I recently made some contributions to https://github.com/alltheplaces/alltheplaces https://github.com/alltheplaces/alltheplaces which is a set of Scrapy spiders

I recently made some contributions to https://github.com/alltheplaces/alltheplaces https://github.com/alltheplaces/alltheplaces which is a set of Scrapy spiders for extracting locations of primarily franchise business stores, for use with projects such as OpenStreetMap. After these contributions I am now in shock at how hostile a lot of businesses are with allowing people the privilege of accessing their websites to find store locations, store information or to purchase an item. Some examples of what I found you can't do at perhaps 20% of business websites: * Use the website near a country border where people often commute freely across borders on a daily or regular basis (example: Schengen region). * Plan a holiday figuring out when a shop closes for the day in another country. * Order something from an Internet connection in another country to arrive when you return home. * Look up product information whilst on a work trip overseas. * Access the website via a workplace proxy server that is mandated to be used and just so happens to be hosted in a data centre (the likes of AWS and Azure included) which is blocked simply because it's not a residential ISP. A more complex check would be the website checking the time between a request from Javascript code executing on client reaching the server matches the time the server thinks it should have taken (by ICMP PING or similar to the origin IP address). * Use the website simply because the geo IP database the website uses hasn't been updated to reflect block reassignments by the regional registry, and thinks that your French residential IP address is a defunct Latvian business IP address. * Find the business on a price comparison website. * Find the business on a search engine that isn't Google. * Access the website without first allowing obfuscated Javascript to execute (example: [1]). * Use the website if you had certain disabilities. * Access the website with IPv6 or using 464XLAT (shared origin IPv4 address with potentially a large pool of other users). The answer to me appears obvious: Store and product information is for the most part static and can be stored in static HTML and JSON/GeoJSON files that are rewritten on a regular cycle, or at least cached until their next update. JSON files can be advertised freely to the public so if anyone was trying to obtain information off the website, they could do so with a single request for a small file causing as minimal impact as possible. It's not difficult to create a website where 10,000 requests per second can be made to static data like product information or store locations. More advanced features such as stock availability would cause additional load, but again, 10,000 simple queries to a relational database is not a challenging problem. Of course, none of the anti-bot measures implemented by websites actually stop bots they're most seeking to block. There are services specifically designed for scraping websites that have 100,000's of residential IP addresses in their pools around the world (fixed and mobile ISPs), and it's trivial with software such as selenium-stealth to make each request look legitimate from a Javascript perspective as if the request was from a Chrome browser running on Windows 10 with a single 2160p screen, etc. If you force bots down the path of working around anti-bot measures, it's a never ending battle the website will ultimately lose because the website will end up blocking legitimate customers and have extremely poor performance that is worsened by forcing bots to make 10x the number of requests to the website just to look legitimate or pass client tests. [1] https://www.imperva.com/products/web-application-firewall-waf/ https://www.imperva.com/products/web-application-firewall-wa...