231–237 of 237 posts
Earlier quoted context omitted.
> Can't the customer rate-limit connections? Bad guys use a botnet (compromised residential computers and routers) to defeat rate limiting and ip-based blocking.
Recently there was a article where LG smart tv were hacked and used for this entire thing.
Earlier quoted context omitted.
I take it you either have a godly IP reputation, or you don't hit 90% of the current internet which is behind cloudflare, google, akamai, etc? They're pretty brutal in blocking non-browsers, I tend to have to add a lot of useless headers.
According to their /clientrep-lookup database the IP address I am using has no reputation Blocking "non-browsers" and blocking IP addresses are two different things, so to speak The first is based on dumb heuristics and (incorrect) assumptions about behavior based on what software someone is (mistakenly) presumed to be using The second is based on past behaviour I send the minimum HTTP headers I only request what I w…
IMO, there is a fundamental difference between (a) not using the data collection, surveillance and advertising-friendly software, i.e., popular graphical web browsers controlled by so-called "tech" companies that, surprise, said so-called "tech" companies and their business partners want people to use and (b) engaging in bad network behaviour, what some used to call poor "netiquette"
The heuristics used to allegedly identify bad behaviour, for example, sending the "wrong" value in a User-Agent header, are beyond stupid
But the false positive totals, "collateral damage", are apparently not large enough to matter
Earlier quoted context omitted.
Can you please not post AI-generated or AI-edited comments to HN? It's not allowed here - see https://news.ycombinator.com/newsguidelines.html#generated and https://news.ycombinator.com/item?id=47340079 . Of course, it's impossible to know for sure what was LLM processed or not, but some of your posts (like this one) have been getting classified that way.
if your classifier had classified anything other than that comment (clearly satirical, come the fuck on) and the deleted attempts to get it past your spam filter, then it is a touch too sensitive.
> One tanh call on the right input is a per-OS signature. Claim macOS, return Linux math bits, and you have contradicted your own User-Agent. They (or rather the LLM that wrote this) missed that this is possibly fingerprintable to browser version range, which is slightly more interesting. Most users aren't spoofing their user agent headers to be a different operating system. Most fingerprinting solutions aren't tryin…
> Most users aren't spoofing their user agent headers to be a different operating system. The people behind the LLM behind this blog post are. They're trying to pretend their robots are people to sell other websites' data to their customer. It's easier to pass bot detection gates if you pretend to be a physical machine running Windows or macOS than if you honestly admit you're using Linux on a VM.
I mean, I get it, saying you support something is technically a commitment. But my goal is to basically never open a chromium browser, so, I'm gonna do what I have to do. And you would be shocked, in the past 5 years I have only encountered ONE website which legitimately required a chromium browser. grapheneos.com, for the web usb installer.
Earlier quoted context omitted.
I feel like this is with 2026 view where browsers are so mutually compatible. In the bad old days there were so many differences between html, css and js behaviors that if you wanted your site to be nice you had to change it for the browser. The way css padding worked wasn't even the same. Feature detection was rarely viable for any of this. No user agent would probably have only entrenched IE6 dominance even more by…
And you can see how well that worked by how many user-agents are such a sane, terse description of the browser rather than a hodgepodge of random words that give the impression that they're trying to seem like every browser at once.
In practice when you make your new set of hacks the string you can always evaluate whatever cruft in the useragent today, but next browser shows up.
It does make the user agents insane but I don't know if there's any obviously better system for the problem, even with hindsight