Live data from Hacker News

Avoiding bot detection: How to scrape the web without getting blocked?

github.com

301–310 of 312 posts

Re: Avoiding bot detection: How to scrape the web without getting blocked?

#303

Earlier quoted context omitted.

This is reason why most of services uses App instead of Browser. When there is App it can use lot of thing like phone fingerprint derived from various sources.

Apple provides a framework or some sort of unique id

Note that Apple explicitly tries to prevent apps from generating any sort of overall device fingerprint besides the ad tracking identifier one which now requires user consent in iOS 14. You can still generate an app-scoped device ID though. (Not sure if these persist across re-installs of the same app or not)

Re: Avoiding bot detection: How to scrape the web without getting blocked?

#304
post #257

Earlier quoted context omitted.

This also depends on the country. Where I live (Europe) the rate now changes by the minute, or thereabouts. That was made possible after everybody had to change to wireless meters. Sometimes you'll get a warning in advance - a newspaper may write "If you live here or here, don't do your cooking at this particular hour". Some providers still have fixed rate options, some apparently don't. What I dislike the most is th…

I’m curious to see the stats they are relying on and the communications materials the fire department and insurance company are using on this topic. It seems to me from a life-safety angle that their energy would likely be far better spent on recommending smoke alarms, CO meters, and periodic cleaning of dryer vents than on recommendations against sleeping with washing/drying machines running.

They do all of that as well, of course. The problem is that when it does happen (and statistically, it will, somewhere, at some point) there's a chance you don't hear the alarm (very common - just this morning there was a newspaper story about someone who were saved by the neighbours, they didn't wake up right away even with all the alarms blaring. What the alarms did though was to alert the fire department, as per their setup).

In short - if there's a fire it's much better that you're awake and up already.

Re: Avoiding bot detection: How to scrape the web without getting blocked?

#305
post #242

Earlier quoted context omitted.

Or they using it as lazy approach to fix long-dos attacks by competitors.

What is the non-lazy alternative that stops a botnet DDOS without affecting regular visitors?

Long-dos is usually not a botnet but a single or a few attackers requesting a resource heavy page on and on or using a technic like slowloris. If you are using WordPress I am sure you find some signs in your log.

The solution other than with ddos is to make the app better. Caching, access control and limiting, etc.

Re: Avoiding bot detection: How to scrape the web without getting blocked?

#306

Earlier quoted context omitted.

On the contrary, there are no laws that say you can't scrape a site. If it's available to the public internet, it's legally scrapable.

There are laws against unauthorized computer access. This is a scenario where you have a server explicitly saying "Stop! You are not permitted to access this computer!", and yet you persist in circumventing that by hiding your identity and accessing it anyway. Those are some murky waters.

If I were on a jury, I’d vote to nullify any scraping case that made it this far.

Re: Avoiding bot detection: How to scrape the web without getting blocked?

#307
post #290

Earlier quoted context omitted.

> I can send you 403's just because I don't like your face. Sure. At least then you're being honest. If you hate me, it doesn't matter what user agent I use to access your site. Browsers, scripts, they are all me.

Why do you think it’s dishonest to send 403s to bots but not browsers? Method of access matters — you the human might have access to your safety deposit box but the bank is still allowed to make rules about your access — like you have to come during business hours and you can’t send someone on your behalf.

> you can’t send someone on your behalf

I totally can though. If sign a document saying another person can do such and such on my behalf, that person can totally do that. Yes, even at the bank. No different from a user agent, really.

Re: Avoiding bot detection: How to scrape the web without getting blocked?

#308

Earlier quoted context omitted.

What could my scraper which makes 1 HTTP request per day possibly cost the webmaster?

Nothing of course. But follow that string a little further. So you do some thing which once a day scrapes a site and pulls off some data that you use in your thing. Maybe you talk about it to friends, or you have this thing as one of your github repositories. Some of your friends download the repository and also start using your thing. They talk to people about how cool your thing is, or what it does and the nice con…

> it is rare that a non-malicious scraper application isn't talked about and shared (amongst people who have a similar itch that the thing is scratching)

That's exactly my case though. I have a few scraper scripts that I've never published. So what if it's rare? Do I deserve to be treated like a botnet just because it's inconvenient for some webmaster or company to do otherwise? That's not fair at all.

Re: Avoiding bot detection: How to scrape the web without getting blocked?

#309

Earlier quoted context omitted.

I’m curious. What is link-only login?

A link is generated, emailed to the user, and clicking the link logs them in.

... and some sites use it instead of passwords, i.e. there are no passwords at all, only email links.

Re: Avoiding bot detection: How to scrape the web without getting blocked?

#310

Earlier quoted context omitted.

A link is generated, emailed to the user, and clicking the link logs them in.

This sounds more or less like OTP.

It does, but usually you also get a long-lived cookie and does not need any setup on the user side, so is nice for the non-technical users.
Post reply on HN