Re:Mēris botnet, climbing to the record
by colejohnson66 on Thursday September 09, 2021 @11:42AM
(#28470924)
But how do you distinguish an abnormal traffic spike (HN hug-of-death) vs a botnet? Cloudflare’s solution is a CAPTCHA, but are there better options?
Re:Mēris botnet, climbing to the record
by jgrahamc on Thursday September 09, 2021 @12:15PM
(#28471336)
Cloudflare's solution is not a CAPTCHA. We have a ton of stuff going on that detects bots. CAPTCHAs are a small part of the tools we use. https://blog.cloudflare.com/cloudflare-bot-management-machin...
Re:Mēris botnet, climbing to the record
by colejohnson66 on Thursday September 09, 2021 @01:42PM
(#28472436)
Sorry. I didn’t mean to imply that you don’t have anything but CAPTCHAs. My wording could’ve been better.
Re:Mēris botnet, climbing to the record
by geitir on Thursday September 09, 2021 @02:48PM
(#28473153)
Do you have a scraper that looks for mentions of Cloudflare or did you just happen upon this?
Re:Mēris botnet, climbing to the record
by jgrahamc on Thursday September 09, 2021 @03:26PM
(#28473612)
Yeah. I use something like this: https://github.com/jgrahamc/hncomments
Although I really need to commit the final version as that one isn't quite what I use.
Re:Mēris botnet, climbing to the record
by mleonhard on Thursday September 09, 2021 @03:44PM
(#28473826)
Cloudflare uses CAPTCHA to drive away proxy users. Privacy conflicts with Cloudflare's endgame of profiling every Internet user and then monetizing that data.
Re:Mēris botnet, climbing to the record
by smasher164 on Thursday September 09, 2021 @12:06PM
(#28471227)
An attack-resistant trust metric? Although I haven’t seen them used against denial of service attacks.
Generally you don't. Just be prepared to scale resources and handle everyone.
Re:Mēris botnet, climbing to the record
by encryptluks2 on Thursday September 09, 2021 @07:16PM
(#28475842)
I think a lot of services would be happy to silently allow bots on their service to help inflate user numbers.
Thankfully these attackers haven't heard about Layer 7 attacks yet.
20 million requests per second coming from a rotating list of hosts from generic IP addresses is a nightmare:
> However, we suppose the number to be higher – probably more than 200 000 devices, due to the rotation and absence of will to show the "full force" attacking at once.
If your site normally has 10,000 users per day and suddenly you’re flooded with 200,000 additional IP addresses hammering at your site, you have a problem.
To put it in perspective, the top post on HN most of yesterday was about someone benchmarking their personal server as being able to handle about 5 million requests per day (Granted, that’s quite slow, but it will suffice for making a point). This botnet can deliver 4X that server’s total daily capacity every second.