3 ms·
Google rate limits unauthenticated sessions. Try using Google over tor. They are pretty heavy-handed about it too. Github isn't tiny enough to use ddos as an ex
by newjersey 11y ago
Google rate limits unauthenticated sessions. Try using Google over tor. They are pretty heavy-handed about it too. Github isn't tiny enough to use ddos as an excuse.
- caleblloyd 11y agoTOR still uses cookies so a session ID can be set for the user agent and rate limited. DDOS scripts create new sessions on every attack request. It's a very hard problem to solve without blocking legitimate traffic too.
- newjersey 11y agoWell, at some point you have to block legitimate traffic. My thought was it doesn't have to be black and white. Maybe require the user to solve a captcha after the nth search from the same IP address? How big are the biggest of botnets? A few hundred thousand computers? Or maybe even require captcha for every unauthenticated search.
- driverdan 11y agoRate limiting is IP based, not session based.
- EGreg 11y agoNot that difficult! Simply sign your session ids with an HMAC, to verify the id without any I/O! And require something expensive to create a session (such as a hash-based challenge request). Sessions are usually not needed for static sites, so by the time the person searches, their browser will have earned one session. A spammer on the other hand wouldn't have the computational power to create the various sessions. Also, if a spammer's IP is detected, the computational complexity can be increased for that IP.