321–330 of 358 posts
Earlier quoted context omitted.
Blocking the entire aws/gcp/azure/digital ocean/linode IP ranges will stop 99.999% of malicious bot traffic full stop.
Yes, it would. It would also stop a not-insignificant number of my customers.
Earlier quoted context omitted.
> I'm not very familiar with all the workings of HTTP/2.0 - why would it break bots? There's a lot of outdated garbage bots out there. Not using HTTP/2.0 is also often the default with various HTTP libraries.
So it just comes down to bot software not being compatible with HTTP 2.0 rather than any sort of HTTP 2.0 specific mechanism/feature?
It's annoying for sure. I deal with abuse at a large scale. I'd recommend: - Rate-limit everything, absolutely everything. Set sane limits. - Rate-limit POST requests harder. Preferably dynamically based on geoip. - Rate-limit login and comment POST requests even harder. Ban IPs that exceed the amount. - Require TLS. Drop TLSv1.0 and TLSv1.1. Bots certainly break. - Require SNI. Do not reply without SNI (nginx has 44…
captchas were designed to solve this (and only this, as opposed to requiring them to merely view content like modern ignorant web devs like to do [yes i know some web devs now require it to be able to make sure the people they're datamining are real, but this is a new practice from this year basically])
public services should be implemented by decentralized p2p. static content is solved by ipfs, freenet, etc. dynamic content perhaps can only be solved with smart contracts, which would be less bad than cloudflare if they weren't expensive, as they still provide protocol conformance (unlike cloudflare that requires you to have your packets look like a big 4 browser), anonymity (yeah, pseudonyms, you can still make one per query), etc. without smart contracts many interactive applications are still possible
> The other alternatives all suck to the extent of my knowledge, they're either prohibitively convoluted, or web3 cryptocurrency micro-transaction nonsense that while sure it would work, also monetizes every single interaction in a way that is more dystopian than the actual skull-crushing robot apocalypse.
centralized web hosting is and always was unsustainable and this is the reason most web content is commercial garbage, and the problem will only get worse. my concern was always what kind of garbage boomer protocol will become the new standard. i sure as hell dont want something that looks like email, web, or UN*X.
Earlier quoted context omitted.
I like this solution because spammers are unlikely to try to get around it. A delay eats into their time budget and they can't introduce a human-like waiting time on every site they try to spam, better to just move on to find cheaper targets.
You could just decrease the timestamp instead of actually waiting.
Earlier quoted context omitted.
I ban IPs from small data centers all the time. For my purposes there is no need to support traffic from small hosting providers that are everywhere all over the world. I do not tend to ban the IPs of commercial ISPs that provide service to end users.
You will probably ban a lot of VPN users as collateral damage. VPN providers often use these small and relatively cheap providers for their endpoints. You may be fine with banning those VPN users, or even want that - lots of bots will try to hide behind "legitimate" VPNs - but one has to be aware of this consequence at least, especially considering that more and more people seem to use them - probably also thanks to…
For my forum with 500k users a month I just added a registration captcha related to my niche. E.g. for a Dark Souls forum it would say "what game is this forum about?" And if you got it wrong the validation would include "tip it's just two words D rk S*ls". This reduced spam by over 99% and didn't annoy people with recaptcha. If someone was unable to get past that captcha (it still happens I have logs!) I figured the…
Reminds me of a guy who implemented a pre-screen on his phone calls to stop spammers. He said he wanted to use something simple at first and that he planned to tweak it depending upon how many spammers go through. So his phase one it asks "Dial 1 to continue". But that was enough to stop all the spam calls so he never had to improve it.
Earlier quoted context omitted.
While your service is of high quality, the pricing is completely unreasonable for private use cases, many times higher than hosting the site in the first place.
I think the it depends on what counts as a "request" in terms of pricing. Is it only successful checks? Pricing would be fine then. If it also includes failed checks then there is no point in the service, including the Advanced plan. Would eat through the entire credit in a day.
Earlier quoted context omitted.
> Require TLS. Drop TLSv1.0 and TLSv1.1. Bots certainly break. So will people who run older computers with older software. But I guess people who don't have money don't matter for commercial websites so screw 'em.
I don't think there's much web you can visit with those browsers anyway. Windows XP with IE and no SNI support, maybe sites from that era without JavaScript would work?
But yeah, corporate employees aren't going to care about those people. Governments have to. And human persons building personal websites should too.
>large resources are the solution
To those who have been recently pondering the history of antivirus companies of the 90s and 00s, and suspiciously wondering how they were always able to so quickly come up with definitions for the newest infections, this all feels so familiar. What a sad world we live in, sometimes.