3 ms·
> would proof of work be feasible and/or desirable to deter mass crawling? No. Bad actors generally don’t pay for CPU/GPU as they use compromised hosts or legi
by tatersolid 2y ago
> would proof of work be feasible and/or desirable to deter mass crawling?
No. Bad actors generally don’t pay for CPU/GPU as they use compromised hosts or legit hosts with stolen payment info.
This same “proof of work” solution didn’t fix email spam 20 years ago, for the same reasons. It only adds costs to legitimate activities while being a minor inconvenience to bad actors.
- eurleif 2y agoCompromising a host, or stealing payment info, cost money, or at least time. Presumably they cost less than you get, but it's not free. If you can increase the CPU time it takes to send a spam message by 10x, then the cost to send a spam message will increase by 10x. This should be especially valuable for as long as there's a "not outrunning the bear, just outrunning your friend" effect, but even with full adoption, I would expect to see spam meaningfully reduced. Was this solution actually shown not to work 20 years because spammers are able to pay the cost? My sense is that Hashcash never saw widespread adoption, and we don't really know how it would have worked out.
- jcynix 2y agoAs you wrote, Hashcash never saw widespread adoption, sadly. The big players all came up with their half-assed "alternate solutions" and what I saw was that spammers where the first to adopt DKIM etc. I still use greylisting which keeps a remarkable number of spammers away, because they do not invest the resources to wait for n minutes for a retry. And I refuse email from clients without a proper reverse DNS entry, which more often than not appear to be hacked machines, or certain "organisations" in countries far away ...