ev1

106 ms·

901.
by ev1 6y ago
Why are you using an unrelated quote to make it look like your site has some form of affiliation or recommendation by Wired? How well does this handle rampant fraud? In the past, whenever we've done any form of educational freebie or
902.
by ev1 6y ago
It's actually localhost and hand-js! It's defined in the two [numbers, numbers, numbers] vars in `function Ca()`
903.
by ev1 6y ago
The entire lead up to the professor saying it is the professor also explaining how certain cultures like in Chinese have pause words. There is absolutely all the correct context. The entire suspension is absurd.
904.
by ev1 6y ago
Do you have any specific list of ISPs, mobile carriers (average hotspot performance, 5G availability, LTE speeds), etc that would work best? I'd imagine this is critical for many WFHers/remote. I'd need a minimum of 2 Gbps s
905.
by ev1 6y ago
Unprotected MongoDB with committed writes turned off
906.
by ev1 6y ago
The skid is not the one doing it. They are buying from semi-professional "proxy sellers" that do it and then sell you some form of authenticated squid proxy that further makes the request.
907.
by ev1 6y ago
"Bot Management" is enterprise only on CF, and Akamai is out of reach.
908.
by ev1 6y ago
It isn't just random residential IPs, but what appears to be BGP hijacking of/onto residential networks on top of that.
909.
by ev1 6y ago
We have a number of required fields that are generated in client-side JS and not present in the underlying HTML. Our best guess based on logs is someone walking through signup with devtools open, and then trying to replicate the requests. A
910.
by ev1 6y ago
I mean that is the price for Stackpath WAF (captcha, rate limiting, etc) :)
911.
by ev1 6y ago
Thanks for responding! Do you know if this is linked anywhere within the captcha itself, or is it + Privacy Pass something that the user has to find and look up for themselves? I don't recall seeing an accessibility link anywhere on an
912.
by ev1 6y ago
We already tag/drop all Tor and VPN traffic. Cookies don't make much sense because this looks like browser automation, not someone just swapping VPNs by hand repeatedly. For IP bans, they are now using illegitimately acquired or f
913.
by ev1 6y ago
This is exactly why I do not want to do captcha. I don't want more third party analytics, tracking, or making our players solve endless captchas. We are a gaming community that also has some older folk that we'd like to be accomod
914.
by ev1 6y ago
This is targetted spambots, so they will run through it once by hand and check the request. Aliexpress uses heavy, extreme amounts of fingerprinting, including port scanning your device and your internal network via <img onerror> tags
915.
by ev1 6y ago
Thanks for the article! In this case, this is custom spam from someone that has spent a few hours looking at the network tab in devtools. The bad actor is running headless browsers after we started doing basic cookie and JS checks; we added
916.
by ev1 6y ago
Yep, unfortunately usage based billing is not possible for us. We can't use any usage based cloud services at all due to abuse and attacks - can't even host a simple avatar or button images on S3 without someone trying to infinite
917.
by ev1 6y ago
Unfortunately, all (ok, the only) the hcaptcha plugins available basically just let you enter a sitekey and nothing else/no other configuration possible.
918.
by ev1 6y ago
Email verification is already required and always has been. He's cycling through handfuls of oddball throwaway/disposable providers, some catchalls. We block all known temporary email providers, but there are a few that are obscur
919.
Ask HN: Captcha Alternatives?
192 points by ev1 6y ago|146 comments
920.
by ev1 6y ago
I'm curious about one thing: I keep hearing weird stories about small police forces and ultra-militarised police forces in the US for example, like tiny towns having surplus tanks and assault rifles. Why/how are the cartels not ju
921.
by ev1 6y ago
Firefox lets you turn off all 3 independently. This breaks some sites that demand device fingerprinting, though.
922.
Tell HN: Check medium's localstorage if you use adblock
360 points by ev1 6y ago|139 comments
923.
by ev1 6y ago
You'll see this in almost every MMORPG (I segment out RPG because it's the most likely to get these - a MMOFPS like Destiny 2 generally just gets by with a few support tickets; people get isolated into clusters or small parties so
924.
by ev1 6y ago
From 2018 case (just google "riot farting" honestly): https://html2-f.scribdassets.com/6454fy6neo6mwj3w/images/5-7... > Why don't game engineers demand better? Start a company with decent work ho
925.
by ev1 6y ago
People are downvoting you, but this is actually a ridiculously common thing in games. The entire game industry is pretty bad in general compared to tech or otherwise: one huge concept is that you have to "love the game"; you'
926.
by ev1 6y ago
there's a really bad naming conflict with an enterprise product that's been out for the better part of a decade.
927.
by ev1 6y ago
nodejs is not a framework details on JS frameworks or libraries used; if you want to do any frontend, throw in keywords like react, vue, angular, redux, typescript, etc. - reading the document I can't tell whether you're fixing jq
928.
by ev1 6y ago
In my experience [pre-covid, city], Whole Foods was just a place to pick up lunch then walk back to your tech office tower or hipster coworking space. I don't see much value in it other than either an Amazon Fresh staging point or pick
929.
by ev1 6y ago
The most blatant thing is to never install their applications, extensions, or any native code. It immediately blows through your VPN.
930.
by ev1 6y ago
Anecdote: I help run a gaming community (think public large Rust, Ark, etc. servers); we routinely have players, anywhere from 14-20+ age, try to "help us out" by donating large amounts with stolen cards, hacked PayPal accounts, a

More ›