5 ms·

I'm tired of seeing CAPTCHAs, redirects, those awful Google "I'm not a robot!" tests, and being forced to fork over my phone number every time I register an ema

I'm tired of seeing CAPTCHAs, redirects, those awful Google "I'm not a robot!" tests, and being forced to fork over my phone number every time I register an email account (it is no longer possible to get an email account at GMail or Yahoo without giving them a phone number). It seems like no one just wants to serve regular web pages fast any more. In my opinion, anyone who puts this sort of stuff in front of their blog is overly paranoid (unless they are some sort of high-profile victim, like Brian Krebs). Just avoid reading their blog.

ryanlol 10y ago
Funnily enough, Krebs doesn't put this sort of stuff in front of his blog. I've never seen a captcha from Google Shield or Akamai. The only reason Cloudflare captchas exist is because of utterly incompetent engineers, nothing else. You can stop attacks without breaking the internet for people without US residential IPs.
- tracker1 10y ago
  Somewhat agreed... While there are other methods, and probably should be for GET with non-html/image/script responses. Or for that matter, common authentication cookies. I would much rather than Cloudflare added a header when in "under attack" mode, and delivered cached responses to get requests.
neoCrimeLabs 10y ago
Let me introduce you to the concept of defence in depth: https://en.wikipedia.org/wiki/Defense_in_depth_(computing) https://en.wikipedia.org/wiki/Defense_in_depth_(computing) Really, the longer a website is online, the more it attracts bots. Spam bots, brute-force login attempting bots, information gathering bots, vulnerability testing bots, and many more. This isn't even counting targeted attacks. I've seen many small websites recieve much more bot traffic than user traffic. Sometimes to a crippling level. My point is, it's not paranoia if they really are after you - even if it's a mindless mass of bots. Like all security though, sometimes you affect legitimate users. This is why it's great to have multiple ways they can provide feedback.
- tracker1 10y ago
  At [a certain auto website I used to work at] the bot traffic was a significant amount of the requests... Because of the nature of referal traffic we were required to let the bot traffic stand... This was mitigated by implementing a few layers of a decent caching strategy, as well as some db improvements, and moving search queries to a separate database server (mongodb, then elasticsearch) altogether. In the end, there are lot of things you can do to help mitigate these things... It really just depends on what you are trying to accomplish with a given site.

ryanlol 10y ago

Funnily enough, Krebs doesn't put this sort of stuff in front of his blog. I've never seen a captcha from Google Shield or Akamai. The only reason Cloudflare captchas exist is because of utterly incompetent engineers, nothing else. You can stop attacks without breaking the internet for people without US residential IPs.

tracker1 10y ago
Somewhat agreed... While there are other methods, and probably should be for GET with non-html/image/script responses. Or for that matter, common authentication cookies. I would much rather than Cloudflare added a header when in "under attack" mode, and delivered cached responses to get requests.

neoCrimeLabs 10y ago

Let me introduce you to the concept of defence in depth: https://en.wikipedia.org/wiki/Defense_in_depth_(computing) https://en.wikipedia.org/wiki/Defense_in_depth_(computing) Really, the longer a website is online, the more it attracts bots. Spam bots, brute-force login attempting bots, information gathering bots, vulnerability testing bots, and many more. This isn't even counting targeted attacks. I've seen many small websites recieve much more bot traffic than user traffic. Sometimes to a crippling level. My point is, it's not paranoia if they really are after you - even if it's a mindless mass of bots. Like all security though, sometimes you affect legitimate users. This is why it's great to have multiple ways they can provide feedback.

tracker1 10y ago
At [a certain auto website I used to work at] the bot traffic was a significant amount of the requests... Because of the nature of referal traffic we were required to let the bot traffic stand... This was mitigated by implementing a few layers of a decent caching strategy, as well as some db improvements, and moving search queries to a separate database server (mongodb, then elasticsearch) altogether. In the end, there are lot of things you can do to help mitigate these things... It really just depends on what you are trying to accomplish with a given site.