Botspam apocalypse • Hacker News Board

Re: Botspam apocalypse

#261

Post by Avamander » Thu, Aug 04, 2022, 2:09 PM UTC

CodeSgt wrote: post #222

Avamander wrote: post #108

It's annoying for sure. I deal with abuse at a large scale. I'd recommend: - Rate-limit everything, absolutely everything. Set sane limits. - Rate-limit POST requests harder. Preferably dynamically based on geoip. - Rate-limit login and comment POST requests even harder. Ban IPs that exceed the amount. - Require TLS. Drop TLSv1.0 and TLSv1.1. Bots certainly break. - Require SNI. Do not reply without SNI (nginx has 44…

> Rate-limit login and comment POST requests even harder. Ban IPs that exceed the amount Don't ban IPs. Or if you do, let the ban expire relatively quickly (days/weeks, not months/years).

Ideally you'd keep track of repeat offenders and decide the length based on that.

Re: Botspam apocalypse

#262

Post by marginalia_nu » Thu, Aug 04, 2022, 2:09 PM UTC

SyneRyder wrote: post #165

Really glad to see someone finally talking about this. Does anyone know what's going on with that "Duke de Montosier" spam botnet? It accounts for more than half of the botspam attacks on my sites, and I can't find anyone talking about it online anywhere, except one tweet dating back to mid-2021. It's identifiable by several short phrases that it posts: Duke de Montosier for Countess Louise of Savoy Testaru. Best kno…

How very numbers station of them.

I've seen it suggested that botnets use comment fields for command and control, maybe something like that?

Re: Botspam apocalypse

#263

Post by Avamander » Thu, Aug 04, 2022, 2:10 PM UTC

NullPrefix wrote: post #240

Avamander wrote: post #156

Earlier quoted context omitted.

Some old browsers break as well, if it's worth it depends on the website. It's your prerogative to disable an useful feature, you can also disable JavaScript. But there's little reason for a website operator to cater to that unnecessary edge case if it's mostly used for abuse.

JavaScript is mostly used for abuse.

Not in that direction though.

Re: Botspam apocalypse

#264

Post by marginalia_nu » Thu, Aug 04, 2022, 2:13 PM UTC

js4ever wrote: post #235

"There has been upwards of 15 queries per second from bots. There is just no way to deal with that sort of traffic, barely even to reject it." What??? My phone can serve that easily, any modern server can handle 50-250 rps

This is queries per second (as in I run a search engine), not requests per second.

Re: Botspam apocalypse

#265

Post by marginalia_nu » Thu, Aug 04, 2022, 2:15 PM UTC

SahAssar wrote: post #195

> There has been upwards of 15 queries per second from bots. There is just no way to deal with that sort of traffic, barely even to reject it. I don't really understand, is that a lot? 15qps does not sound like a lot, especially for a blocking/rejection function.

It's 15 search queries per second, not requests per second. RPS is usually 10-20x higher.

Re: Botspam apocalypse

#266

Post by ticviking » Thu, Aug 04, 2022, 2:17 PM UTC

sircastor wrote: post #32

paulmd wrote: post #2

> They're a major part in killing off web forums, and a significant wet blanket on any sort of fun internet creativity or experimentation. > The only ones that can survive the robot apocalypse is large web services. Your reddits, and facebooks, and twitters, and SaaS-comment fields, and discords. They have the economies of scale to develop viable countermeasures, to hire teams of people to work on the problem full ti…

>The solution is real simple: it costs 10 bux to register an account, if you're a nuisance your account is banned and you pay 10bux to get back on. Many years ago there was a public server called SDF (Super Dimensional Fortress). It was a BSD system and anyone could get a user account for $1. The theory was even the least of us, a kid scrounging for money on the street, could come up with a dollar (and presumably the…

SDF is still around. I recently recovered my account and spent a lovely afternoon hanging out on their chat

Re: Botspam apocalypse

#267

Post by JimWestergren » Thu, Aug 04, 2022, 2:17 PM UTC

robalni wrote: post #146

JimWestergren wrote: post #133

I am running a website builder with > 20K sites. I use open contact forms without captcha. What worked for me is to use a one line javascript that places current timestamp in a hidden input field that is default 0. Then I check on the backend and if the value is either 0 or time to fill out and send the form is less than 4 seconds I block as spam. This blocks more than 99% of spam and also takes care of most human co…

If you don't want to require users to run javascript you should be able to make the server generate the timestamp.

I used to do it with PHP but the problem is that then you can't cache the HTML (varnish or other solutions). Javascript don't have that problem and the added benefit of stopping bots that don't run javascript.

In the error message I have a friendly texts for human to turn on javascript if it is off and a Go back and try again making them not loose the text that they have typed.

Re: Botspam apocalypse

#268

Post by Xeoncross » Thu, Aug 04, 2022, 2:19 PM UTC

I have considered skipping the regular fingerprinting, geolocation, captcha, hashcash, email verification, payment required, etc... mitigations and instead requiring people to drop into a public chat room (or pm/chat the support team) to have their account activated.

The number of languages supported would be small to match whoever helped moderate this, but it would at least require speaking to someone. A PM thread or live chat would be an instant way to find out if someone can string two sentences together and might be worth allowing into the site. You could even have them create an account and solve a single captcha prior to getting access to the chat.

It's not perfect by any stretch, but might be worth exploring having humans-verify-humans.

Re: Botspam apocalypse

#269

Post by hbn » Thu, Aug 04, 2022, 2:24 PM UTC

troad wrote: post #166

Avamander wrote: post #108

It's annoying for sure. I deal with abuse at a large scale. I'd recommend: - Rate-limit everything, absolutely everything. Set sane limits. - Rate-limit POST requests harder. Preferably dynamically based on geoip. - Rate-limit login and comment POST requests even harder. Ban IPs that exceed the amount. - Require TLS. Drop TLSv1.0 and TLSv1.1. Bots certainly break. - Require SNI. Do not reply without SNI (nginx has 44…

In other words, make your website unusable for people who have to connect through VPNs or public networks, difficult for anyone without a stable Western broadband connection, and unpleasant for everyone else.

Google search seems to have this issue for most of the regions near me on the VPN I use (Private Internet Access)

Sometimes I just turn it on if I have to fire off a few searches because it'll make me complete a long, tedious captcha for EVERY search

Re: Botspam apocalypse

#270

Post by Avamander » Thu, Aug 04, 2022, 2:25 PM UTC

neurostimulant wrote: post #220

Avamander wrote: post #108

It's annoying for sure. I deal with abuse at a large scale. I'd recommend: - Rate-limit everything, absolutely everything. Set sane limits. - Rate-limit POST requests harder. Preferably dynamically based on geoip. - Rate-limit login and comment POST requests even harder. Ban IPs that exceed the amount. - Require TLS. Drop TLSv1.0 and TLSv1.1. Bots certainly break. - Require SNI. Do not reply without SNI (nginx has 44…

I'm sure these would work but I'll probably got banned too just because I often try to poke ip addresses directly. I also often use VPN especially when outside, so I'll definitely got banned.

VPNs tend to be smaller offenders in terms of clients-per-IP than say educational institutions or offices.