471–480 of 508 posts
Earlier quoted context omitted.
That's harder to set up, and also unfair to people who have an odd IP address. It's easier and better to just block 0.0.0.0/1 half of the time, and 128.0.0.0/1 for the other half of the time. Switch every day at noon. Bot traffic will be cut by 50%, and humans are all treated equally! It's a total win!
And blocking ipv6 addresses isn't unfair to people who have an ipv6 address?
Just block it all.
Cloudflare is known to use fingerprinting to detect scrapers For example, they use JA3 fingerprints and match them against the UA to block stuff like cURL while allowing OkHttp (Android clients) - but this can be easily be spoofed with packages such as CycleTLS [1]. I don't want to defend them, because they gate away a good chunk of the internet with their "bot protection", but unless you do PoW (which is also ecolog…
it's all for nothing, because Cloudflare's scraping protection works about as well as a $5 padlock - good enough to dissuade bored teens, not good enough to dissuade even an amateur burglar. if someone wants to scrap your publicly visible data, they will. there's nothing you can do.
Earlier quoted context omitted.
Why wouldn't PoW help? If it's tuned so that each device in that army takes 10 seconds instead of 10 milliseconds to make a request, have you not slowed the army down by a factor 1000?
Then every normal user has to take 10 seconds as well, which is an awful experience.
Earlier quoted context omitted.
You can use Firefox with different profiles and configure it to launch particular profile directly, without launching default profile and using about:profiles. Firefox with a non-default profile can be created like that: ./firefox -CreateProfile "profile-name /home/user/.mozilla/firefox/profile-dir/" # For, say, cloudflare that would be: ./firefox -CreateProfile "cloudflare /home/user/.mozilla/firefox/cloudflare/" An…
What does profile-switching provide that switching containers within a single profile doesn't? Edit: I RTFA'd, containers can't adjust `privacy.resistfingerprinting`. Boo
- Independent set of settings/about:config parameters.
You can't turn off, say, WebRTC completely for some profiles, while allowing it for other profiles.
Different history. I remember accidentally nuking history of a few years - that wasn't fun. Now, you reduce blast radius.
Proxy on/off or different proxies. Though, there's probably an extension that manages it on per-site basis.
Different userChrome.css, if you fancy that.
Earlier quoted context omitted.
I used to just start giving any IP downloading way too much a redirect to multi-tb NASA images. This was a long time ago but it was surprisingly how many would follow redirects and never time out. Wouldn't see a request again for hours and then its right back to downloading a new part of the sky. Those images also used to crash all the early GUI irc and chat clients that showed inline images without size checks...
How do you know it followed the redirect and downloaded the image?
Earlier quoted context omitted.
Fingerprinting for "bot protection" is indistinguishable from fingerprinting for mass surveillance.
Sure, this is the age-old “knife used to cut steak is indistinguishable from knife used to stab people” thing. Tools are inherently amoral; only people can have motives we can celebrate or condemn.
so as a toolmaker (presumably) you still have to answer for what you do.
Earlier quoted context omitted.
> Stronger protections that block more trackers, but may cause some sites to break. People already expect sites to break, so why holding back?
(n.b. I own these features in Firefox) There are three levels of protection: - ETP Standard (see [0] for the latest improvements we rolled out) - ETP Strict (we're working on things in Bugs 2036879 specifically this issue, 2037260, and more generally 2036786) - Resist Fingerprinting (RFP) These levels are something akin to "Wash your hands after using the subway", "Wear a mask on the subway", and "Wear a level B hazm…
second, would it be possible to make RFP appear as an extension like uBO, where it suggests sites to allow-list, or hints that the page might be broken and asks if you want to disable RFP?
I'm more tech savvy than the average user, admittedly, but I've learned this pattern for uBO.
Earlier quoted context omitted.
I second this. My website exposes a cgit and 99% of the traffic now is AI scraping the sources, but the load is nowhere near DoS territory. And this is running on the cheapest VPS I could find. Not saying I'm not annoyed by the scraping; I am looking to block them, but I'm also not going to put the site behind the gatekeeper. If anything, Cloudflare must love AI scraping now for the same reason AV companies love malw…
> 99% of the traffic now is AI scraping the sources I wonder if we should stop fighting this and instead create an API specifically for this purpose? Or, a central repository that you could send your data to and say to anyone wanting to scrape, "safe yourself some time and just get my data from this other place"
Earlier quoted context omitted.
[flagged]
Actually you are. It's called living in country. Lawless countries don't get blocked. If you don't like it, clean up your country.
What about before I start "fixing" anything, you throw away everything you have "made in China" and stop buying Chinese goods.
Oh, but wait, you cannot do it because walking naked in the street is illegal.
No, you enjoy cheap Chinese stuff to the degree that your country lost all its manufacturing.
Earlier quoted context omitted.
Sure, this is the age-old “knife used to cut steak is indistinguishable from knife used to stab people” thing. Tools are inherently amoral; only people can have motives we can celebrate or condemn.
I guess then you wouldn't mind if I cut you in order to verify you indeed aren't a steak, would you?