You are reading a single comment by @hippy and its replies. Click here to read the full conversation.
  • https://www.ipvanish.com/

    And I know the browser fingerprint, etc.

    But... the fingerprint is probably not unique, as I don't do anything intrusive to make it so. Which means if I block based on that I'm likely to have false positives.

    And in general, I'm pro-VPN, anti-surveillance... the obvious automated technical solution here kinda goes against both of those principles.

    That said... interesting conversation at work now about whether sites could log the request identifier (cf-ray header) and later report "That was a bad request" where bad means "spam" or "L7 attack" or "harrassment", whatever. And then the system could look at those requests to determine the correlation at a more granular level, or across a huge number of sites, and if it is determined to actually be bad, could then mitigate on either a single website (LFGSS) or on the network (all CF sites).

  • I also think I'd prefer manual intervention rather than risk blocking false positives.

    But this does depend on how frisky the culprit is and how much time we are prepared to spend deleting and blocking.

  • When I finish migrating the front-end to Go, I'll give you a really big button to ban spammers. 2 clicks, and it will nuke someone with great vengeance.

    Manual intervention, but taking much less time would be great.

About

Avatar for hippy @hippy started