←back to thread

Cloudflare scrubs Aisuru botnet from top domains list

(krebsonsecurity.com)
97 points jtbayly | 2 comments | 08 Nov 25 16:25 UTC | HN request time: 0s | source
Show context
bradly ◴[08 Nov 25 18:02 UTC] No.45858587[source]▶
> We should have two rankings: one representing trust and real human use, and another derived from raw DNS volume.

Isn't identifying real humans an unsolved problem? I'm not sure efforts to hide the truth that these domain are actually the most requested domains does anyone any favors. Is there something using these rankings as an authoritative list or are they just vanity metrics similar to the Alexa Top Site rankings of yore? If they are authoritative, then Cloudflare defining "trusted" is going to be problematic as I would expect them to hide that logic to avoid gaming.

replies(1): >>45858640 #
iamkonstantin ◴[08 Nov 25 18:08 UTC] No.45858640[source]▶
> Isn't identifying real humans an unsolved problem?

I'm not sure this was ever a problem to begin with. The obsession with "confirm you are human" has created a lot of "bureaucracy" on technical level without actually protecting websites from unauthorised use. Why not actually bite the bullet and allow automations to interact with web resources instead of bothering humans to solve puzzles 10 times per day?

> Cloudflare defining "trusted"

They would love to monetise the opportunity, no doubt

replies(2): >>45858699 #>>45858808 #
1. bradly ◴[08 Nov 25 18:32 UTC] No.45858808[source]▶
> I'm not sure this was ever a problem to begin with. The obsession with "confirm you are human" has created a lot of "bureaucracy" on technical level without actually protecting websites from unauthorised use. Why not actually bite the bullet and allow automations to interact with web resources instead of bothering humans to solve puzzles 10 times per day?

I mostly just let the bots have my sites, but I also don't have anything popular enough that it costs me money to do so. If I was paying for extra compute or bandwidth to accommodate bots, I may have a stronger stance.

I do feel a burden with my private site that has a request an account form that has no captcha or bot blocking technology. Fake account requests are 100 to 1 real account, but this is my burden as a site owner, not my users' burden. Currently the fake account requests are easy enough to scan and I think I do a good job of picking out the humans, but I can't be sure and I fear this works because I run small software.

replies(1): >>45859114 #
2. jacquesm ◴[08 Nov 25 19:12 UTC] No.45859114[source]▶
I send them on endless redirect loops with very slow responses. Cost me very little bandwidth and it effectively traps one bot process that then isn't available for useful work. Multiply by suitably large 'n' and they might even decide to start to play nice.