4 ms·

Experienced the same during my Asia travels with Cloudflare 2016/2017. Actually that was the biggest reason/negative ad not to consider Cloudflare when choosing

Experienced the same during my Asia travels with Cloudflare 2016/2017. Actually that was the biggest reason/negative ad not to consider Cloudflare when choosing a CDN. They simply don't respect Asia and other non first class countries with their standard settings. It's like good Internet only for the rich people in the world! I'm aware on the Chrome extension (really, why should I install this sh&+t on the first place?) and that you can change Cloudflare settings. But the usual IT admin won't change this settings and f&+ck up Asia.

RobertRoberts 7y ago
Asia is the #1 attacker of all websites I work with. Since 100% of the traffic (based on our analysis) coming from Asia is not legitimate business traffic, how would you advise those responsible for these sites security to handle this? Edit: I have no interest in using Cloudflare...
- knolax 7y ago
  Presumably you have a method to deter attacks that's better than IP-blocking an entire continent, otherwise you'd be utterly hopeless the moment somebody decides to attack from a North American IP.
  - optimiz3 7y ago
    North American IPs have North American law enforcement.
- therealmarv 7y ago
  Attacker means what? Serving too much traffic to bots (because that is what this captchas circumvent). How about that you can measure traffic and reaction times depending on region and also detect peaks? Ever seen a Google captcha on Google search (yes they have them too), it's much much smarter and not saying stupidly to "wrong" countries: here is a captcha.
- johndough 7y ago
  Similar for me. From the 732745 login attempts last month, 52% were from China, followed by US with 13%. Here is a graph: https://i.imgur.com/YPAuTXO.png https://i.imgur.com/YPAuTXO.png The sheer volume of bot traffic surprised me at first, especially since my website has zero human visitors as far as I can tell, but the numbers are consistent month after month. Nevertheless, my $1/month VPS can handle the traffic without a problem, so I see no need to ban or rate limit any IPs, especially since I hate captchas with a passion.
  - speedplane 7y ago
    > my $1/month VPS can handle the traffic without a problem, so I see no need to ban or rate limit any IPs, especially since I hate captchas with a passion. I run a company that routinely scrapes government run, public domain websites. Sadly, many of these sites come with captchas. We can easily bypass these captchas by paying roughly $1.50/1000 captchas, but when scraping millions of pages a month, these costs become significant. As far as I can tell, adding a captcha to a site does nothing to prevent bots, it just alters the economics of any business that relies on the data. I understand that bots can potentially slow down servers and cause disruptions for human users, but for the handful of government agencies that actually talk to us, we happily restrict scraping to certain hours of the day or limit overall traffic to a reasonable level. I would go further and happily give the money we're spending on solving captchas back to the government so they can upgrade their servers and make the system better for everyone. For those that are conducting nefarious activities, captchas likely do nothing. For individuals, they are annoying. For legitimate scraping companies, they are a needless expense. Captchas are pretty obsolete.
    - therein 7y ago
      > adding a captcha to a site does nothing to prevent bots, it just alters the economics of any business that relies on the data Definitely agreed. Recently I have been working on a side-project that makes use of bypassing/placating reCaptcha and it has been trivial and not so costly. If it is accounts you're creating, it simply puts a "reasonable" price on account creation. If it is about scraped content, once again, does the same. However these costs already existed in terms of compute resources and time anyway. Captchas hardly made it any harder.
- falcolas 7y ago
  Consider it a community-run pentest, and look for them to actually get past the gatekeepers. Set an alert for a successful login from an “Asian” IP and push them towards a honeypot. They’re doing work for you for free; take advantage of it.

RobertRoberts 7y ago

Asia is the #1 attacker of all websites I work with. Since 100% of the traffic (based on our analysis) coming from Asia is not legitimate business traffic, how would you advise those responsible for these sites security to handle this? Edit: I have no interest in using Cloudflare...

knolax 7y ago
Presumably you have a method to deter attacks that's better than IP-blocking an entire continent, otherwise you'd be utterly hopeless the moment somebody decides to attack from a North American IP.
- optimiz3 7y ago
  North American IPs have North American law enforcement.
therealmarv 7y ago
Attacker means what? Serving too much traffic to bots (because that is what this captchas circumvent). How about that you can measure traffic and reaction times depending on region and also detect peaks? Ever seen a Google captcha on Google search (yes they have them too), it's much much smarter and not saying stupidly to "wrong" countries: here is a captcha.
johndough 7y ago
Similar for me. From the 732745 login attempts last month, 52% were from China, followed by US with 13%. Here is a graph: https://i.imgur.com/YPAuTXO.png https://i.imgur.com/YPAuTXO.png The sheer volume of bot traffic surprised me at first, especially since my website has zero human visitors as far as I can tell, but the numbers are consistent month after month. Nevertheless, my $1/month VPS can handle the traffic without a problem, so I see no need to ban or rate limit any IPs, especially since I hate captchas with a passion.
- speedplane 7y ago
  > my $1/month VPS can handle the traffic without a problem, so I see no need to ban or rate limit any IPs, especially since I hate captchas with a passion. I run a company that routinely scrapes government run, public domain websites. Sadly, many of these sites come with captchas. We can easily bypass these captchas by paying roughly $1.50/1000 captchas, but when scraping millions of pages a month, these costs become significant. As far as I can tell, adding a captcha to a site does nothing to prevent bots, it just alters the economics of any business that relies on the data. I understand that bots can potentially slow down servers and cause disruptions for human users, but for the handful of government agencies that actually talk to us, we happily restrict scraping to certain hours of the day or limit overall traffic to a reasonable level. I would go further and happily give the money we're spending on solving captchas back to the government so they can upgrade their servers and make the system better for everyone. For those that are conducting nefarious activities, captchas likely do nothing. For individuals, they are annoying. For legitimate scraping companies, they are a needless expense. Captchas are pretty obsolete.
  - therein 7y ago
    > adding a captcha to a site does nothing to prevent bots, it just alters the economics of any business that relies on the data Definitely agreed. Recently I have been working on a side-project that makes use of bypassing/placating reCaptcha and it has been trivial and not so costly. If it is accounts you're creating, it simply puts a "reasonable" price on account creation. If it is about scraped content, once again, does the same. However these costs already existed in terms of compute resources and time anyway. Captchas hardly made it any harder.
falcolas 7y ago
Consider it a community-run pentest, and look for them to actually get past the gatekeepers. Set an alert for a successful login from an “Asian” IP and push them towards a honeypot. They’re doing work for you for free; take advantage of it.