5 ms·

In that case, an IP or IP block throttling is good enough. Except then there are those pesky CGNATs to handle including Chinese Great Wall. Anyway, high profi

In that case, an IP or IP block throttling is good enough. Except then there are those pesky CGNATs to handle including Chinese Great Wall. Anyway, high profile spammers will emulate enough of the browser to render any measure based on browser anomaly detection worthless. Including using a headless browser. The only way to defeat them would be too put some quite computationally intensive JS operation... (On par with mining, ruining all the laptops, phones and tablets. But you can make it not trigger every time.) This would make spamming expensive. Server-side we have excellent AI spam filters that nobody seems to be using to fire off a captcha check later. The big problem here is that you cannot offload to some provider without inviting big privacy concerns. (Same problem as forum/chat/discussion platform providers.)

tjoff 7y ago
IP block for registration? Seems highly unrealistic.
thu2111 7y ago
high profile spammers will emulate enough of the browser to render any measure based on browser anomaly detection worthless Based on actual experience of fighting spammers, that isn't the case. Like a lot of people new to spam fighting you're making assumptions about the adversaries that aren't valid.
- bradknowles 7y ago
  There are many different types of spammers and attackers. Some will be stopped by the simplest protection mechanisms. Some will be indistinguishable from real humans, and you won’t be able to stop them without crippling your services for your real users. But those are the two extremes. The real problem is the ones between those extremes. Every intentional stumbling block you put in the path to try and stop those in the middle might also have a negative impact on your real users. The real problem is that the most troublesome attackers will learn and adapt to whatever stumbling blocks you put in the path. So, how many of your own toes are you willing to sacrifice with your foot guns in the name of stopping the attackers?
  - thu2111 7y ago
    Very few, but that's OK. Good spam fighters don't have to sacrifice many or really any toes to stop nearly all spam. You seem to be assuming a linear relationship between effort and false positives, but that would be a very ineffective spam fighting team relative to the ones I've worked on. In practice you can have nearly no false positives combined with nearly no false negatives. This isn't easy and many firms fail at it, but you it can be done and we routinely did it.
massaman_yams 7y ago
No. Botnets are large and broadly distributed enough to render protection methods based only on the IP or IP block ineffective. They're commonly used for mailbombing attacks such as those described here: https://www.wired.com/story/how-journalists-fought-back-against-crippling-email-bombs/ https://www.wired.com/story/how-journalists-fought-back-agai... Do you think a botnet with 10k machines is going to be meaningfully inhibited by making each machine's cpu run calculations for a second or two for each submission? I'm sure reCAPTCHA looks at the IP and IP block as one of the inputs to its ML algorithm, but as one or two of perhaps a dozen different features - including mouse movement and/or keyboard input, which is quite a bit harder to fake.

tjoff 7y ago

IP block for registration? Seems highly unrealistic.

thu2111 7y ago

high profile spammers will emulate enough of the browser to render any measure based on browser anomaly detection worthless Based on actual experience of fighting spammers, that isn't the case. Like a lot of people new to spam fighting you're making assumptions about the adversaries that aren't valid.

bradknowles 7y ago
There are many different types of spammers and attackers. Some will be stopped by the simplest protection mechanisms. Some will be indistinguishable from real humans, and you won’t be able to stop them without crippling your services for your real users. But those are the two extremes. The real problem is the ones between those extremes. Every intentional stumbling block you put in the path to try and stop those in the middle might also have a negative impact on your real users. The real problem is that the most troublesome attackers will learn and adapt to whatever stumbling blocks you put in the path. So, how many of your own toes are you willing to sacrifice with your foot guns in the name of stopping the attackers?
- thu2111 7y ago
  Very few, but that's OK. Good spam fighters don't have to sacrifice many or really any toes to stop nearly all spam. You seem to be assuming a linear relationship between effort and false positives, but that would be a very ineffective spam fighting team relative to the ones I've worked on. In practice you can have nearly no false positives combined with nearly no false negatives. This isn't easy and many firms fail at it, but you it can be done and we routinely did it.

massaman_yams 7y ago

No. Botnets are large and broadly distributed enough to render protection methods based only on the IP or IP block ineffective. They're commonly used for mailbombing attacks such as those described here: https://www.wired.com/story/how-journalists-fought-back-against-crippling-email-bombs/ https://www.wired.com/story/how-journalists-fought-back-agai... Do you think a botnet with 10k machines is going to be meaningfully inhibited by making each machine's cpu run calculations for a second or two for each submission? I'm sure reCAPTCHA looks at the IP and IP block as one of the inputs to its ML algorithm, but as one or two of perhaps a dozen different features - including mouse movement and/or keyboard input, which is quite a bit harder to fake.