Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Precursor

blog.cloudflare.com

Post reply on HN
Print view View original

161–170 of 170 posts

Re: Precursor

#161

Post by abirch »

RedRocketFlash wrote: post #140
abirch wrote: post #34

Earlier quoted context omitted.

I'm guessing it's going to lock the non-sighted//keyboard only users out of the anonymous Internet. I'm guessing if you log in and give up your anonymity they'll consider you not a bot.

If that's true, attackers just need to run their bots under registered throwaway accounts...

The account will require a phone number and the US is trying to move away from burner phones. As long as we don't commit thought crimes and we love Big Brother all will be well.

https://www.wired.com/story/security-news-this-week-the-fcc-...

Re: Precursor

#162

Post by angelhadjiev »

nerdsniper wrote: post #50
reluctant_dev wrote: post #8

What prevents bots/agents from just adding "jitter" to their movements that mimics how humans move their cursor? I know there are other signals being used but this one in particular seems like it wouldn't be hard to beat with a small amount of sophistication from the bot.

Beating this would require a large amount of sophistication, not a small amount. Basic machine learning clustering will expose bots mouse+keyboard+touch behavior and discriminate them from humans. It will also likely discriminate against anyone with a disability and therefore using affordances like eye tracking. Just imagine how different a person with only one hand would look compared to a “typical” user!! This shou…

[flagged]

Re: Precursor

#163

Post by thenthenthen »

linksbro wrote: post #101

The examples of mouse movement, really reminds me what bot scripts looked like for Runescape back in 00s-10s. Early scripts were color-based and jumped the mouse around, and those were quickly caught. But over time, bot scripts developed into complex orchestrations; taking breaks, doing random actions spontaneously, moving the mouse naturally, logging sessions on different platforms (mobile, PC), even responding in c…

There is a cool video on Runescape bot development and detection methods here: https://youtu.be/B8i26g45WeY?si=MrnM8b5T7L5rpWjp

Re: Precursor

#165

Post by cute_boi »

owenthejumper wrote: post #118
Catloafdev wrote: post #39

Earlier quoted context omitted.

What Cloudflare competitors offer a similar range of services?

Akamai, Fastly, HAProxy, F5, many others? Talking about bots specifically, not about "workers" etc.

Akamai is nightmare, they block many user mercilessly. They are worst than Akamai. I don't see issue with other though.

Re: Precursor

#167

Post by pocksuppet »

esseph wrote: post #29
ianm218 wrote: post #24

Earlier quoted context omitted.

For any one of their product there is a good opportunity to build an open source alternative or something like it! Can be hard to work around they have the benefit of being able to have negative unit economics on lots of infra products... But people succesfully built tons of alternatives to google analytics and similar.

What they are doing requires both physical and digital infrastructure spread throughout the globe. It's not a cheap task.

Do you actually have customers spread throughout the globe, or just in North America and some in Europe?

Re: Precursor

#168

Post by TinyOslo »

My 2 cents - have anyone bothered to account for disabilities? Anyone using a given site with tech that moves a cursor? Not using a mouse or trackpad?

Re: Precursor

#169

Post by JJvb89 »

This is frankly just ridiculous. Tracking mouse movements has been a basic bot-detection signal for 15 years. Cloudflare just added it as a signal and is making a huge deal out of it.

A firewall company knows very little about browser internals so don't expect much from this.

Re: Precursor

#170

Post by lukewarm707 »

cjbarber wrote: post #145
lukewarm707 wrote: post #144

Earlier quoted context omitted.

happy to offer a counter of some great products for anti-bot defeat: https://brightdata.com/ https://www.zenrows.com/ https://www.capsolver.com/ https://scrapfly.io/ hundreds of millions of residential ips, human browser fingerprints, custom browser binaries, auto solve of turnstyle, recaptcha v3, kasada, datadome, AWS WAF, etc if they come up.

Bright Data ranks #1 on Foil's leaderboard [1], but is still detected. ScrapFly is #4 and ZenRows #7. And I guess Capsolver isn't really a scraping thing but is more just for the captcha component. I think it'd be good if there were more products that did a better job of making an actually undetectable agent, but doesn't seem like any exist yet. [1]: https://usefoil.com/research/stealth-browser-leaderboard

so, i found out why foil detects all the bypass products and the others fail badly:

it costs $0.05 per bot check

Post reply on HN