3 ms·
This sounds a lot like Abuse as a Service. Trying to defend against malicious bots is tedious at best, impossible at the worst. I don't really see how lowering
by Avamander 3y ago
This sounds a lot like Abuse as a Service.
Trying to defend against malicious bots is tedious at best, impossible at the worst. I don't really see how lowering the bar would be a net positive. People will start using methods that will cause more collateral damage and just reduce user freedoms.
My guess is that this only increases the push towards attestation and attestation-like approaches. Login walls and PAT/Privacy Pass are just the start.
- Spivak 3y agoDamned if you do, damned if you don't. The only way to mitigate the attestation future will be legislation so you might as well do while it lasts. If you can't bypass bot detection now because in response they'll make the bot detection harder then there's really no winning is there?
- Avamander 3y agoEven if you or I might find attestation against user freedoms nobody is going to legislate attestation away. The alternatives to the vast majority are way worse.
- notpushkin 3y agoCould you elaborate on the alternatives bit?
- Avamander 3y agoIf it's too difficult to guarantee end-users' devices are legitimate using other means then the alternative would just be more invasive fingerprinting and login/paywalls. In addition to that any access restrictions would probably end up being less precise and thus cause more collateral damage. Which would also mean an increased amount of false negatives, leading to an increase in spammy content.
- hooverd 3y agoIt's wild that the end goal for a safe from bots internet is basically doing what North Korean did their digital infrastructure.
- realusername 3y agoDevice attestation doesn't solve the bot problem either as seen on Android. It just annoys browsers and OS with a smaller marketshare to the point that I'm wondering if it's even legal with antitrust legislation.
- jeroenhd 3y agoIt will, but only on Android recent, locked-down Android devices. The first step in device attestation will probably allow the Android click farms to continue, but once it's in place, restrictions will just become stricter over time.
- realusername 3y agoThe clickfarms nowadays already use tons of non modified devices built on racks so I really don't see how it's going to make a dent. Devices are way too cheap for an attestation system to work to counter bots
- Avamander 3y agoNot only click farms, these devices are also used for SMS toll fraud and other similar attacks. SafetyNet's attestation only helps to the extent that you can ban a specific model/maker.
- realusername 3y agoYes that's basically it, you can ban a specific device but that's like removing water from the ocean with a bucket. Betting on device attestation really means betting that computing devices will become more and more expensive in the future since the device cost is the only blocker created by the attestation. And if there's one thing I'm expecting, it's that's not going to happen, device prices will continue to decline.
- Etheryte 3y agoIt could, but not in a way any one of us would want it. This specific attested device isn't marked as legit by any of the big players? Into the blocked list you go. This is very similar to what we see today with email providers for example. If you start running a new server, you start with a negative reputation and have to climb out, you don't start from neutral.
- jeroenhd 3y agoServices like these are why massive blocks of IP addresses end up firewalled off, and why Cloudflare/Google CAPTCHAs are absolutely everywhere. Normally, you can just block non-consumer ISPs, but this site offers "residential proxy" services (basically a botnet-as-a-service), which means that now consumer IP ranges need to be selectively blocked as well. I think PAT/Privacy Pass will solve this problem as far as normal users are concerned ("normal" meaning "running Windows, macOS, iOS, or Android, on devices with hardware attestation capabilities"), but soon enough we'll arrive in an age where you can only visit so many web pages before you've exceeded your daily internet allowance.
- deleted 3y ago[deleted]
- CatWChainsaw 3y agoMaybe getting rid of Abuse As A Service is a positive use case for Autonomous Killer War Drones as a Service!
- vetrom 3y agoThe expression is a bit different but this is literally a (minor) piece of worldbuilding in Daniel Suarez's 'Daemon' (2006).
- CatWChainsaw 3y agoI already have so much on my reading list...
- buildfocus 3y agoAttestation creates all sorts of challenges absolutely, but it actually doesn't really help here - there's plenty of services doing this on real devices, and no real challenges to doing so at the prices people will pay. The overhead is the one-off cost of the cheapest legitimate device that will attest, split between the many users to get near 100% utilisation over a large period. Once you look at cheap androids & PCs, this gets very cheap indeed. The only solution is actual paid services, or real-user verification (and deduplication, which means little privacy, which means legal problems in much of the world) for free accounts. If you publish something on the internet for free, you _must_ accept that people can read it automatically. You can make it difficult, make it a bit more expensive, but at the end of the day paid data means paywalls.