Live data from Hacker News

An update on residential proxies and the scraper situation

lwn.net

361–370 of 422 posts

Re: An update on residential proxies and the scraper situation

#361
post #10

Residential Proxies are the most emblematic technology of our era- a group of people looked at something that used to be considered a crime (botnets) and realized that if they just did it openly, no one would ever punish them.

I think they also have to operate in countries that don't mind shady things like this.

Residential proxies aren't illegal in any country, within reason.

Re: An update on residential proxies and the scraper situation

#362
post #10

Residential Proxies are the most emblematic technology of our era- a group of people looked at something that used to be considered a crime (botnets) and realized that if they just did it openly, no one would ever punish them.

TIL: > Many providers build their proxy pools by partnering with device owners who agree to share their bandwidth, while others use embedded SDKs in free apps or VPNs. WTF. That's just botnets. Source: https://www.fbi.gov/investigate/cyber/alerts/2026/evading-re...

Yeah so it turns out the illegal part of a virus-based botnet was the virus, not the botnet.

Re: An update on residential proxies and the scraper situation

#363

In theory, proof of work that is used to mine a cryptocurrency could be a solution. Bitcoin and others are already secured via massive pow computations. If we could shift that into browsers, no additional energy would be used and we could solve an issue that has been unsolved for too long: How to pay websites that provide useful information other than with ads. The question is which resources typical consumer hardwar…

Better skip the PoW part as it'll be wildly inefficient for most of the work done. Instead, exchange web traffic for actual $. Say, some kind of tokens that are easily turned back into hard cash through a 3rd party. Requesting a 100KB file? Okay, that'll be a $0.00002 token, please! (visitor's user agent provides it in a manner transparent to regular web users). Requesting a 3MB image? Okay, that'll be a $0.0005 toke…

Easily gamed. My homepage is 4GB (uncompressed) and refreshes itself every microsecond.

Re: An update on residential proxies and the scraper situation

#364

> There are ways to tell the difference — the bots usually do not fetch images or CSS, for example — but, by the time that determination is made, the address in question will not be used again. Blocking the address at that point is just a waste of time. Maybe there's no point for the scanned server to block the address, but couldn't collective / shared block lists help with sites that may get scanned by the same addr…

Scanners and scrapers are mostly two different groups.

Re: An update on residential proxies and the scraper situation

#365

How much does routing traffic though residential proxies cost?

You can just Google this. It isn't illegal, you can find many providers, you can even pay with your credit card. Usually around $0.20/GB - other types of proxies are cheaper.

Re: An update on residential proxies and the scraper situation

#366

Sorry, I understand scraping is a problem, but talking about open Internet while simultaneously complaining you can no longer discriminate datacenter IPs like you used to is hypocrisy. I use a datacenter-based IPv6 address because my local ISPs don't offer v6 connectivity and the Internet is already broken for me. And generally the entire idea of a "residential" IP address smells.

Noone complained we can't discriminate DC IPs, though to be fair some (imo bad) operators did just that. This is not even about preventing bots, which has perfectly legitimate usecases (eg. Internet Archive). This is about filtering out bad bots/actors who have no respect for your resources and will drain all of it causing bad experience for everyone. But because they know they don't respect robots.txt or even simple…

You could always try various counterattacks - returning a repeating compressed stream that decompresses to several terabytes, or returning one byte per second, or returning an endless list of hyperlinks to a honeypot, if the date is older than 200 years.

Re: An update on residential proxies and the scraper situation

#367

Sorry, I understand scraping is a problem, but talking about open Internet while simultaneously complaining you can no longer discriminate datacenter IPs like you used to is hypocrisy. I use a datacenter-based IPv6 address because my local ISPs don't offer v6 connectivity and the Internet is already broken for me. And generally the entire idea of a "residential" IP address smells.

This is definitely an issue, where data centre addresses are, by default, second class citizens or even persona non grata. The problem is that this reputation has been, unfortunately, well-earned. There's no easy answer here. The ephemerality and pseudonymity of VPS address usage screams untrustworthy, and the only way to reign that in is better identification of who is using the VPS/address or significantly more res…

The other possibility is that things get so mixed up that there's no way to tell identification at all and you have to allow everyone or no-one. That's the direction that residential proxies are pushing in.

Re: An update on residential proxies and the scraper situation

#368
post #247
post #41

>There are ways to tell the difference — the bots usually do not fetch images or CSS, for example — but, by the time that determination is made, the address in question will not be used again. Blocking the address at that point is just a waste of time. I don't get it. Don't we keep blacklists of this stuff? And if they hammer thousands of requests per site per second and never reuse an IP, they'd run out of addresses…

Blocking in ipv6 works roughly the same way as in ipv4, just that the scale is different. Instead of blocking something like a company's /24 or an ISP's /16 when they don't respond to abuse messages, you block the company's /48 or the ISP's /32. It'll vary per organisation how large a range they got exactly but you can see that in WHOIS. End users are no longer at a /32 (v4) but at /64 (v6), or some prosumers might h…

Various ISPs give out either a /64, a /56 or a /48. Anything else is very unusual. A normal approach is to limit by /64 at first, limit a /56 to 3-4 times the rate limit of a /64 and a /48 to 3-4 times that again. Someone who has a /48 gets to enjoy 16 times the rate limit of someone who has a /64 but that's not too bad, and you don't have to tune anything per ISP.

Anyone who has bigger than /48 is no longer an individual user. They could be an ISP set up solely for scraping, though that comes with some fees and requirements.

Re: An update on residential proxies and the scraper situation

#369

Ever since bots became a problem on the internet 10-20 years ago, it has seemed like the common-sense solution is some kind of micropayment. Pay $0.01 to view the page. When money is on the line, scrapers are likely to be more well-behaved, even if they do pay. The problem is, and has always been, the friction of payment. How do you pay $0.01? The credit card processors will tack on a $6 surcharge. We need a trusted…

Probably with something similar to Lightning Network, which reallocates pre-committed funds between two or more parties. But not with Lightning Network itself, for several reasons including how costly it is to pre-commit the funds.

Re: An update on residential proxies and the scraper situation

#370

Earlier quoted context omitted.

If I get kicked out of Epstein island because I refuse to **** a child, that doesn't make me a bad actor.

And then going there 1 million times under fake identities? Yeah, I'm sure that's not a bad actor.

What if I'm a journalist trying to expose what's happening on the island?
Post reply on HN