News for hackers. Stuff that matters.

A comment on Blocked by Cloudflare. Parent comment

Re:Blocked by Cloudflare by dcow on Tuesday August 08, 2023 @04:57PM (#37055345)
Of course I'd agree that if a robot is following the rules and behaving indistinguishably from a human but maybe just a little more quickly, then it shouldn't be pre-judged (and our detection should accommodate). But here we're talking about robots without agency being e.g. used in botnets to abuse services, or otherwise not following the rules.
[ Parent | on HN ]
Re:Blocked by Cloudflare by ipaddr on Tuesday August 08, 2023 @09:46PM (#37057802)
All clients follow the rules if you enforce them. Break rate limit and get a timeout. Settle your payment before you send the product using bitcoin instead of Visa which is not able to do this.
[ Parent | on HN ]
Re:Blocked by Cloudflare by semiquaver on Tuesday August 08, 2023 @10:29PM (#37058055)
You’re so close to getting it.

  > Break rate limit and get a timeout
And what exactly should the rate limit key be? From your username I’m sure you are aware that it can’t be the IP address.

It sounds like you’re coming at this from an authenticated API perspective where client identity is a given and anonymous access is the exception. The web inverts this, making everything much more difficult and necessitating the sort of fingerprinting that is at issue in this article and I presume you are opposed to.

[ Parent | on HN ]
Re:Blocked by Cloudflare by enigmurl on Tuesday August 08, 2023 @10:26PM (#37058041)
Isn't the point that Cloudfare is essentially enforcing the rules then?
[ Parent | on HN ]