3 ms·
They also protect against ddos, sqli, overuse, bots etc. so comment spam is only one problem and get requests are not always safe. You'd think they could be fa
by grey-area 11y ago
They also protect against ddos, sqli, overuse, bots etc. so comment spam is only one problem and get requests are not always safe.
You'd think they could be far more sophisticated about reputation though and adjust it in realtime so that ips are by default trusted and are marked down temporarily for bad behaviour.
- ascorbic 11y agoThe problem is that with Tor the IP isn't much use as an identifier to establish reputation. As CloudFlare say in their post, they do use reputation of the exit node IPs to some extent, but the trouble is that there's so much abuse from Tor, most exit nodes always have bad rep. The zero knowledge tokens t hat they talk about are a way of establishing reputation without losing anonymity.
- grey-area 11y agoWhat they do at present appears to be to assign long term reputation to tor nodes, but if instead they assigned reputation over a few minutes and reset it soon after, wouldn't that work better and avoid being overly broad? More load for them obviously but could possibly be done just for tor nodes. The token scheme looks interesting though as long as it was truly anonymous and tokens were different on each request to avoid tracking. https://github.com/gtank/captcha-draft/blob/master/captcha-plugin-draft.txt https://github.com/gtank/captcha-draft/blob/master/captcha-p... i wonder if they could do a plugin for the tor browser so that they don't have to wait for tor?
- avip 11y agoOther CDN/WAF providers are indeed doing that.
- CloudFlrFeedbck 11y agoWhen are GET requests unsafe?
- grey-area 11y agoddos or sqli, see the cf article
- CloudFlrFeedbck 11y agoA respectable CDN should be able to handle lots of GET requests, even if by attack. As others have pointed out, the Tor network can't support much traffic, so DDoS by GET requests does not seem like a big concern.