2 ms·

> Obvious proxy is obvious. > if ($http_x_forwarded_for) {.... This may block schools and libraries that use content blockers. Often the internal client is le

> Obvious proxy is obvious. > if ($http_x_forwarded_for) {.... This may block schools and libraries that use content blockers. Often the internal client is left to make abuse tracking easier (or because the overworked admin didn't know they could turn it off).

Bender 4mo ago
This may block schools and libraries Oh, well that is ok for me I suppose. I add RTA/adult headers that hopefully they also look for and block using parental controls as adult content should not be viewed in a school or library. I could add a note suggesting to skip that step if one wishes schools and libraries that may be using a proxy to view.
- ferngodfather 4mo ago
  That's fair enough. I think it's a great article to be fair. We need more of this cheap and quick bot blocking. The fact the solution to unwanted traffic is often "use Cloudflare" is _not_ great for the internet, and nobody really actually likes deploying or managing ModSecurity. Its a nice middleground.
  - inigyou 4mo ago
    Cheap and quick bot-blocking is provided by go-away, less cheap and quick by Anubis.
    - aorth 4mo ago
      Sadly, go-away https://git.gammaspectra.live/git/go-away https://git.gammaspectra.live/git/go-away doesn't seem to be maintained anymore.
    - iririririr 3mo ago
      both of these are easily bypassed by bots. security theater at its finest. not to mention wasteful.
      - ferngodfather 3mo ago
        It's not "security theatre", it's blocking the absolute worst, most painfully obvious bots that. These bots also happen to account for a good 85% of bot traffic, so it makes sense to block them. Yes, of course, if a real threat actor is doing things properly they'll be using residential proxies and legitimate user agents, but we're talking here about blocking "some of the bots" - mainly the script kiddies.
- inigyou 4mo ago
  At this point you may as well define who you want to allow instead of defining who you want to block.

Bender 4mo ago

This may block schools and libraries Oh, well that is ok for me I suppose. I add RTA/adult headers that hopefully they also look for and block using parental controls as adult content should not be viewed in a school or library. I could add a note suggesting to skip that step if one wishes schools and libraries that may be using a proxy to view.

ferngodfather 4mo ago
That's fair enough. I think it's a great article to be fair. We need more of this cheap and quick bot blocking. The fact the solution to unwanted traffic is often "use Cloudflare" is _not_ great for the internet, and nobody really actually likes deploying or managing ModSecurity. Its a nice middleground.
- inigyou 4mo ago
  Cheap and quick bot-blocking is provided by go-away, less cheap and quick by Anubis.
  - aorth 4mo ago
    Sadly, go-away https://git.gammaspectra.live/git/go-away https://git.gammaspectra.live/git/go-away doesn't seem to be maintained anymore.
  - iririririr 3mo ago
    both of these are easily bypassed by bots. security theater at its finest. not to mention wasteful.
    - ferngodfather 3mo ago
      It's not "security theatre", it's blocking the absolute worst, most painfully obvious bots that. These bots also happen to account for a good 85% of bot traffic, so it makes sense to block them. Yes, of course, if a real threat actor is doing things properly they'll be using residential proxies and legitimate user agents, but we're talking here about blocking "some of the bots" - mainly the script kiddies.
inigyou 4mo ago
At this point you may as well define who you want to allow instead of defining who you want to block.