HN bans Hector Martin’s home IP address • Hacker News Board

Re: HN bans Hector Martin’s home IP address

#31

Post by fragmede » Wed, Oct 04, 2023, 12:39 AM UTC

dang wrote: post #26

fragmede wrote: post #19

Earlier quoted context omitted.

Bots and spam are an impossibly hard problem to crack. Google had to change the digital landscape of email in order to fight spam, and even then, the job is never finished. The worst part though is knowing that legitimate users will get caught as collateral damage. > How would we even know who's accessing HN unless they tell us? My browser sends a cookie telling HN it's me. More advanced tooling would let you allow-l…

> My browser sends a cookie telling HN it's me Yes, that's what I mean: if people log in, then we know at least a bit about who's accessing the site. But the particular blocks I posted about above only apply to logged-out users. Logging in immunizes you from them immediately.

Or rather, presumably Hector Martin's connecting to HN via a logged in browser and experiencing the block, which shouldn't apply to logged-out users, so I'm guessing there a bug/disconnect somewhere (could be in my parsing of your original comment).

Re: HN bans Hector Martin’s home IP address

#32

Post by dang » Wed, Oct 04, 2023, 12:47 AM UTC

fragmede wrote: post #31

dang wrote: post #26

Earlier quoted context omitted.

> My browser sends a cookie telling HN it's me Yes, that's what I mean: if people log in, then we know at least a bit about who's accessing the site. But the particular blocks I posted about above only apply to logged-out users. Logging in immunizes you from them immediately.

Or rather, presumably Hector Martin's connecting to HN via a logged in browser and experiencing the block, which shouldn't apply to logged-out users, so I'm guessing there a bug/disconnect somewhere (could be in my parsing of your original comment).

No one connecting via a logged-in browser would have been blocked by this code.

Edit: there are two exceptions—accounts we blocked because they were running crawlers that didn't respect HN's robots.txt—but both have been blocked for much longer than a few days.

Re: HN bans Hector Martin’s home IP address

#33

Post by fragmede » Wed, Oct 04, 2023, 4:10 AM UTC

dang wrote: post #32

fragmede wrote: post #31

Earlier quoted context omitted.

Or rather, presumably Hector Martin's connecting to HN via a logged in browser and experiencing the block, which shouldn't apply to logged-out users, so I'm guessing there a bug/disconnect somewhere (could be in my parsing of your original comment).

No one connecting via a logged-in browser would have been blocked by this code. Edit: there are two exceptions—accounts we blocked because they were running crawlers that didn't respect HN's robots.txt—but both have been blocked for much longer than a few days.

In this post* Hector Martin makes a contradicting claim - that he's blocked using a logged in browser.

* https://social.treehouse.systems/@marcan/111165508206292497

Based on other posts in that thread though, he also appears to be behind CG-NAT, which is always a confounding factor for IP-based blocking. Maybe someone else on his netblock is running that crawler.

Re: HN bans Hector Martin’s home IP address

#34

Post by dang » Wed, Oct 04, 2023, 9:23 PM UTC

fragmede wrote: post #33

dang wrote: post #32

Earlier quoted context omitted.

No one connecting via a logged-in browser would have been blocked by this code. Edit: there are two exceptions—accounts we blocked because they were running crawlers that didn't respect HN's robots.txt—but both have been blocked for much longer than a few days.

In this post* Hector Martin makes a contradicting claim - that he's blocked using a logged in browser. * https://social.treehouse.systems/@marcan/111165508206292497 Based on other posts in that thread though, he also appears to be behind CG-NAT, which is always a confounding factor for IP-based blocking. Maybe someone else on his netblock is running that crawler.

If someone wants to tell me the username, I'd be happy to look into what happened. Without the username, I don't know of any way to check this particular case—all I can say is what changed during those few days, and what changed is that we blocked more IPs that were making logged-out requests; logged-in requests would not have been affected.

Since that link refers to opening HN in an incognito window—and all those requests would be logged-out—most probably it was that activity that triggered the block. As I think I said elsewhere, it's hard to distinguish between a legit user accessing a bunch of HN links in various tabs, and a distributed botnet making similar handfuls of requests from a million different IP addresses.

What I can tell you for sure, though, is that the claim that we were targeting any individual user is quite false. Isn't that the main point?