4 ms·

This strikes me as a terrible idea, relying on an idiosyncrasy of an arbitrary database to deny access to users. For anyone doing something like this with a se

by gazby 4y ago

This strikes me as a terrible idea, relying on an idiosyncrasy of an arbitrary database to deny access to users. For anyone doing something like this with a service that's useful to people, consider MaxMind's minFraud service. It's PAYG and you can choose three different levels of information at three different price points. It's targeted at fraud minimization, but you can hand it as little as an IP address and it'll give you what you need to know.

panarky 4y ago
Depends on the use case. MaxMind's minFraud is $0.015 per request and requires a call to an external endpoint. Justified for finance and shopping apps, not great for a high volume free service. And you don't have to deny based on this one signal alone, you could fall back to recaptcha or minFraud to reduce the false positive rate.
- capableweb 4y ago
  > MaxMind's minFraud is $0.015 per request and requires a call to an external endpoint. Justified for finance and shopping apps, not great for a high volume free service. What fraud are you trying to prevent that gets abused in a free service? Most of the abuse I see for free services I host is DDoS, brute-forcing paths/authentication and port scanning, but all of those are trivial to deal with rate-limiting.
  - zdragnar 4y ago
    Any and all public form submissions will get spammed. My wife ran a small business for awhile that catered to local customers only (i.e. not an online business, products didn't ship through the mail. She added a contact us type form which submitted to google forms as a quick alternate to phone calls for prospective clients. It was used almost exclusively by people trying to sell her things from overseas. She wasn't even running ads or anything online, so how they ever found the website in the first place, I have no idea.
    - capableweb 4y ago
      That's also relatively easy to protect. First defense is rate-limited, second is captchas, third is having a dynamic "secret" key fetching from some backend via JS that gets injected into the form and works as a "password" to successfully trigger the email to get sent (but displaying success messages even if it's not).
      - d110af5ccf 4y ago
        > but displaying success messages even if it's not Please don't do stuff like this. Some of use use VPNs and aggressively block third party JS. These sorts of shenanigans render many sites unusable which is frustrating but simply not using those services is a price I'm more than willing to pay at this point.
        capableweb 4y ago
        There is no need for 3rd party JS. It's something like ten lines and you can embed it in a script tag right next to the form elements.
      - parasti 4y ago
        > dynamic "secret" key fetching from some backend via JS that gets injected into the form and works as a "password" to successfully trigger the email to get sent Are you describing nonces? A nonce is basically a "secret" (due to SSL encryption) number inserted into the HTML and submitted via a form. You don't need JS, just SSL.
        capableweb 4y ago
        Yeah, but in simpler terms :) Making it require JS is on purpose as a lot of spam robots only parse HTML and don't execute JS, so you get less spam that way.
    - account42 4y ago
      Just require submissions (from new users at least) to be manually approved before being shown publicly or having any other side effects and your will be set. A lot of people seem to like making spam into a much bigger problem than it is but how much do you actually get and how long do you really need to sort it out manually instead of relying on automated solutions that are GUARANTEED to have false positives. But since it's your time (not much) against other peoples frustration (which you might not even see so can easily ignore) you choose to make the world a worse place?
fire 4y ago
I find it more than a little amusing that we go from decrying an arbitrary database solution[1] to recommending one 1: ( which is likely to be maxmind's geoip DB in many cases anyway )
- gazby 4y ago
  We go from decrying use of an arbitrary implementation detail of a database not fit for purpose, to recommending using a separate database for its intended purpose that just happens to be from the same vendor.

by gazby 4y ago

panarky 4y ago

Depends on the use case. MaxMind's minFraud is $0.015 per request and requires a call to an external endpoint. Justified for finance and shopping apps, not great for a high volume free service. And you don't have to deny based on this one signal alone, you could fall back to recaptcha or minFraud to reduce the false positive rate.

capableweb 4y ago
> MaxMind's minFraud is $0.015 per request and requires a call to an external endpoint. Justified for finance and shopping apps, not great for a high volume free service. What fraud are you trying to prevent that gets abused in a free service? Most of the abuse I see for free services I host is DDoS, brute-forcing paths/authentication and port scanning, but all of those are trivial to deal with rate-limiting.
- zdragnar 4y ago
  Any and all public form submissions will get spammed. My wife ran a small business for awhile that catered to local customers only (i.e. not an online business, products didn't ship through the mail. She added a contact us type form which submitted to google forms as a quick alternate to phone calls for prospective clients. It was used almost exclusively by people trying to sell her things from overseas. She wasn't even running ads or anything online, so how they ever found the website in the first place, I have no idea.
  - capableweb 4y ago
    That's also relatively easy to protect. First defense is rate-limited, second is captchas, third is having a dynamic "secret" key fetching from some backend via JS that gets injected into the form and works as a "password" to successfully trigger the email to get sent (but displaying success messages even if it's not).
    - d110af5ccf 4y ago
      > but displaying success messages even if it's not Please don't do stuff like this. Some of use use VPNs and aggressively block third party JS. These sorts of shenanigans render many sites unusable which is frustrating but simply not using those services is a price I'm more than willing to pay at this point.
      - capableweb 4y ago
        There is no need for 3rd party JS. It's something like ten lines and you can embed it in a script tag right next to the form elements.
    - parasti 4y ago
      > dynamic "secret" key fetching from some backend via JS that gets injected into the form and works as a "password" to successfully trigger the email to get sent Are you describing nonces? A nonce is basically a "secret" (due to SSL encryption) number inserted into the HTML and submitted via a form. You don't need JS, just SSL.
      - capableweb 4y ago
        Yeah, but in simpler terms :) Making it require JS is on purpose as a lot of spam robots only parse HTML and don't execute JS, so you get less spam that way.
  - account42 4y ago
    Just require submissions (from new users at least) to be manually approved before being shown publicly or having any other side effects and your will be set. A lot of people seem to like making spam into a much bigger problem than it is but how much do you actually get and how long do you really need to sort it out manually instead of relying on automated solutions that are GUARANTEED to have false positives. But since it's your time (not much) against other peoples frustration (which you might not even see so can easily ignore) you choose to make the world a worse place?

fire 4y ago

I find it more than a little amusing that we go from decrying an arbitrary database solution[1] to recommending one 1: ( which is likely to be maxmind's geoip DB in many cases anyway )

gazby 4y ago
We go from decrying use of an arbitrary implementation detail of a database not fit for purpose, to recommending using a separate database for its intended purpose that just happens to be from the same vendor.