4 ms·

Can somebody tell me why we don't just classify bots as legitimate users and get rid of all this shit? If you want to prevent insane amounts of traffic, you can

Can somebody tell me why we don't just classify bots as legitimate users and get rid of all this shit? If you want to prevent insane amounts of traffic, you can already use rate-limiting strategies. Why does anyone care if it's a bot or a person? Are we just unable to scale our systems to meet such demand? Cloudflare even offers queuing in extreme cases, if I'm not mistaken. I have a silly anecdote. So, my wife wanted a Louis Vuitton purse - one of the more modest ones, which is relevant. Being more affordable, the demand for it is amongst the highest of their offerings presumably. But, they artificially create a scarcity scenario so it's more desirable. This then leads to bots farming the page endlessly and invididuals struggling to get them. So, the bots win anyway. Why don't they just accept a waitlist if they're going to be so silly about it? Or verify you are a human being using some kind of private identity service when you attempt to purchase your cart? How does throwing up blocks on the page solve anything? Edit: Added anecdote

jgrahamc 5y ago
It's not (just) about load: it's about unwanted scraping, retail bots grabbing inventory before humans can, credential stuffing done slowly and widely. All manner of unwanted interaction with a website or API.
- lucasyvas 5y ago
  There are other solutions to at least one of the cited problems. I added an anecdote above and I'm hoping to see what you think. I would challenge that there is no such thing as unwanted traffic if it's publicly accessible - If you want it to be stricter, you should be requiring accounts with strict purchasing limits matching that of a normal person by default. No "anonymous" purchases, and a more appropriate identity vetting on account creation.
  - yunohn 5y ago
    I think the weakness in your assumption is that CAPTCHAs exist solely to solve retail scalping by bots. It serves a much larger purpose - mitigating bot load in aggregate across an entire domain or network. Maybe you’re assuming that DDOS/bot attacks are rare? Because they’re not (1). If you let all of them continue willy-nilly, obviously it’ll get overwhelmed at some point? Plus, why waste so much server energy/time serving malicious load… (1) https://blog.cloudflare.com/network-layer-ddos-attack-trends-for-q4-2020/ https://blog.cloudflare.com/network-layer-ddos-attack-trends...
vslira 5y ago
The consumer web is an all-you-can-eat buffet and bots have unlimited appetite. Also, you can’t monetize their robotic eyeballs. So the economics wouldn’t work, mostly
Nextgrid 5y ago
A large part of the internet is after "growth and engagement". They don't have a real business model where the consumer pays for the service (otherwise it wouldn't matter whether the paid content was accessed by a human, bot or even alien), so the best they can do is either "grow" which means recruit human users (or at least with enough plausible deniability to claim they're all human - whether they actually are doesn't matter) so they can get more investors to pour money into the dumpster fire (though thankfully that strategy seems to have died down now), or obtain an ever-increasing amount of "engagement" which involves wasting human user's time so they can sell that crowd to advertisers.

jgrahamc 5y ago

It's not (just) about load: it's about unwanted scraping, retail bots grabbing inventory before humans can, credential stuffing done slowly and widely. All manner of unwanted interaction with a website or API.

lucasyvas 5y ago
There are other solutions to at least one of the cited problems. I added an anecdote above and I'm hoping to see what you think. I would challenge that there is no such thing as unwanted traffic if it's publicly accessible - If you want it to be stricter, you should be requiring accounts with strict purchasing limits matching that of a normal person by default. No "anonymous" purchases, and a more appropriate identity vetting on account creation.
- yunohn 5y ago
  I think the weakness in your assumption is that CAPTCHAs exist solely to solve retail scalping by bots. It serves a much larger purpose - mitigating bot load in aggregate across an entire domain or network. Maybe you’re assuming that DDOS/bot attacks are rare? Because they’re not (1). If you let all of them continue willy-nilly, obviously it’ll get overwhelmed at some point? Plus, why waste so much server energy/time serving malicious load… (1) https://blog.cloudflare.com/network-layer-ddos-attack-trends-for-q4-2020/ https://blog.cloudflare.com/network-layer-ddos-attack-trends...

vslira 5y ago

The consumer web is an all-you-can-eat buffet and bots have unlimited appetite. Also, you can’t monetize their robotic eyeballs. So the economics wouldn’t work, mostly

Nextgrid 5y ago

A large part of the internet is after "growth and engagement". They don't have a real business model where the consumer pays for the service (otherwise it wouldn't matter whether the paid content was accessed by a human, bot or even alien), so the best they can do is either "grow" which means recruit human users (or at least with enough plausible deniability to claim they're all human - whether they actually are doesn't matter) so they can get more investors to pour money into the dumpster fire (though thankfully that strategy seems to have died down now), or obtain an ever-increasing amount of "engagement" which involves wasting human user's time so they can sell that crowd to advertisers.