←back to thread

Cloudflare scrubs Aisuru botnet from top domains list

(krebsonsecurity.com)
97 points jtbayly | 3 comments | 08 Nov 25 16:25 UTC | HN request time: 0s | source
Show context
bradly ◴[08 Nov 25 18:02 UTC] No.45858587[source]▶
> We should have two rankings: one representing trust and real human use, and another derived from raw DNS volume.

Isn't identifying real humans an unsolved problem? I'm not sure efforts to hide the truth that these domain are actually the most requested domains does anyone any favors. Is there something using these rankings as an authoritative list or are they just vanity metrics similar to the Alexa Top Site rankings of yore? If they are authoritative, then Cloudflare defining "trusted" is going to be problematic as I would expect them to hide that logic to avoid gaming.

replies(1): >>45858640 #
iamkonstantin ◴[08 Nov 25 18:08 UTC] No.45858640[source]▶
> Isn't identifying real humans an unsolved problem?

I'm not sure this was ever a problem to begin with. The obsession with "confirm you are human" has created a lot of "bureaucracy" on technical level without actually protecting websites from unauthorised use. Why not actually bite the bullet and allow automations to interact with web resources instead of bothering humans to solve puzzles 10 times per day?

> Cloudflare defining "trusted"

They would love to monetise the opportunity, no doubt

replies(2): >>45858699 #>>45858808 #
nickff ◴[08 Nov 25 18:15 UTC] No.45858699[source]▶
>"Why not actually bite the bullet and allow automations to interact with web resources instead of bothering humans to solve puzzles 10 times per day?"

This is a great idea if you've developed your 'full-stack', but if you're interfacing with others, it often doesn't work well. For example, if you use an external payment processor, and allow bots to constantly test stolen credit card data, you will eventually get booted from the service.

replies(2): >>45858797 #>>45858882 #
1. AnthonyMouse ◴[08 Nov 25 18:41 UTC] No.45858882[source]▶
The average normal user would go months to years between needing to update payment info, so why would that require them to solve puzzles 10 times a day?

That is also notably a completely unnecessary dumpster fire created by the credit card companies. Hey guys, how about an API that will request the credit card company to send a text/email to the cardholder asking them to confirm they want to make a payment to Your Company, and then let your company know in real time whether they said yes? Use that once when they first add the card and you're not going to be a very useful service for card testing.

replies(1): >>45859000 #
2. CamouflagedKiwi ◴[08 Nov 25 18:58 UTC] No.45859000[source]▶
Isn't that basically 3DSecure / Verified by Visa?
replies(1): >>45859174 #
3. AnthonyMouse ◴[08 Nov 25 19:20 UTC] No.45859174[source]▶
It's what those things should have been.

What you need is for all card issuers to be required to implement it by the network. Otherwise you'll still have people showing up to test all the cards that don't support it and the payment processors would still kick you off for that.