5 ms·

In my opinion, PoW is the only reliable way, to avoid DDoS attacks. Scraping too much, too quickly is a light form of DDoS, although not intentional. PoW was in

In my opinion, PoW is the only reliable way, to avoid DDoS attacks. Scraping too much, too quickly is a light form of DDoS, although not intentional. PoW was invented in 2006 exactly for that purpose. The genius of bitcoin (not BTC) is that it provides an organized and practical way, for PoW to be used by everyone on the planet. Some people find it strange, because there is an imaginary token created out of pure nothing which represents the PoW. It would work fine, without that imaginary token i.e. bitcoin, just by dollars of euros, but it wouldn't be internet native. The point is always to just send a minimal PoW with every http or tcp/ip request.

sph 3y ago
Proof-of-work was originally introduced by Adam Back's hashcash, to fight email spam. Bitcoin is an evolution of that idea applied to digital cash. https://en.wikipedia.org//wiki/Hashcash https://en.wikipedia.org//wiki/Hashcash
- emporas 3y ago
  Yes, DDoS attacks are spam over the http protocol. Spam is spam over the imap protocol. Overwhelming a server with too many download requests, is not spam but it has the same effect. Calling the police every ten minutes because the door sounds like someone tries to break in, is spam.
  - account42 3y ago
    > Spam is spam over the imap protocol. IMAP isn't used for sending email. You're thinking of SMTP.
- jcq3 3y ago
  Would it be possible to use bitcoin pow as a replacement for captcha? It both blocks ddos and create an income through mining (client side) for the host.
  - GTP 3y ago
    It wouldn't create any income due to the electricity costs associated with mining, unless the users start buying ASICs. Also the most straightforward way of implementing this would be by having the user spending the token they generated in a transaction to prove their work, which would nullify their income. Maybe there is some workaround by monitoring the blockchain and seeing if a certain user generated some tokens at a certain time, but would it be worth the extra energy required due to the use of bitcoin' PoW? I think no.
  - kmeisthax 3y ago
    No. In fact, using such a well-known proof of work function would defeat the purpose of using PoW. Instead of having something that's cheap for occasional users but expensive for spammers, you'd have something that's cheap for people who own mining ASICs and expensive for occasional users. Hardware specialization breaks the economics behind a CAPTCHA. To fight that you need to use a PoW that hasn't been ASIC'd yet, and be willing to change PoW functions at the drop of a hat. PoW functions that stress memory or cache are also helpful here, though you run the risk of browsers flagging you as a cryptominer (which is technically correct, even if economically wrong).
    - smallnamespace 3y ago
      > cheap for people who own mining ASICs and expensive for occasional users. Seems like it should be the same cost (barring the friction of having a wallet, etc.) for both sets of people since Bitcoin is just a commodity and the value is the same to everyone, miner or not. For example, a miner should value some fraction of a BTC the same way anyone else does, since they can sell or buy it at the same price a normal user can. The fact that they can profitably mine BTC just means they have a profitable business on the side, it doesn’t mean they should prefer to pay for services (or emails) in BTC.
      - kmeisthax 3y ago
        Miners have ASICs - specialized silicon that ONLY mines Bitcoin, but does so many times faster than a CPU or GPU can. The average low-demand user does not have such hardware. Furthermore, because Bitcoin increases difficulty to maintain a fixed transaction rate, ASICs have to be replaced with newer models every few years. So older ASICs are going to be cheaper, but they might still be worth buying if you're a spammer. So in order to moderately inconvenience said spammer, you have to make each and every ordinary user wait hours mining a few satoshis' worth of hashes in order to be let in. This is the exact opposite of what you want.
- davidgerard 3y ago
  no, this is incorrect. Proof of Work was invented by Moni Naor and Cynthia Dwork in 1992 as a proposal to fight email spam. https://www.wisdom.weizmann.ac.il/~naor/PAPERS/pvp.ps https://www.wisdom.weizmann.ac.il/~naor/PAPERS/pvp.ps
  - sowbug 3y ago
    Pretty sure my second-grade teacher invented it. Writing "I will not talk while the teacher is talking" 100 times on the chalkboard is proof of work, and it definitely cut down on unwanted chatter.
RugnirViking 3y ago
I hate to be a pedant but I see it used wrong a lot. "DDOS" stands for Distributed denial of service, specifically indicating the traffic is coming from many sources (wide range of ip), which is what makes it so hard to defend against. Someone scraping too fast would be performing an unintentional DOS, because they probably arent scraping using a botnet (and if they were they probably do in fact intend to attack)
- jakear 3y ago
  And if they’re scraping using “serverless” compute? It’s distributed, but could be used without “meaning” to attack. That seems to be what happened to Archive (they said AWS, could be ECS or Lambda, idk). FWIW this thread inspired me to implement Cloudflare Turnstile on one of my pages - highly recommend. As compared to reCAPTCHA your users are never wasting their life away clicking on traffic signs, and as compared to mCaptcha you don’t have to host the server yourself.
  - geraldwhen 3y ago
    Extremely unlikely that was lambda unless the user liked to light money on fire.
    - jakear 3y ago
      Well they were an "AI Startup"....
- marginalia_nu 3y ago
  In practice they're often using botnets. It's what makes this such a difficult problem to deal with. If they weren't it would be trivial to rate-limit or block problematic IPs or subnets.
  - RugnirViking 3y ago
    as I mentioned in the post: why would a legitimate scraper be using a botnet?
riedel 3y ago
The problem to me seems that it needs to scale with the number of requests. So PoW effectively burns energy. As the problem with captchas, is rather who profits from them and who could track users, it seems that with an OCR system to be protected, it is most reasonable to actually give OCR tasks to humans. IMHO this is far more sustainable and people would understand the value: there is nothing bad in improving ML in general. Maybe someone could even define a sensible PoW task for OCR but I doubt it...

sph 3y ago

Proof-of-work was originally introduced by Adam Back's hashcash, to fight email spam. Bitcoin is an evolution of that idea applied to digital cash. https://en.wikipedia.org//wiki/Hashcash https://en.wikipedia.org//wiki/Hashcash

emporas 3y ago
Yes, DDoS attacks are spam over the http protocol. Spam is spam over the imap protocol. Overwhelming a server with too many download requests, is not spam but it has the same effect. Calling the police every ten minutes because the door sounds like someone tries to break in, is spam.
- account42 3y ago
  > Spam is spam over the imap protocol. IMAP isn't used for sending email. You're thinking of SMTP.
jcq3 3y ago
Would it be possible to use bitcoin pow as a replacement for captcha? It both blocks ddos and create an income through mining (client side) for the host.
- GTP 3y ago
  It wouldn't create any income due to the electricity costs associated with mining, unless the users start buying ASICs. Also the most straightforward way of implementing this would be by having the user spending the token they generated in a transaction to prove their work, which would nullify their income. Maybe there is some workaround by monitoring the blockchain and seeing if a certain user generated some tokens at a certain time, but would it be worth the extra energy required due to the use of bitcoin' PoW? I think no.
- kmeisthax 3y ago
  No. In fact, using such a well-known proof of work function would defeat the purpose of using PoW. Instead of having something that's cheap for occasional users but expensive for spammers, you'd have something that's cheap for people who own mining ASICs and expensive for occasional users. Hardware specialization breaks the economics behind a CAPTCHA. To fight that you need to use a PoW that hasn't been ASIC'd yet, and be willing to change PoW functions at the drop of a hat. PoW functions that stress memory or cache are also helpful here, though you run the risk of browsers flagging you as a cryptominer (which is technically correct, even if economically wrong).
  - smallnamespace 3y ago
    > cheap for people who own mining ASICs and expensive for occasional users. Seems like it should be the same cost (barring the friction of having a wallet, etc.) for both sets of people since Bitcoin is just a commodity and the value is the same to everyone, miner or not. For example, a miner should value some fraction of a BTC the same way anyone else does, since they can sell or buy it at the same price a normal user can. The fact that they can profitably mine BTC just means they have a profitable business on the side, it doesn’t mean they should prefer to pay for services (or emails) in BTC.
    - kmeisthax 3y ago
      Miners have ASICs - specialized silicon that ONLY mines Bitcoin, but does so many times faster than a CPU or GPU can. The average low-demand user does not have such hardware. Furthermore, because Bitcoin increases difficulty to maintain a fixed transaction rate, ASICs have to be replaced with newer models every few years. So older ASICs are going to be cheaper, but they might still be worth buying if you're a spammer. So in order to moderately inconvenience said spammer, you have to make each and every ordinary user wait hours mining a few satoshis' worth of hashes in order to be let in. This is the exact opposite of what you want.
davidgerard 3y ago
no, this is incorrect. Proof of Work was invented by Moni Naor and Cynthia Dwork in 1992 as a proposal to fight email spam. https://www.wisdom.weizmann.ac.il/~naor/PAPERS/pvp.ps https://www.wisdom.weizmann.ac.il/~naor/PAPERS/pvp.ps
- sowbug 3y ago
  Pretty sure my second-grade teacher invented it. Writing "I will not talk while the teacher is talking" 100 times on the chalkboard is proof of work, and it definitely cut down on unwanted chatter.

RugnirViking 3y ago

I hate to be a pedant but I see it used wrong a lot. "DDOS" stands for Distributed denial of service, specifically indicating the traffic is coming from many sources (wide range of ip), which is what makes it so hard to defend against. Someone scraping too fast would be performing an unintentional DOS, because they probably arent scraping using a botnet (and if they were they probably do in fact intend to attack)

jakear 3y ago
And if they’re scraping using “serverless” compute? It’s distributed, but could be used without “meaning” to attack. That seems to be what happened to Archive (they said AWS, could be ECS or Lambda, idk). FWIW this thread inspired me to implement Cloudflare Turnstile on one of my pages - highly recommend. As compared to reCAPTCHA your users are never wasting their life away clicking on traffic signs, and as compared to mCaptcha you don’t have to host the server yourself.
- geraldwhen 3y ago
  Extremely unlikely that was lambda unless the user liked to light money on fire.
  - jakear 3y ago
    Well they were an "AI Startup"....
marginalia_nu 3y ago
In practice they're often using botnets. It's what makes this such a difficult problem to deal with. If they weren't it would be trivial to rate-limit or block problematic IPs or subnets.
- RugnirViking 3y ago
  as I mentioned in the post: why would a legitimate scraper be using a botnet?

riedel 3y ago

The problem to me seems that it needs to scale with the number of requests. So PoW effectively burns energy. As the problem with captchas, is rather who profits from them and who could track users, it seems that with an OCR system to be protected, it is most reasonable to actually give OCR tasks to humans. IMHO this is far more sustainable and people would understand the value: there is nothing bad in improving ML in general. Maybe someone could even define a sensible PoW task for OCR but I doubt it...