a one line javascript that places current timestamp in a hidden input field that is default 0. Then I check on the backend and if the value is either 0 or time to fill out and send the form is less than 4 seconds I block as spam. This blocks more than 99% of spam and also takes care of most human copy paste spam as well.

Re: Botspam apocalypse

#134

Post by realaravinth »

titaniczero wrote: post #125
realaravinth wrote: post #67

Earlier quoted context omitted.

Hello! I'm the author of mCaptcha, I'd be happy to answer any questions that people might have :)

It looks great, as a suggestion: Instead of an easy mode and advanced one I would use a single mode with a calculator, that way it is more transparent to the user and it would make the process of learning the advance mode and concepts easier. Also, here: https://mcaptcha.org/ , under the "Defend like Castles" section, I think you meant "expensive", not "experience". Keep up the good work!

Thank you for the kind words!

> Instead of an easy mode and advanced one I would use a single mode with a calculator, that way it is more transparent to the user and it would make the process of learning the advance mode and concepts easier.

Makes sense, I'll definitely think about it. The dashboard UX needs polishing and this is certainly one area where it can be improved.

> Also, here: https://mcaptcha.org/, under the "Defend like Castles" section, I think you meant "expensive", not "experience".

Fixed! There are a bunch of other typos on the website too, I can't type even if my life depended on it :D

Re: Botspam apocalypse

#135

Post by dtgriscom »

tpoacher wrote: post #122
remram wrote: post #40

Earlier quoted context omitted.

> bots hammering the web service with requests and consuming resources I've never seen this referred as "spam". Denial of service, botting, scraping, sure, but does anyone call that spam?

It's spam from a server owner's point of view in the broader sense, in that it is "junk requests" instead of legitimate requests, they can be sent as a flood at no cost or consequence to the senders, and it's up to you as the recipient to find a way to filter it all to separate the wheat from the chaff. It's certainly not denial of service, that means something far more specific. One could call it "scraping", but I'd…

> And "botting" is not a word. :)

It is now! OED, here we come.

Re: Botspam apocalypse

#136

Post by randunel »

viraptor wrote: post #119
matkoniecz wrote: post #97

Earlier quoted context omitted.

What alternatives you recommend?

It depends on your audience and regions you're most interested in. But if you're aiming for the EU, gcore labs may be interesting. Akamai is not bad, but a bit enterprisey - I don't think they even had an official api the last time I used them?

None of those are free, though.

Re: Botspam apocalypse

#137

Post by greazy »

SmileyJames wrote: post #87

I thought a plan for spam had solved this one? http://www.paulgraham.com/spam.html Has NLP progressed rendering Paul's plan a failure? Am I a bot? How about you? Does it matter if I make valuable contributions?

Spam and bots eating traffic are two different things.

Re: Botspam apocalypse

#138

Post by bambax »

tpoacher wrote: post #122
remram wrote: post #40

Earlier quoted context omitted.

> bots hammering the web service with requests and consuming resources I've never seen this referred as "spam". Denial of service, botting, scraping, sure, but does anyone call that spam?

It's spam from a server owner's point of view in the broader sense, in that it is "junk requests" instead of legitimate requests, they can be sent as a flood at no cost or consequence to the senders, and it's up to you as the recipient to find a way to filter it all to separate the wheat from the chaff. It's certainly not denial of service, that means something far more specific. One could call it "scraping", but I'd…

But supposing it's not purely malicious, what's the benefit to the spammer?

Re: Botspam apocalypse

#139

Post by nottorp »

mjevans wrote: post #52
s1k3s wrote: post #44

Earlier quoted context omitted.

I guess it's a different time and it also depends on who's your target audience. Some people go crazy if you ask for their email address. Phone numbers and calling is a big no-no.

I'm one of those radical militants who refuses to give up any means of direct contact... However for a small scale thing I'd gladly go visit at a face to face meetup to fulfill this type of validation.

> However for a small scale thing I'd gladly go visit at a face to face meetup to fulfill this type of validation.

Even if it were 3 flights totalling 18 hours away? :)

Or even just from one coast of the US to another...

Re: Botspam apocalypse

#140

Post by naillo »

JimWestergren wrote: post #133

I am running a website builder with > 20K sites. I use open contact forms without captcha. What worked for me is to use a one line javascript that places current timestamp in a hidden input field that is default 0. Then I check on the backend and if the value is either 0 or time to fill out and send the form is less than 4 seconds I block as spam. This blocks more than 99% of spam and also takes care of most human co…

I like this solution because spammers are unlikely to try to get around it. A delay eats into their time budget and they can't introduce a human-like waiting time on every site they try to spam, better to just move on to find cheaper targets.
Post reply on HN