4 ms·

Enough with playing around the issue. The way out of this mess is not to protect with tech that works but with principles and laws. This is not a tech problem.

Enough with playing around the issue. The way out of this mess is not to protect with tech that works but with principles and laws. This is not a tech problem. This is about what should or should not be legal. Nor it’s a question of having time to implement solution X or Y. If someone attacks you yes, you should have better security but you also need to have legal recourse, or it will never stop. Ddos is already illegal. I am not a lawyer so don’t ask me for exact resources, which vary by country anyway, but stop treating scrapers as an inescapable force of nature.

Certhas 2mo ago
I agree in principle. The tech community naturally has a tendency to reach for tech solutions to societal problems. But without jurisdiction, laws are meaningless. If you create a law that says you have to honour robots.txt files, what do you do if an IP from another country fails to do so?
- rufasterisco 2mo ago
  You check the laws of your country. Likely they say that DDOS are criminal offences, and you can get 10 or 20 years of jail time, already. Then you report a crime and send the logs. And maybe report to some politician that is tough on crime. And you are not alone. I am sure you follow through, Pls check also my other comments. Laws without enforcement are meaningless, without jurisdiction they are less effective. Maybe yes, some poor guy will find a letter that says he needs to pay 50 USD or EUR to some faraway country because the puzzle app in his tv has weird ToS. Or whatever, a cease and desist letter? A “you are part of a hacking circle please uninstall this app” letter, signed by a judge? I don’t advocate for people getting thrown in jail, I just think that the whole “residential proxies” issue might be a charade that would not last longer if citizens and businesses would claim rights instead of play victim. I also really dislike grasping for a tech solution because I don’t want to start to mine crypto to read an article or to depend on some “free” cloud service to host an open bug tracker. It just feels so weird: why is it that no-one is doing it? I feel like I an one “comment away” from someone explaining to me how naive I am, and yet it’s never coming.
rcxdude 2mo ago
The question is, even if you identify who is the source of the traffic, are they even in a place where you can realistically sue them? The problematic traffic generally is not the bots that identify themselves, but the ones that are using residential proxies and try to be a non-fingerprintable as possible.
- rufasterisco 2mo ago
  Then enforcement will target companies providing residential proxy services. In whatever country they are. I am not saying this is the magic bullet that will make it all go away. Some will, some will not. Enforcement’s aim is not to completely eradicate crime: make it anti-economical for the majority and it’s a good deal enough. Go to Berlin and torrent a movie: you will be fined, for a few hundred euros. Can you VPN and get away with it? I suppose so, but your average Joe is just not going to do it: why pay 10 euro per month on a VPN and risk? Just rent it. DDOS is also, in general, a criminal charge. What would happen to prices once you get a few inducements? If it’s a crime and enforced, what are the roles of App Stores that let users download residential proxy? Are they also committing a crime? Residential proxy can be used for legitimate purposes? I don’t think that line of defence worked well for Pirate Bay, no? And yes pirate bay is still around, some scraping will always be there.
  - rcxdude 2mo ago
    The residential proxy operators are also not often within easy reach of western justice systems. Fines for torrenting movies are targeted against end users within the countries (and also not exactly effective, either, because the issue is quite diffuse), but prosecuting criminals in other countries, especially countries which don't really care to stop those criminals so long as they are causing problems for other countries, is not an easy process. The internet is an global system but criminal law generally is not.
    - marginalia_nu 2mo ago
      Yeah, countries are even using this as a bargaining chip, if not a form of hybrid warfare. Neither Russia nor China is losing any sleep over digital attrition in the west.

Certhas 2mo ago

I agree in principle. The tech community naturally has a tendency to reach for tech solutions to societal problems. But without jurisdiction, laws are meaningless. If you create a law that says you have to honour robots.txt files, what do you do if an IP from another country fails to do so?

rufasterisco 2mo ago
You check the laws of your country. Likely they say that DDOS are criminal offences, and you can get 10 or 20 years of jail time, already. Then you report a crime and send the logs. And maybe report to some politician that is tough on crime. And you are not alone. I am sure you follow through, Pls check also my other comments. Laws without enforcement are meaningless, without jurisdiction they are less effective. Maybe yes, some poor guy will find a letter that says he needs to pay 50 USD or EUR to some faraway country because the puzzle app in his tv has weird ToS. Or whatever, a cease and desist letter? A “you are part of a hacking circle please uninstall this app” letter, signed by a judge? I don’t advocate for people getting thrown in jail, I just think that the whole “residential proxies” issue might be a charade that would not last longer if citizens and businesses would claim rights instead of play victim. I also really dislike grasping for a tech solution because I don’t want to start to mine crypto to read an article or to depend on some “free” cloud service to host an open bug tracker. It just feels so weird: why is it that no-one is doing it? I feel like I an one “comment away” from someone explaining to me how naive I am, and yet it’s never coming.

rcxdude 2mo ago

The question is, even if you identify who is the source of the traffic, are they even in a place where you can realistically sue them? The problematic traffic generally is not the bots that identify themselves, but the ones that are using residential proxies and try to be a non-fingerprintable as possible.

rufasterisco 2mo ago
Then enforcement will target companies providing residential proxy services. In whatever country they are. I am not saying this is the magic bullet that will make it all go away. Some will, some will not. Enforcement’s aim is not to completely eradicate crime: make it anti-economical for the majority and it’s a good deal enough. Go to Berlin and torrent a movie: you will be fined, for a few hundred euros. Can you VPN and get away with it? I suppose so, but your average Joe is just not going to do it: why pay 10 euro per month on a VPN and risk? Just rent it. DDOS is also, in general, a criminal charge. What would happen to prices once you get a few inducements? If it’s a crime and enforced, what are the roles of App Stores that let users download residential proxy? Are they also committing a crime? Residential proxy can be used for legitimate purposes? I don’t think that line of defence worked well for Pirate Bay, no? And yes pirate bay is still around, some scraping will always be there.
- rcxdude 2mo ago
  The residential proxy operators are also not often within easy reach of western justice systems. Fines for torrenting movies are targeted against end users within the countries (and also not exactly effective, either, because the issue is quite diffuse), but prosecuting criminals in other countries, especially countries which don't really care to stop those criminals so long as they are causing problems for other countries, is not an easy process. The internet is an global system but criminal law generally is not.
  - marginalia_nu 2mo ago
    Yeah, countries are even using this as a bargaining chip, if not a form of hybrid warfare. Neither Russia nor China is losing any sleep over digital attrition in the west.