4 ms·
Why is everyone obsessed with knowing whether the user is a bot or an actual person? What differences does it make? A bot it's not inherently malicious, there a
by rnhmjoj 11y ago
Why is everyone obsessed with knowing whether the user is a bot or an actual person? What differences does it make? A bot it's not inherently malicious, there are thousand of legitimate use cases: a bot may be downloading content as part of a script or some application, checking updates or creating a cache. Traffic generated by bots should not be blocked per se. There are certainly lots of malicious bots scanning for vulnerabilities, DDoSing sites and so on but this applies to people as well.
I think human generated traffic may have priority but blocking bots entirely is nonsense: ultimately the user agent is always a "bot" acting on behalf of an actual person: by blocking this traffic you may always break some user workflow.
- jeffasinger 11y agoCAPTCHAs are useful when you want to rate limit something to an extremely low rate, like for example attempting to login with a username and password.
- rnhmjoj 11y agoYou could slow down the responses or rate limit the requests, with no need to completely block automatic logins.
- progval 11y agoYou would have to limit it per IP address if you do not want to after all clients. So it would not be effective against someone who can use many IP addresses (eg. with Tor)
- jeffasinger 11y agoIf you are a valuable enough target, this is not an option. IPs are cheap, if you let someone try 20 times in an hour before banning an IP, there are targets that people will cycle through IPs that quickly for.
- dredmorbius 11y agoTor largely prevents most approaches to this. You'd need some way to provide a ticket to a given client, check for it later, and, preferably, ensure anonymity over time. I've just posted top-level in this thread listing two projects of which I'm aware that provide this, though as experimental protocols only. I've been mildly agitating for further development of such tools. Looks as if CloudFlare are working in a similar direction, which I see as positive.
- sigmar 11y ago>There are certainly lots of malicious bots scanning for vulnerabilities, DDoSing sites and so on but this applies to people as well. Nah, a human isn't going to waste their time refreshing a page manually 50,000 times.
- ryanlol 11y agoWhich seems to be a pretty easy pattern to detect. (And not something you'd want to do over Tor)
- rnhmjoj 11y agoBut it surely can attemp cross-site scripting, send phishing and spam messages, broken requests and look for exploits. Also TOR is generally so slow I don't think there is even the possibility of generating enough traffic for a DOS.
- lenish 11y agoIt would depend on the website's resources and services. For example, a layer 7 DoS which just queries an expensive endpoint on the website over and over may not need high traffic volume to overload the website's systems.
- shopkins 11y agoSounds like something a bot would say.