291–300 of 516 posts
I mean you could just ban the user agent?
The real issue is with bots pretending not to be bots.
We solved a lot of our problems by blocking all Chinese ASNs. Admittedly, not the friendliest solution, but there were so many issues originating from Chinese clients that it was easier to just ban the entire country. It's not like we can capitalize on commerce in China anyway, so I think it's a fairly pragmatic approach.
There's some weird ones you'd never think of that originate an inordinate amount of bad traffic. Like Seychelles. A tiny little island nation in the middle of the ocean inhabited by... bots apparently? Cyprus is another one. Re: China, their cloud services seem to stretch to Singapore and beyond. I had to blacklist all of Alibaba Cloud and Tencent and the ASNs stretched well beyond PRC borders.
Earlier quoted context omitted.
What is beyond irresponsible? Monitoring logs and researching odd things found there?
The way to handle a password: plaintextPassword = POST["password"] ok = bcryptCompare(hashedPassword, plaintextPassword) // (now throw away POST and plaintextPassword) if (ok) { ... } Bonus points: on user lookup, when no user is found, fetch a dummy hashedPassword, compare, and ignore the result. This will partially mitigate username enumeration via timing attacks.
Earlier quoted context omitted.
Blocking a residential proxy doesn't sound like a bad idea to me. My single-layer thought process: If they're knowingly running a residential proxy then they'll likely know "the cost of doing business". If they're unknowingly running a residential proxy then blocking them might be a good way for them to find out they're unknowingly running a residential proxy and get their systems deloused.
Let's suppose I'm running a residential proxy. Of course my home IP address changes every day, so you'll end up blocking my entire ISP (a major one) or city (a major one) one by one. And what if I'm behind CGNAT? You will block my entire ISP or city all in one go, and get complaints from a lot of people.
Alas, the "enough users get annoyed by being blocked and switch ISPs" step will never happen. Most users only care about the big web properties, and those have the resources to absorb such crawler traffic so they won't get in on the ISP-blocking scheme.
Earlier quoted context omitted.
Are you familiar with port knocking? My servers will only open port 22, or some other port, after two specific ports have been knocked on in order. It completely eliminates the log files getting clogged.
I've used that solution in the past. What happens when the bots start port knocking?
Earlier quoted context omitted.
Okay, but this causes me about 90% of my major annoyances. Seriously. It’s almost always these stupid country restrictions. I was in UK. I wanted to buy a movie ticket there. Fuck me, because I have an Austrian ip address, because modern mobile backends pass your traffic through your home mobile operator. So I tried to use a VPN. Fuck me, VPN endpoints are blocked also. I wanted to buy a Belgian train ticket still fr…
The vpn is probably your problem there mate.
Earlier quoted context omitted.
Okay, but this causes me about 90% of my major annoyances. Seriously. It’s almost always these stupid country restrictions. I was in UK. I wanted to buy a movie ticket there. Fuck me, because I have an Austrian ip address, because modern mobile backends pass your traffic through your home mobile operator. So I tried to use a VPN. Fuck me, VPN endpoints are blocked also. I wanted to buy a Belgian train ticket still fr…
> I wanted to order something while I was in America at my friend’s place. Fuck me of course. Not just my IP was problematic, but my phone number too. Your mobile provider was routing you through Austria while in the US?
Earlier quoted context omitted.
Yes and it makes reading your logs needlessly harder. Sometimes I find an odd password being probed, search for it on the web and find an interesting story, that a new backdoor was discovered in a commercial appliance. In that regard reading my logs led me sometimes to interesting articles about cyber security. Also log flooding may result in your journaling service truncating the log and you miss something important…
You log passwords?
Earlier quoted context omitted.
My friend has a small public gitea instance, only use by him a a few friends. He's getting thousounds of requests an hour from bots. I'm sorry but even if it does not impact his service, at the very least it feels like harassment
Thousands of requests per hour? So, something like 1-3 per second? If this is actually impacting perceived QoS then I think a gitea bug report would be justified. Clearly there's been some kind of a performance regression. Just looking at the logs seems to be an infohazard for many people. I don't see why you'd want to inspect the septic tanks of the internet unless absolutely necessary.
Earlier quoted context omitted.
My friend has a small public gitea instance, only use by him a a few friends. He's getting thousounds of requests an hour from bots. I'm sorry but even if it does not impact his service, at the very least it feels like harassment
Thousands of requests per hour? So, something like 1-3 per second? If this is actually impacting perceived QoS then I think a gitea bug report would be justified. Clearly there's been some kind of a performance regression. Just looking at the logs seems to be an infohazard for many people. I don't see why you'd want to inspect the septic tanks of the internet unless absolutely necessary.