Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Botspam apocalypse

memex.marginalia.nu

Post reply on HN
Print view View original

91–100 of 358 posts

Re: Botspam apocalypse

#91

Post by rightbyte »

TheCapeGreek wrote: post #61
hamilyon2 wrote: post #5

I experienced this firsthand with government immigration websites. The thing is there are only so many time slots and and people are forsed to use a certain web site to apply, so everyone is hunting for available time and generally none are available. So, some creative people set up bots which check periodically for them. They are paid services which will do that for you. Now we have bots hammering gatekeeper's websi…

It gets more fun when there are arbitrary restrictions on process. Fun anecdote: South Africa's Home Affairs website, where you make bookings for passports, only lets you book appointment dates 2 weeks ahead normally. It's effectively permanently booked even without bots this way. Luckily, if you're technically inclined, editing the value of the input element via dev tools is accepted by the form.

Heh, I've done the same thing to calculate my tax.

The tax agency had grayed out the "calc tax" button until the declaration period started, but you could just enable it with the enable flag.

Did nothing but read querry their servers though.

Re: Botspam apocalypse

#92

Post by viraptor »

jart wrote: post #8

This kind of botspam is usually pretty easy to address with redbean using the finger https://redbean.dev/#finger and maxmind https://redbean.dev/#maxmind modules. The approach I usually recommend people isn't so much ip reputation, which can be unfair, but rather it allows you to find evidence of clients lying to you. For example, if the User-Agent says it's Windows with a language preference of English, but the TCP…

That's actually a terrible heuristic. My requests are often from windows proxied by Linux, with language set to my preferred one in a non-matching country. And that's before I start travelling and using a hotspot with a faked TTL to workaround telco limitations. That's before you even get to people completely unaware of interesting routing applied to them (like corporate proxies, vpns) and people with incorrect maxmind entries.

Re: Botspam apocalypse

#93

Post by MauranKilom »

probably_wrong wrote: post #35
hamilyon2 wrote: post #5

I experienced this firsthand with government immigration websites. The thing is there are only so many time slots and and people are forsed to use a certain web site to apply, so everyone is hunting for available time and generally none are available. So, some creative people set up bots which check periodically for them. They are paid services which will do that for you. Now we have bots hammering gatekeeper's websi…

> I don't think there is a good solution besides a deep anti-bot expertise whithin the primary website development team But there is a solution: the website team should get their act together and remove the "first come first served" aspect altogether. Do you, citizen, want to register? Cool - leave your e-mail and we'll call you. Is the service optional? Then we'll pick at random from the pool of applicants and e-mai…

"Thank you for waiting three weeks for your appointment selection. We are happy to offer you a time slot next Friday, from 1 pm to 1:15 pm. Click here to accept: [button]. If this does not suit you, click here to get sent back to the queue: [button]."

Half the point of these services tends to be giving users some choice in when they have to show up somewhere. Because not everyone can make time in the middle of business hours of an arbitrary day. Not to mention that you might simply be out of town.

Re: Botspam apocalypse

#94

Post by viraptor »

> If Marginalia Search didn't use Cloudflare, it couldn't serve traffic.

Cloudflare is not the only CDN/protection. It's the most popular and the most evil one. You have a choice.

Re: Botspam apocalypse

#95

Post by nixcraft »

I run a popular blog and confirm that spam is a massive issue. I am trying to keep the independent web alive with an old-school commenting system because it helps readers and myself improve outdated posts. My domain is over 20+ years old and attracts all sorts of threats, including monthly DDoS and daily spam. Using Cloudflare solved all of these problems. Next, you need to add firewall rules inside Cloudflare WAF to trigger a captcha for /path/to/blog/wp-comments-post.php. That will not get rid of human spam tho. For that, you need to use another filtering service called Akismet.

Re: Botspam apocalypse

#96

Post by raverbashing »

efitz wrote: post #41
BiteCode_dev wrote: post #31

It's not that bad. First, of course, you have cloudflare and recaptcha, which are free and very efficient, as the author say. But even if you don't want to use them (some of my services don't), most bots are very dumb: - require JS, and you lose half of the web ones - silly tricks like hidden input fields in forms that worked in 2000 still work in 2022. Use a bunch of them, and you can yet again halve the bot traffic…

Also, attackers are rarely going to try to guess your URLs - they’re going to find them via Google or Shodan, or, if you’re a good rest citizen, via “/ /“

Any website gets probed for wp-admin.php etc, even if you don't use WP

Re: Botspam apocalypse

#98

Post by closedloop129 »

Animats wrote: post #39

What's hard to do now is host a lightly used but broadly interesting service that doesn't require a login. Although, surprisingly, I host such a service, and while it gets a constant stream of random hits, they're a minor nuisance. Probably because it's just the back end for a web page, and nobody bothers to target it specifically. Random web browsing won't find it, and the API will just return an error if called inc…

>What's hard to do now is host a lightly used but broadly interesting service that doesn't require a login.

Which other broadly interesting services do exist? The owners of those services could come together and offer a VPN that gets preferred treatment for these services. This could be more precise than https://www.abuseipdb.com/.

Re: Botspam apocalypse

#99

Post by rightbyte »

luckylion wrote: post #90
TomK32 wrote: post #7

Earlier quoted context omitted.

I faced a website like this recently when booking a slot at my own German embassy, went a different route around the embassy instead. What I don't like about the slot system: You won't get a convenient time slot anyways so why do they bother setting it up like this in the first place? Why not just register with your contact details and receive an email with a guaranteed spot at a selection of three days instead. No m…

That reminds me of the chaos that ensued in my state in the early days of Covid-19 vaccination when they were still having centralized systems where the elderly could book an appointment. Of course, they had way more demand than supply but still insisted on First Come, First Served, so you ended up with every member of the extended family being asked to try and book a slot, quickly overwhelming their booking systems.…

In some miracle of competence my district alotted shots by decreasing age limit so that it were no "shortage" or lagfest for those eligible in the booking system.

Re: Botspam apocalypse

#100

Post by luckylion »

realaravinth wrote: post #67
tmikaeld wrote: post #23

Earlier quoted context omitted.

"mCaptcha uses SHA256 based proof-of-work(PoW) to rate limit users." https://github.com/mCaptcha/mCaptcha

Hello! I'm the author of mCaptcha, I'd be happy to answer any questions that people might have :)

The results of the PoW are just thrown away, right? I wonder if you could couple that with something useful, e.g. what SETI@home used to do, but the intentionally small size of the work probably makes it difficult to be useful.
Post reply on HN