Earlier quoted context omitted.
> How about we just make a "blacklist" of these known bots, look up every user agent, and compare against the blacklist? So now every single request to your site has to do a substring match against every single term in this list. Depending on your site's implementation, this is probably not trivial to do without taking some sort of performance hit . ???! Excuse me? Are you programmers? Efficient substring matching is…
This is entirely honor system, though. All of the user-agent checking has to be layered with the other bot-removal techniques. Malicious users will always fake user agent strings.
I mean it's a good (and cheap) first pass to throw out quite a number of true positives.