Hacker News Reader

Comment by gary_0 | Hacker News Reader

Does HN ever require CAPTCHAs? It seems to do pretty well with its basic but battle-tested moderation/antispam tools, and rate-limiting that seems to repel all but the most concerted DDoS attacks. I don't think HN has any unreasonable restrictions on scraping or third-party clients, either. And it manages to serve 5M unique visitors a month and 10M views a day[0].

[0] https://news.ycombinator.com/item?id=33454140

View on HN

HN is also not really a very attractive target. The only thing you can do is post spam, and that's pretty low-value in terms of actual monetary value to the abuser, and tools to deal with that have been around for decades as you say.

This is very different from many other sites where the potential to make a buck is much more pronounced and direct.

It struggles whenever there's a story more popular than usual though

Only for those logged in, because we bypass caches/cdn. Logout helps both you and HN in these cases.

Hacker News doesn't use a CDN as far as I can see; news.ycombinator.com resolves straight to the single box HN lives on. You're right about caching, though.

IIRC the registration page (only in some cases?) shows a reCAPTCHA.

For me this is about my limit. If I am opening an account that can spam or cost the company real money I can accept that a captcha, while shitty is one of the best available options.

It really gets me when I have a 8 year old account that has made purchases and I still see them across the app.

The annoyingly common one is on login pages. If I am giving you correct credentials you don't need a captcha. If bots are an issue you should be doing per-account strong rate limiting, not a captcha.

On one machine! :)

On one thread even

Pretty sure it's an AST interpreter too (metacircular eval - apply, as in SICP)

They go down somewhat frequently. I think it’s like four 9’s? I’m not sure why they insist on running just a few machines though. They have more than enough money and probably make up the difference by the advertising for YC that they get.

Unless something changed, it's just the one server.

Main and backup. The last outage was because they have a single network provider. Those are rare, and can be dealt with relatively easily by dual connecting your server to two different networks and sharing across both and removing the dns entry for a broken one. But it’s not worthwhile for such a rare outage

The “outages” that are common are slowdowns for logged in users.

I mean, it works well enough the way it is. Does it need to be more reliable? It’s just a simple forum, there isn’t anything critical on the platform. We all like to see lots of 9s, but they don’t matter that much for something like HN.

That’s fair. To clarify my frustration comes from a place of “love”. When a partial or complete outage happens I get severe HN withdrawals.

I cant tell if the audience of HN are more likely to script something untoward against HN, be that DDOS or just "check out my product" spam, because its a bunch of hackers - or less likely to do it because (maybe) we like having nice things, or figure the audience is too in the know to fall for boring crypto spam.

HN audience is rich enough to just pay $10 for 1000 solved CAPTCHAs of any complexity since those services are human powered.

Reply on news.ycombinator.com