3 ms·
Regarding the problem of how to let "good" bots through: You could use PKI: Drop the PoW if the client provides a TLS client certificate chain that asserts tha
by akoboldfrying 2y ago
Regarding the problem of how to let "good" bots through:
You could use PKI: Drop the PoW if the client provides a TLS client certificate chain that asserts that <publicKey> corresponds to a private key that is controlled by <fullNamesAndAddressesOfThesePeople> (or just by, say, <people WhoControlThisUrl>, for Let's Encrypt-style automatable cert signing). This would be a slight hassle for good bot operators to set up, but not a very big deal. The result is that bad bots couldn't spoof good bots to get in.
(Obviously this strategy generalises to handling human users too -- but in that case, the loss of privacy, as well as admin inconvenience, makes it much less palatable.)
- areyourllySorry 2y agowell, good bots usually publish their ip ranges, and that's way simpler
- akoboldfrying 2y agoYes, that's much simpler, but doesn't it mean that every site owner needs to manage a hardcoded set of "places to look" for these published IPs? If I want to create a good bot tomorrow, where do I publish its IP addresses? IOW, how can I ensure that the world "notices"?