4 ms·

This kind of botspam is usually pretty easy to address with redbean using the finger https://redbean.dev/#finger https://redbean.dev/#finger and maxmind https:/

by jart 4y ago

This kind of botspam is usually pretty easy to address with redbean using the finger https://redbean.dev/#finger https://redbean.dev/#finger and maxmind https://redbean.dev/#maxmind https://redbean.dev/#maxmind modules. The approach I usually recommend people isn't so much ip reputation, which can be unfair, but rather it allows you to find evidence of clients lying to you. For example, if the User-Agent says it's Windows with a language preference of English, but the TCP SYN packet says it's Linux and MaxMind says it's coming from China, then that means the client is lying (or being MiTM'd) and you can righteously hellban once it's fingered for the crime.

unglaublich 4y ago
What keeps bots from just fixing their acts and reporting correct info instead?
- jart 4y ago
  What's stopping them from clubbing you with a monkey wrench? With bots, to answer your question, it'd probably take another standard deviation in the IQ of the person using it. So you've ruled out all the script kiddies in the world by default. The purpose of this game isn't to have a perfect defense, which is impossible, but rather to make the list of people who can mess with you as short as possible.
- krageon 4y ago
  Nothing. Once this sort of fingerprinting becomes common the common bot frameworks will bypass it.
  - jart 4y ago
    But it's not common. So for the time being, redbean users have the advantage.
    - krageon 4y ago
      If taking away normal users' agency is an advantage to you, you go and use it.
  - marginalia_nu 4y ago
    To be fair, bot countermeasures are and have always been an arms race.
BiteCode_dev 4y ago
My laptop is lying all the time. I change my UA, preferred language, my ip, mac and so on, because of tracking, terrible dev assumptions and personal preferences. Yet, I'm a very good web citizen. Because of this, I often have to solve the same captcha many times before it thinks I'm human.
- jart 4y ago
  I don't doubt it. Given how rare people like you are, I'm sure a good citizen like you would also be perfectly fine sending an email to the service asking to be whitelisted, or having a second browser that isn't your daily driver for situations like this that doesn't try to obfuscate its identity by behaving like a bot.
  - BiteCode_dev 4y ago
    The first solution isn't practical (so many services to manually find a mail to send a message to, then interact with a human that might not even exist), and if you do, they don't whitelist you. I tried. Either they don't answer, or have "no way to have a specific whitelist for a single user in our system". So the second browser is the solution. But then the site will do all the bad things that I wanted it not to do in the first place. Like serving terrible French results instead of good English ones, or assuming Firefox doesn't work based on UA while their site work fine with it. And of course track me to death, sell my data, and so on. The only solution that works is to chose services you pay money for: they have your card, so they know you are not a bot. For years now, I have been suspicious of anything free. But it doesn't solve the tracking problem.
    - jart 4y ago
      Yes I understand the desire for capitalism rather than surveillance capitalism, but that's a derailment. The OP appears to be someone who just wants to build something cool and share it with other human beings. In that case, it's really helpful to be able to have a free practical way to address abuse. Would you really tell someone like the OP to stop expressing themself and shut down their service and put a paid one in its place? How can you charge for search when Google gives it away for free?
viraptor 4y ago
That's actually a terrible heuristic. My requests are often from windows proxied by Linux, with language set to my preferred one in a non-matching country. And that's before I start travelling and using a hotspot with a faked TTL to workaround telco limitations. That's before you even get to people completely unaware of interesting routing applied to them (like corporate proxies, vpns) and people with incorrect maxmind entries.
deleted 4y ago
[deleted]

by jart 4y ago

unglaublich 4y ago

What keeps bots from just fixing their acts and reporting correct info instead?

jart 4y ago
What's stopping them from clubbing you with a monkey wrench? With bots, to answer your question, it'd probably take another standard deviation in the IQ of the person using it. So you've ruled out all the script kiddies in the world by default. The purpose of this game isn't to have a perfect defense, which is impossible, but rather to make the list of people who can mess with you as short as possible.
krageon 4y ago
Nothing. Once this sort of fingerprinting becomes common the common bot frameworks will bypass it.
- jart 4y ago
  But it's not common. So for the time being, redbean users have the advantage.
  - krageon 4y ago
    If taking away normal users' agency is an advantage to you, you go and use it.
- marginalia_nu 4y ago
  To be fair, bot countermeasures are and have always been an arms race.

BiteCode_dev 4y ago

My laptop is lying all the time. I change my UA, preferred language, my ip, mac and so on, because of tracking, terrible dev assumptions and personal preferences. Yet, I'm a very good web citizen. Because of this, I often have to solve the same captcha many times before it thinks I'm human.

jart 4y ago
I don't doubt it. Given how rare people like you are, I'm sure a good citizen like you would also be perfectly fine sending an email to the service asking to be whitelisted, or having a second browser that isn't your daily driver for situations like this that doesn't try to obfuscate its identity by behaving like a bot.
- BiteCode_dev 4y ago
  The first solution isn't practical (so many services to manually find a mail to send a message to, then interact with a human that might not even exist), and if you do, they don't whitelist you. I tried. Either they don't answer, or have "no way to have a specific whitelist for a single user in our system". So the second browser is the solution. But then the site will do all the bad things that I wanted it not to do in the first place. Like serving terrible French results instead of good English ones, or assuming Firefox doesn't work based on UA while their site work fine with it. And of course track me to death, sell my data, and so on. The only solution that works is to chose services you pay money for: they have your card, so they know you are not a bot. For years now, I have been suspicious of anything free. But it doesn't solve the tracking problem.
  - jart 4y ago
    Yes I understand the desire for capitalism rather than surveillance capitalism, but that's a derailment. The OP appears to be someone who just wants to build something cool and share it with other human beings. In that case, it's really helpful to be able to have a free practical way to address abuse. Would you really tell someone like the OP to stop expressing themself and shut down their service and put a paid one in its place? How can you charge for search when Google gives it away for free?

viraptor 4y ago

That's actually a terrible heuristic. My requests are often from windows proxied by Linux, with language set to my preferred one in a non-matching country. And that's before I start travelling and using a hotspot with a faked TTL to workaround telco limitations. That's before you even get to people completely unaware of interesting routing applied to them (like corporate proxies, vpns) and people with incorrect maxmind entries.

deleted 4y ago

[deleted]