i just told this story earlier today on HN! It's something I did just in the past few days, but it is quite satisfying. My site has recently been the target of

i just told this story earlier today on HN! It's something I did just in the past few days, but it is quite satisfying. My site has recently been the target of some extremely aggressive "card testers" (criminals who have huge lists of stolen credit cards; they use bots to stuff small donations into donation forms to test which cards are still working). At first I just blocked the offending IPs, but they kept finding new IPs, creating a lot of annoying work for me. So I pivoted--instead of blocking their IPs, I started feeding them randomly generated false responses with a statistically accurate "success" rate. They are trying to build a list of working cards, and getting absolute garbage results. It is still ongoing, but so far they have run ~50k card tests in over a week, and 99.9% of the data they have collected from us looks legit, but it is totally bogus. It pleases me to know that I am polluting their data, and ultimately wasting a lot of their time and effort. Consume excrement, evil-doers!