6 ms·
It's annoying for sure. I deal with abuse at a large scale. I'd recommend: - Rate-limit everything, absolutely everything. Set sane limits. - Rate-limit POST
by Avamander 4y ago
It's annoying for sure. I deal with abuse at a large scale.
I'd recommend:
- Rate-limit everything, absolutely everything. Set sane limits.
- Rate-limit POST requests harder. Preferably dynamically based on geoip.
- Rate-limit login and comment POST requests even harder. Ban IPs that exceed the amount.
- Require TLS. Drop TLSv1.0 and TLSv1.1. Bots certainly break.
- Require SNI. Do not reply without SNI (nginx has 444 return code for that). Ban IP's on first hit that connect without. There's no legitimate use and you'll also disappear from places like Shodan.
- If you can, require HTTP/2.0. Bots break.
- Ban IP's listed on StopForumSpam, ban destination e-mail addresses listed there. If possible also contribute back to SFS and AbuseIPDB.
- Collect JA3 hashes, figure out malicious ones, ban IPs that use those hashes. This blocks a lot of shit trivially because targeting tools instead of behaviour is accurate.
- gkbrk 4y ago> If you can, require HTTP/2.0. Bots break. Non-bots break as well. I have Firefox configured to use HTTP/1.1 only. No reason to chase Google's standard-of-the-day, HTTP/1.1 has worked for ages and it will continue to do so for the foreseeable future.
- sirshmooey 4y agoGenuinely curious, why disable HTTP2? Your web browsing must be awfully slow sans multiplexing.
- gkbrk 4y ago> why disable HTTP2 Because it adds nothing to improve my browsing experience, and reducing the number of protocols supported by my browser from 3 to 1 also reduces the attack surface. > Your web browsing must be awfully slow sans multiplexing. And yet it's not slowed down at all. How many different resources must a web page use before it feels slow on a connection pool of keep-alive TCP sockets? Maybe people visit some wild experimental web pages with hundreds of blocking <src> tags that are not bundled/minified? Either way, my experience is it doesn't slow anything down when I use both websites (forums, resources, youtube, social media) and web apps (banking, maps, food delivery etc).
- dboreham 4y agoPerhaps your experience is the same, but it may impose extra load on middleboxes that track TCP flows.
- stonemetal12 4y agohttps://github.com/dalf/pyhttp-benchmark/blob/master/results/output.md https://github.com/dalf/pyhttp-benchmark/blob/master/results... HTTP2 is barely any better than http 1, if you want it to make a 1/10 of a second difference you have to be making 100s of requests.
- Avamander 4y agoSome old browsers break as well, if it's worth it depends on the website. It's your prerogative to disable an useful feature, you can also disable JavaScript. But there's little reason for a website operator to cater to that unnecessary edge case if it's mostly used for abuse.
- NullPrefix 4y agoJavaScript is mostly used for abuse.
- Avamander 4y agoNot in that direction though.
- bsuvc 4y agoThat seems like a strange reason to me. Isn't HTTP/2.0 faster? Isn't it also basically transparent to the end user? I'm trying to figure out what I would gain by configuring my browser to use HTTP/1.1 only.
- dspillett 4y agoIf doing something fends off a lot of bots, but also inconveniences a very small number of people who have significantly non-standard or just out-of-date configurations, I'm likely to favour protecting myself from the former over worrying about the latter. To paraphrase Mr Spok: The inconveniences of the me outweigh the inconveniences of the you!
- b112 4y agoBear in mind, inconveniencing 4.8% of users, does not map identically. Instead, you are often dumping 4.8+4.8+4.8 as you add block methods, with some overlap.
- marginalia_nu 4y agoTo be fair, most of my visitors are not exactly lining up with the expectations of "standard". I get >90% of my [human] traffic from desktop clients, for example.
- b112 4y agoSure, but the logic about mitigation does hold true, if you overlap methods. Eg, your method described in prior post, along with thongs which may lock out VPN or NAT users. Just something to consider.
- dspillett 4y agoFWIW I don't block non-HTTP2, but at some point that 4.8% who can't use it will be much smaller and if you are still turning it off you will be part of an increasingly insignificant population. It is not dissimilar to measures that will have the side effect of stopping apps working on IE - I wouldn't in DayJob¹ but I'd not think twice on a personal project. I don't have time to care that much about people with very non-standard or very out-of-date setups, if accidentally blocking them is a side effect of a benefit I might feel. Added benefit: blocking them effectively removes potentially difficult users from the support queue! And to some, that 4.8%+4.8%+… doesn't overlap their target audience enough that losing the few in both categories isn't really a problem in the grand scheme of things. ---- [1] some of our clients still have users using IE11 even though we no longer officially support it² so we still don't want anything other than minor display & performance issues there ATM [2] of course we will for more money, if someone wants to pay us to address said minor display & performance issues
- troad 4y agoIn other words, make your website unusable for people who have to connect through VPNs or public networks, difficult for anyone without a stable Western broadband connection, and unpleasant for everyone else.
- Avamander 4y agoWith a bit of work any limits can be fine-tuned usually not to impact actual users behind NATs. Some collateral does happen but that's an unfortunate reality. I'd like you to elaborate on the rest of your comment though.
- dalbasal 4y agoI agree that there's a "that's life" aspect to collateral/tradeoff. That said, I sympathize somewhat with the parent. "Done right, negative side effects are minimal" is an uncomforting statement. First, because things are often not implemented correctly. There are a lot of details and tuning that will often fail to materialize in practice. Second, because long tail usability issues can often go overlooked. The abuse->anti-abuse feedback loop is pretty tight. Abuse gets identified and counteracted. The anti-abuse-> UX problems loop tends to be noticeably looser. Often, it's just aggregates (revenue/AUD/etc).
- hbn 4y agoGoogle search seems to have this issue for most of the regions near me on the VPN I use (Private Internet Access) Sometimes I just turn it on if I have to fire off a few searches because it'll make me complete a long, tedious captcha for EVERY search
- ajsnigrutin 4y ago> - Rate-limit everything, absolutely everything. Set sane limits. This breaks when multiple users are behind the same IP. I've seen services fail even in classroom, because the prof did something and a few tens of students followed (captchas everywhere).
- CWuestefeld 4y agoFor sure! Our site is B2B ecommerce, and any sizeable customer has all their users coming to us from a single NAT or proxy. For major customers it's likely that there are several of their employees using our system at any given time. The answer needs a whole lot more finesse than this.
- Avamander 4y agoA "sane limit" wouldn't be "one person one IP", such a global limit should rather stop one IP (even if it's a nasty CGNAT) from having a negative impact on the entire service. If such a limit would hinder classroom usage, but that's your target audience then other solutions should be found, fairly logical.
- marginalia_nu 4y ago(Author) I do in fact rate-limit everything, it is good advice, but the way you implement rate-limiting allows for traffic bursts. It's basically a reverse leaky bucket, where you start out with N allowed requests, which gets depleted for each request, and refilled slowly over time. Search traffic is fairly bursty, people do a few requests where they tweak the query and then they go go away.
- RamRodification 4y agoOff-topic, but isn't that a normal (non-reverse) leaky bucket? When the bucket gets full the rate limiting engages. An empty bucket allows for a burst without getting full. It slowly leaks over time at a rate that allows a normal amount of traffic without filling up.
- 4y ago
- 1vuio0pswjnm7 4y ago"This spam traffic is all from botnets with IPs all over the world. Tens, maybe hundreds of thousands of IPs, each with a relatively modest query rates, so rate limiting does all of bupkis."
- Avamander 4y agoYep, there isn't a silver bullet that curtails all abuse.
- shiftpgdn 4y agoBlocking the entire aws/gcp/azure/digital ocean/linode IP ranges will stop 99.999% of malicious bot traffic full stop.
- CWuestefeld 4y agoYes, it would. It would also stop a not-insignificant number of my customers.
- Plasmoid 4y agoWhy do your customers pay Amazon for egress to the internet? Isn't that very expensive?
- neurostimulant 4y agoI'm sure these would work but I'll probably got banned too just because I often try to poke ip addresses directly. I also often use VPN especially when outside, so I'll definitely got banned.
- Avamander 4y agoVPNs tend to be smaller offenders in terms of clients-per-IP than say educational institutions or offices.
- CodeSgt 4y ago> Rate-limit login and comment POST requests even harder. Ban IPs that exceed the amount Don't ban IPs. Or if you do, let the ban expire relatively quickly (days/weeks, not months/years).
- Avamander 4y agoIdeally you'd keep track of repeat offenders and decide the length based on that.
- annoyingnoob 4y agoI ban IPs from small data centers all the time. For my purposes there is no need to support traffic from small hosting providers that are everywhere all over the world. I do not tend to ban the IPs of commercial ISPs that provide service to end users.
- rndgermandude 4y agoYou will probably ban a lot of VPN users as collateral damage. VPN providers often use these small and relatively cheap providers for their endpoints. You may be fine with banning those VPN users, or even want that - lots of bots will try to hide behind "legitimate" VPNs - but one has to be aware of this consequence at least, especially considering that more and more people seem to use them - probably also thanks to the aggressive "sponsoring" certain providers such as ExpressVPN do on e.g. a wide variety youtube videos.
- annoyingnoob 4y agoIt depends on what you are trying to protect I suppose. Banning OVH IPs (and others) cleared up a lot of issues for me. I don't miss them, but sure you might.
- LinuxBender 4y agoOr at least rate limit session cookies. If a person does not have a session cookie, rate limit by IP. If they are authenticated as a unique person have different rate limits and different levels of authentication. HAProxy can do different rate limits by ACL conditions. Or instead of strictly rate limiting, ask them a question that can't be "looked up" in a table and that requires human thought, philosophy, emotion, ethics. Maybe GPT could eventually adapt to this and in that case fall back to IP rate limiting and grow the set of questions.
- superkuh 4y ago> Require TLS. Drop TLSv1.0 and TLSv1.1. Bots certainly break. So will people who run older computers with older software. But I guess people who don't have money don't matter for commercial websites so screw 'em.
- Kalium 4y agoAnything that got a significant update in the past ten to twelve years will support TLS 1.2. The window of systems that would support 1.1 but not 1.2 is pretty small. You have to go all the way back to IE on Windows XP before a lack of 1.2 support becomes an issue. So, yeah. You're absolutely right. In a lot of cases the loss of revenue from users with severely outdated software will be less than the cost decease of cutting spam and abuse. This gets back to an old question - to what degree should legacy systems be supported and at what level of expense? There's no one easy answer that works for everyone.
- Avamander 4y agoI don't think there's much web you can visit with those browsers anyway. Windows XP with IE and no SNI support, maybe sites from that era without JavaScript would work?
- superkuh 4y agoI think you'd be surprised the how recent a browser can be and still lack a client/server cypher overlap once you start whittling down what TLS versions you accept. Just at the start of the pandemic many government sites had to re-enable early TLS because so many people couldn't access their recent TLS only sites. But yeah, corporate employees aren't going to care about those people. Governments have to. And human persons building personal websites should too.
- jmt_ 4y agoI'm not very familiar with all the workings of HTTP/2.0 - why would it break bots? Assuming no CloudFlare type protection, does it somehow stop someone from using curl to get (non-JS generated) content? Does it thwart someone accessing the site from something like playwright/selenium?
- Avamander 4y ago> I'm not very familiar with all the workings of HTTP/2.0 - why would it break bots? There's a lot of outdated garbage bots out there. Not using HTTP/2.0 is also often the default with various HTTP libraries.
- andai 4y ago>Bots break. Wonder if you could respond in a way to get them to crash, or even better, to hang indefinitely.
- JZerf 4y agoIf you're reasonably certain that the request is being made by a malicious bot, you could try responding with a ZIP bomb [1] if HTTP 1.1 or newer is being used and the bot accepts compression. It can cause problems for several browser engines. [1] https://blog.haschek.at/2017/how-to-defend-your-website-with-zip-bombs.html https://blog.haschek.at/2017/how-to-defend-your-website-with...
- deleted 4y ago[deleted]