3 ms·
client side, GPU bound challenge (the user doesn't do anything but wait for a spinner to load, the javascript has to solve a np hard problem). won't block all
by obblekk 6y ago
client side, GPU bound challenge (the user doesn't do anything but wait for a spinner to load, the javascript has to solve a np hard problem).
won't block all spammers, but will increase the server cost (even for selenium) to the point where they'll have to get GPU instances which will be too expensive for a script kiddie.
this is what cloudflare is sorta doing when they say "verifying your browser"
- abiogenesis 6y agoThis is one of the best methods to rate limit attackers. Something like https://news.ycombinator.com/item?id=7944540 https://news.ycombinator.com/item?id=7944540
- unnouinceput 6y agoHow will this stop a bot that has embedded browser in it? For the bot is just a thread that will wait on "cloudflare verification" to happen. Not that hard to bypass
- Kiro 6y agoIt will cost server resources for the attacker. It's not just waiting, it needs to actually solve the problem.
- luckylion 6y agoUnless you make it very expensive (which would turn legitimate users away, because they don't want to wait for a minute to sign up), that won't help, I think. You tie up a core for 5 seconds, but the server has 12 of those, so they can create 12 accounts every 5 seconds => still too much to handle in moderation.
- zaarn 6y agoIt's 12 accounts per second instead of 600 per second if it only takes 1 second. Or 1200 if it takes half a second. That is still an improvement.
- rolandog 6y agoI've seen this in some forums; you suddenly get a lot of cpu usage; at first I thought a crypto miner was getting through my external script blockers, but after checking the source and grokking the minified code, it dawned on me what it was.