Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Botspam apocalypse

memex.marginalia.nu

Post reply on HN
Print view View original

201–210 of 358 posts

Re: Botspam apocalypse

#201

Post by Suzuran »

Lex-2008 wrote: post #174
12907835202 wrote: post #109

For my forum with 500k users a month I just added a registration captcha related to my niche. E.g. for a Dark Souls forum it would say "what game is this forum about?" And if you got it wrong the validation would include "tip it's just two words D rk S*ls". This reduced spam by over 99% and didn't annoy people with recaptcha. If someone was unable to get past that captcha (it still happens I have logs!) I figured the…

re: someone was unable to get past that captcha - this reminded me a story I heard back in ICQ times about some human who couldn't pass anti-bot question: "What planet do we live on?"

I remember a friend's con-group forums who had an issue along these lines - the anti-bot question was "What is the brightest thing in the sky at noon?" the expected answer was "the sun", but some guy got stuck because he was answering "Sol". Since they had an IRC channel the issue was relatively quickly resolved, but it was an in-joke for some time.

Re: Botspam apocalypse

#202

Post by swinglock »

TekMol wrote: post #176
kragen wrote: post #151

Earlier quoted context omitted.

Satoshi Nakamoto almost certainly isn't Adam Back. It might be enough for the request to require more resources from the requestor than from the server, even if it doesn't actually give the server any money. I mean the requestor probably isn't going to be willing to dedicate more hardware "horsepower" to taking your search engine down than you are to keeping it up. That was the idea behind Hashcash. As for coins, the…

I have not seen any arguments yet, why Satoshi is not Adam. I did say "crypto currency, that is suitable for mining in the browser" for exactly this reason: That Bitcoin is not well suited for it. One would have to look at what typical consumer hardware is good at. Maybe an algorithm that saturates one CPU core with serial calculations that need fast access to exactly 1GB of RAM. I think consumer hardware is pretty g…

You'd only need lightning integration and paying a small amount of sats, recycling the Bitcoin proof of work instead of making more. You could even have the server transfer the same sats back and forth as a token as long as the server side is happy.

Re: Botspam apocalypse

#203

Post by marginalia_nu »

krageon wrote: post #49
unglaublich wrote: post #14

Earlier quoted context omitted.

What keeps bots from just fixing their acts and reporting correct info instead?

Nothing. Once this sort of fingerprinting becomes common the common bot frameworks will bypass it.

To be fair, bot countermeasures are and have always been an arms race.

Re: Botspam apocalypse

#204

Post by marginalia_nu »

JohnJamesRambo wrote: post #25

What is the reason behind bots spamming marginalia? What’s the motivation? What do they gain? I always wonder about these things.

Simple answer is I don't know, but it appears to be happening to other search engines as well.

My best guess is they're assuming it's backed by google, and are attempting to poison its search term suggestions. The queries I've been getting are fairly long and highly specific, often within e-pharma or online casino or similarly sketchy areas.

Re: Botspam apocalypse

#205

Post by dj_mc_merlin »

tmikaeld wrote: post #179
protoduction wrote: post #163

Earlier quoted context omitted.

I’m the co-founder of Friendly Captcha [0], we offer a proof of work-based captcha since two years or so. Happy to answer any questions. A big part of what makes our captcha successful in fighting abuse is that we scale the difficulty of the proof-of-work puzzle based on the user’s previous behavior and other signals (e.g. minus points if their IP address is a known datacenter IP). The nice thing about a scaling PoW…

While your service is of high quality, the pricing is completely unreasonable for private use cases, many times higher than hosting the site in the first place.

I think the it depends on what counts as a "request" in terms of pricing. Is it only successful checks? Pricing would be fine then. If it also includes failed checks then there is no point in the service, including the Advanced plan. Would eat through the entire credit in a day.

Re: Botspam apocalypse

#206

Post by Kiro »

Coin Hive was an interesting solution before it became synonymous with crypto jacking. In order to post a comment you had to lend your CPU to mine for X seconds. The only true anonymous and frictionless micropayment system I've seen.

Re: Botspam apocalypse

#207

Post by marginalia_nu »

jb1991 wrote: post #80

> They're a major part in killing off web forums, I’ve noticed that a lot of old popular forums disappeared in recent years, but I didn’t realize it was possibly due to bots. Why is that? I assumed that the admins just got tired of running them and moderating them.

It's more complicated than just bots, competition from Reddit is another factor, but bot traffic were certainly a significant part of the problem, both in terms of the constant drive-by exploits and ceaseless comment spam drove up the amount of work needed to operate a forum as a hobby to basically a full time job. With waning visitor numbers, it simply became untenable.

Re: Botspam apocalypse

#208

Post by figmaheart255 »

While clearly bot spam is on the rise, we need to be very careful on how we choose to deal with it. Cloudflare has already introduced "proof-of-Apple" [1], where proven Apple devices get special treatment, bypassing captchas. Later we might see websites that are only accessible via Google, Microsoft, or Apple devices. If we continue down this path, we'll end up with a social credit system ruled by big tech.

[1]: https://news.ycombinator.com/item?id=31751203

Re: Botspam apocalypse

#210

Post by coldpie »

nicbou wrote: post #181
nixcraft wrote: post #95

I run a popular blog and confirm that spam is a massive issue. I am trying to keep the independent web alive with an old-school commenting system because it helps readers and myself improve outdated posts. My domain is over 20+ years old and attracts all sorts of threats, including monthly DDoS and daily spam. Using Cloudflare solved all of these problems. Next, you need to add firewall rules inside Cloudflare WAF to…

Same job, same problem. I simply don't allow comments anymore. This is unfortunate, because they're amazing feedback if you write about bureaucracy. People won't take the time to write to you about their experience, but they'll leave a comment.

I came to the same solution, just disabling comments. There's a prompt to email me in the footer, but no one ever has. Shame, but that's the world we live in.
Post reply on HN