Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Botspam apocalypse

memex.marginalia.nu

Post reply on HN
Print view View original

141–150 of 358 posts

Re: Botspam apocalypse

#141

Post by jks »

toastal wrote: post #120
nixcraft wrote: post #95

I run a popular blog and confirm that spam is a massive issue. I am trying to keep the independent web alive with an old-school commenting system because it helps readers and myself improve outdated posts. My domain is over 20+ years old and attracts all sorts of threats, including monthly DDoS and daily spam. Using Cloudflare solved all of these problems. Next, you need to add firewall rules inside Cloudflare WAF to…

Putting everything 'behind Cloudflare' isn't a panacea. By merely living outside the West, I'm getting Geo blocked from 'normal' news sites and constantly having to solve hCAPTCHAs to solve riddles for some AI algo without compensation. It's such a burden and I find myself giving up pretty often. GeoIP blocking is what prevented me from getting my voter information out of my last domicile. Running everything through…

Does Cloudflare's "Privacy Pass" browser plugin help at all? It's advertised as reducing the number of hCaptchas you need to solve by a factor of 30, but I rarely see hCaptchas anywhere on my connection so I can't really evaluate myself.

Re: Botspam apocalypse

#142

Post by GeckoEidechse »

I wonder if a general solution could be to make the visit more computationally demanding to the visitor than to the host, e.g. some form of proof-of-work. I guess captchas already do that in some sense but they require the humans to do the work.

Now the author above has stated they dislike the crypto route and I agree that the whole web3 idea is bs but what if in the case that spam of some form is detected by the server, it requires the visitor to show some proof-of-work and combine that with the "mining crypto in JS instead of ads" craze. That way the bot would need to put work in which would slow it down and at the same time it would pay for its own visit.

No ofc no spam detection system is perfect and it would also hit human users but in their case it would be just a wait a few more seconds longer for page to load kinda case.

Re: Botspam apocalypse

#143

Post by nottorp »

jart wrote: post #38
BiteCode_dev wrote: post #33

Earlier quoted context omitted.

The first solution isn't practical (so many services to manually find a mail to send a message to, then interact with a human that might not even exist), and if you do, they don't whitelist you. I tried. Either they don't answer, or have "no way to have a specific whitelist for a single user in our system". So the second browser is the solution. But then the site will do all the bad things that I wanted it not to do…

Yes I understand the desire for capitalism rather than surveillance capitalism, but that's a derailment. The OP appears to be someone who just wants to build something cool and share it with other human beings. In that case, it's really helpful to be able to have a free practical way to address abuse. Would you really tell someone like the OP to stop expressing themself and shut down their service and put a paid one…

> The OP appears to be someone who just wants to build something cool and share it with other human beings.

Only thing is, you don't know if that statement is true. Or they could really be wanting to build something cool but take advantage of all those "free" services and basically sell you to Google and Facebook.

Re: Botspam apocalypse

#144

Post by GeckoEidechse »

TekMol wrote: post #11

Crypto currency mining could be the solution. If one request to the site generates more revenue than it costs in resources, the bot problem is solved. The author says that he is getting 15 bot requests to his site per second. That is about 36 million requests per month. How much does it cost to serve those? $1000 would seem high. $1000/36M = $0.00003 per request. How long would a crypto currency, that is suitable for…

As much as I hate the whole cryptocurrency hype myself, I think I agree that a proof-of-work requirement on spam detection that pays in the hosts favour could help solve spam to some degree.

Re: Botspam apocalypse

#145

Post by mobiclick »

MauranKilom wrote: post #93
probably_wrong wrote: post #35

Earlier quoted context omitted.

> I don't think there is a good solution besides a deep anti-bot expertise whithin the primary website development team But there is a solution: the website team should get their act together and remove the "first come first served" aspect altogether. Do you, citizen, want to register? Cool - leave your e-mail and we'll call you. Is the service optional? Then we'll pick at random from the pool of applicants and e-mai…

"Thank you for waiting three weeks for your appointment selection. We are happy to offer you a time slot next Friday, from 1 pm to 1:15 pm. Click here to accept: [button]. If this does not suit you, click here to get sent back to the queue: [button]." Half the point of these services tends to be giving users some choice in when they have to show up somewhere. Because not everyone can make time in the middle of busine…

Applicants specify their preferred time slots in decending order and the government agency chooses the time. This is how the my country does it.

Re: Botspam apocalypse

#146

Post by robalni »

JimWestergren wrote: post #133

I am running a website builder with > 20K sites. I use open contact forms without captcha. What worked for me is to use a one line javascript that places current timestamp in a hidden input field that is default 0. Then I check on the backend and if the value is either 0 or time to fill out and send the form is less than 4 seconds I block as spam. This blocks more than 99% of spam and also takes care of most human co…

If you don't want to require users to run javascript you should be able to make the server generate the timestamp.

Re: Botspam apocalypse

#147

Post by gkbrk »

Avamander wrote: post #108

It's annoying for sure. I deal with abuse at a large scale. I'd recommend: - Rate-limit everything, absolutely everything. Set sane limits. - Rate-limit POST requests harder. Preferably dynamically based on geoip. - Rate-limit login and comment POST requests even harder. Ban IPs that exceed the amount. - Require TLS. Drop TLSv1.0 and TLSv1.1. Bots certainly break. - Require SNI. Do not reply without SNI (nginx has 44…

> If you can, require HTTP/2.0. Bots break.

Non-bots break as well. I have Firefox configured to use HTTP/1.1 only.

No reason to chase Google's standard-of-the-day, HTTP/1.1 has worked for ages and it will continue to do so for the foreseeable future.

Re: Botspam apocalypse

#148

Post by lifeisstillgood »

1vuio0pswjnm7 wrote: post #127

"The rest are forced to build web services with no interactivity, or seek shelter behind something like Cloudflare, which discriminates against specific browser configurations and uses IP reputation to selectively filter traffic." Interactivity is not a must-have. The world's first general purpose computer, ENIAC, was not built for "interactivity". It was built to calculate ballistic trajectories, which were otherwis…

>>> Automation is not reserved for those providing "services". It also should be available to those using them.

Yes !

I call this software literacy. And yes - no matter how cool the JS on a major site, the fact that the sites goals are to keep me there and clicking and my goals are to get what I want with minimal action are in conflict.

I would suggest that bots are actually not a problem. For most things I would like a bot acting for me. Telling me as and when that I need to visit the dentist, who has slots free next weds and friday. Friday is best because I am also WFH that day.

The bot apocalypse is only one because we are trying to make a "web for humans" when actually a "web for bots, and a bot for a human" is a much better idea :/)

Re: Botspam apocalypse

#149

Post by lifeisstillgood »

I would suggest that bots are actually not the underlying problem. For most things I would like a bot acting for me. Telling me as and when that I need to visit the dentist, who has slots free next weds and friday. Friday is best because I am also WFH that day. The bot apocalypse is only one because we are trying to make a "web for humans" when actually a "web for bots, and a bot for a human" is a much better idea :/)

We need to redesign a web based on APIs, certificates, rate limits etc. And stop having "engagement" as a goal, and have "getting things done" as a goal

Edit: mucked up formatting

Re: Botspam apocalypse

#150

Post by sirshmooey »

gkbrk wrote: post #147
Avamander wrote: post #108

It's annoying for sure. I deal with abuse at a large scale. I'd recommend: - Rate-limit everything, absolutely everything. Set sane limits. - Rate-limit POST requests harder. Preferably dynamically based on geoip. - Rate-limit login and comment POST requests even harder. Ban IPs that exceed the amount. - Require TLS. Drop TLSv1.0 and TLSv1.1. Bots certainly break. - Require SNI. Do not reply without SNI (nginx has 44…

> If you can, require HTTP/2.0. Bots break. Non-bots break as well. I have Firefox configured to use HTTP/1.1 only. No reason to chase Google's standard-of-the-day, HTTP/1.1 has worked for ages and it will continue to do so for the foreseeable future.

Genuinely curious, why disable HTTP2? Your web browsing must be awfully slow sans multiplexing.
Post reply on HN