4 ms·
Regarding the abuse, have you tried hashcash style challenges to mitigate them? Basically, you serve a random, signed string S; have the client brute force x su
by supriyo-biswas 3y ago
Regarding the abuse, have you tried hashcash style challenges to mitigate them? Basically, you serve a random, signed string S; have the client brute force x such that prefix(hash(S+x),0,2)==“00” and submit that along with the search query.
The problem with this approach is the client can offload the calculation to another machine which is part of a botnet. There are more advanced passive and active fingerprinting methods that you could use, but they require non-trivial infrastructure to collect said fingerprints, not making it worthwhile for a side project like this.
- marginalia_nu 3y agoI've thought of just implementing a bunch of different options. I think the solution to bots is to either have some associated cost (whether monetary or effort), or some obstacle like manual email verification. * hashcash-verification * manual email-based signup * domain-based verification * an ancap dystopia where every query costs an infinitesimal amount of cryptocurrrency * dunno what else there is, probably more creative solutions
- boyter 3y agoI have been meaning to add a hashcash style calculation on searchcode for ages to make the bots a bit less painful. I did add it to another search I run to stop spam and that was very effective.