22 ms·

> Captchas. These can obviously be worked around... Best to not consider this a barrier at all. I helped build a lot of systems to bypass these and the "guaran

> Captchas. These can obviously be worked around... Best to not consider this a barrier at all. I helped build a lot of systems to bypass these and the "guarantees" they offer are truly "de minimus". Phone numbers and credit cards are are only slightly better. The real answer is to determine how much value a successful compromise of your service can generate, and combine enough barriers to clearly exceed that value. Some criminals are very business-savvy, but many have poor judgement of value and will overspend on marginal cost-of-acquisition and try to "make up for it in volume", so it's important to be obviously not worth the expense. Unfortunately for PyPI, there's a wide gamut of value gained from compromise from a wide variety of different actors. And for some of those actors, the potential value gained is existential, so they are willing to spend anything to compromise PyPI, and they have incredible resources. So then PyPI has to make itself more expensive than compromising Windows/SS7/Linux/iOS/Office365/AT&T/etc/etc. And that's a very difficult field to find yourself competing in. Shameless plug: http://resolved.dominuslabs.com http://resolved.dominuslabs.com feel free to reach out for custom work - specializing in accessing gated sites for new search engines to do better web crawling, scraping public data, etc.

throwaway892238 3y ago
None of the barriers are fool-proof, but they are layers of defense. When adding defensive layers, you need a cost comparison of how much time and money it costs you, versus how much time and money it costs the attacker. If it costs you $0 recurring and 5 developer days, and it costs the attacker 1 human solving 1 captcha per 1 form submission, then it's probably worth doing it, if only to stop randomly-scanning botnets and reduce the signal-to-noise on your detection capabilities. (I know AI is getting better at automated solving, dunno if they're all broken yet)
- reaperman 3y ago
  > you need a cost comparison of how much time and money it costs you, versus how much time and money it costs the attacker. Not quite! It's actually "how much money your countermeasures costs the attacker to beat, versus how much money it gains the attacker to beat your countermeasures". The attacker doesn't care if you spent $1 or $1 billion on it, they only care what it costs them vs. gains them. If it gains a lot, there are usually ways to fund the effort, no matter how large. There's usually an enormous mismatch between your budget and the attackers' budgets (in either direction), as well as a massive adjustment for purchasing-power-parity. This isn't a "near-peer" fight where you're trying to "outspend" the attackers using efficient techniques to exhaust their budget before your budget is exhausted. This is a situation where there are nomadic bandits, regional pirates, FAANGs, and entire governments where you want to just make it so they look at your system and go "nah skip that. we'll do this another way entirely by getting access to a different company's system instead".

throwaway892238 3y ago

None of the barriers are fool-proof, but they are layers of defense. When adding defensive layers, you need a cost comparison of how much time and money it costs you, versus how much time and money it costs the attacker. If it costs you $0 recurring and 5 developer days, and it costs the attacker 1 human solving 1 captcha per 1 form submission, then it's probably worth doing it, if only to stop randomly-scanning botnets and reduce the signal-to-noise on your detection capabilities. (I know AI is getting better at automated solving, dunno if they're all broken yet)

reaperman 3y ago
> you need a cost comparison of how much time and money it costs you, versus how much time and money it costs the attacker. Not quite! It's actually "how much money your countermeasures costs the attacker to beat, versus how much money it gains the attacker to beat your countermeasures". The attacker doesn't care if you spent $1 or $1 billion on it, they only care what it costs them vs. gains them. If it gains a lot, there are usually ways to fund the effort, no matter how large. There's usually an enormous mismatch between your budget and the attackers' budgets (in either direction), as well as a massive adjustment for purchasing-power-parity. This isn't a "near-peer" fight where you're trying to "outspend" the attackers using efficient techniques to exhaust their budget before your budget is exhausted. This is a situation where there are nomadic bandits, regional pirates, FAANGs, and entire governments where you want to just make it so they look at your system and go "nah skip that. we'll do this another way entirely by getting access to a different company's system instead".