Hacker News Reader

Comment by rnhmjoj | Hacker News Reader

Why is everyone obsessed with knowing whether the user is a bot or an actual person? What differences does it make? A bot it's not inherently malicious, there are thousand of legitimate use cases: a bot may be downloading content as part of a script or some application, checking updates or creating a cache. Traffic generated by bots should not be blocked per se. There are certainly lots of malicious bots scanning for vulnerabilities, DDoSing sites and so on but this applies to people as well.

I think human generated traffic may have priority but blocking bots entirely is nonsense: ultimately the user agent is always a "bot" acting on behalf of an actual person: by blocking this traffic you may always break some user workflow.

View on HN

>There are certainly lots of malicious bots scanning for vulnerabilities, DDoSing sites and so on but this applies to people as well.

Nah, a human isn't going to waste their time refreshing a page manually 50,000 times.

Which seems to be a pretty easy pattern to detect. (And not something you'd want to do over Tor)

But it surely can attemp cross-site scripting, send phishing and spam messages, broken requests and look for exploits. Also TOR is generally so slow I don't think there is even the possibility of generating enough traffic for a DOS.

It would depend on the website's resources and services. For example, a layer 7 DoS which just queries an expensive endpoint on the website over and over may not need high traffic volume to overload the website's systems.

Sounds like something a bot would say.

CAPTCHAs are useful when you want to rate limit something to an extremely low rate, like for example attempting to login with a username and password.

You could slow down the responses or rate limit the requests, with no need to completely block automatic logins.

You would have to limit it per IP address if you do not want to after all clients. So it would not be effective against someone who can use many IP addresses (eg. with Tor)

If you are a valuable enough target, this is not an option.

IPs are cheap, if you let someone try 20 times in an hour before banning an IP, there are targets that people will cycle through IPs that quickly for.

Tor largely prevents most approaches to this. You'd need some way to provide a ticket to a given client, check for it later, and, preferably, ensure anonymity over time.

I've just posted top-level in this thread listing two projects of which I'm aware that provide this, though as experimental protocols only. I've been mildly agitating for further development of such tools. Looks as if CloudFlare are working in a similar direction, which I see as positive.

Reply on news.ycombinator.com