5 ms·
Do you guys ever think about abusive automation at all, or do you just consider that other people's problem?
by mike_hearn 4y ago
Do you guys ever think about abusive automation at all, or do you just consider that other people's problem?
- scotty79 4y agoYou call it abuse. Other people might call it use.
- hackernewds 4y agoYou call it use. Other people might call it abuse.
- mike_hearn 4y agoI've not yet encountered anyone who doesn't consider spam to be a form of abuse.
- scotty79 4y ago[flagged]
- dang 4y agoWould you please stop posting in the flamewar style? We've had to ask you this in the past as well. It's not what this site is for, and destroys what it is for. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- scotty79 4y agoI'm sorry. I'll try to bite my tongue more often when I'm in combative mood. Thanks for putting up with me so far.
- aabbcc11 4y agoI am that anyone you mentioned. For example, autoposting on 4chan works very well for me. I spam goods on 4chan to buy or create opinions that I force.
- account42 4y agoSpam can be an effective way around censorship. What is and isn't abuse often isn't as objective as some people want to pretend.
- lupire 4y agoAbusive how? Headed chrome can be automated, as can wget. Its bizarre to ask a client side program to implement server-side controls for users you want to allow on your site but throttle.
- parker_mountain 4y agoHeaded chrome adds a huge amount of overhead, and can also be fingerprinted more easily. This is a lot more declarative and makes it easier to run an abuse farm. Although, per my other comment, I don't see Headless as a tool that will particularly move the needle on abuse cases.
- squeaky-clean 4y agoIsn't headed chrome usually fingerprinted by variables inserted by the chromedriver? You can rename these variables and be undetectable (you don't even have to recompile chromedriver, you can use a hex editor or a perl replacement). At least I've never gotten detected.
- runlevel1 4y agoThere are even Puppeteer plugins that will do it for you. [^1] The best detection I've come across so far (i.e. before this release) has just required I run headless Chrome in headed mode. Granted, I don't do a ton of scraping -- mostly just pulling data out of websites so that I can play with it in aggregate using more civilized tools. [1]: https://github.com/berstend/puppeteer-extra/tree/master/packages/puppeteer-extra-plugin-stealth https://github.com/berstend/puppeteer-extra/tree/master/pack...
- pdntspa 4y agoThe implications of your question are beyond dystopian
- DangitBobby 4y agoPlease elaborate.
- supriyo-biswas 4y agoSee my comment[1] on this very thread. [1] https://news.ycombinator.com/item?id=34858232 https://news.ycombinator.com/item?id=34858232
- pdntspa 4y agoBecause it suggests adding usage controls, possibly enforced via cloud connectivity, to add restrictions that will inevitably make legitimate usage more difficult, frustrating, and most importantly, subject to outside control. Extend this far enough and the world starts to look like Doctorow's "Unauthorized Bread". This is an awful world, one designed to reinforce class divide and protect the entrenched and the rich by deliberately handicapping easily-accessible tools, because of a few bad actors. It creates a world where the code for literally everything is the most hideously complex version of itself because it is riddled with constant checks, phone-homes, and arbitrary usage limits. It further pushes us towards a disempowering future where our computing is limited exclusively to appliance-like devices whos inner workings are controlled for it. It stands against the very principle of general-purpose computing.
- robertlagrant 4y agoThat's not beyond dystopian. It's just dystopian. And implications of a question aren't either. Just your imagined implications. Questions aren't bad.
- parker_mountain 4y agoFor what it's worth, the large "players" already seem to have this capability. They've forced pretty much everyone to roll out captchas, waf-level throttling, proof of work interstitials, and behavior-based fingerprinting. While my immediate response was the same as yours, I think this actually won't really change much in the way of bad actors. It's unfortunate, but basic controls (such as throttling, etc) are pretty much a floor-required feature - one way to avoid this burden is to do things like use 3rd party idp (aka google login). I'm not happy with the state of things but I don't think headless will particularly contribute to a material increase in abuse cases.
- aabbcc11 4y agoIf you are soy developer who thinks cloudflare is god that should solve problems for you and use O(n^2) or even worse algorithms in your code so you can't even optimize it, it is only your problem, correct. In 2000 sites were running where code has been precisely made such way DDoS attack was impossible. Now it is heckin sauce of js malware obfuscated proprietary code. If your site like this, you deserved it. Cloudflare and such companies just need your money for solving 5-minutes problem like AWF that is just a regex, and you have limits even for user agent filtering, lol. Stop making shitcode and learn HTTP and TCP/IP theory, and you will make antispam filter that is 200% better than any cloudflare shit that is simply malware that runs cryptominer as a "IUAM" mode for their own benefit and you even pay for it.