But... the fingerprint is probably not unique, as I don't do anything intrusive to make it so. Which means if I block based on that I'm likely to have false positives.
And in general, I'm pro-VPN, anti-surveillance... the obvious automated technical solution here kinda goes against both of those principles.
That said... interesting conversation at work now about whether sites could log the request identifier (cf-ray header) and later report "That was a bad request" where bad means "spam" or "L7 attack" or "harrassment", whatever. And then the system could look at those requests to determine the correlation at a more granular level, or across a huge number of sites, and if it is determined to actually be bad, could then mitigate on either a single website (LFGSS) or on the network (all CF sites).
When I finish migrating the front-end to Go, I'll give you a really big button to ban spammers. 2 clicks, and it will nuke someone with great vengeance.
Manual intervention, but taking much less time would be great.
https://www.ipvanish.com/
And I know the browser fingerprint, etc.
But... the fingerprint is probably not unique, as I don't do anything intrusive to make it so. Which means if I block based on that I'm likely to have false positives.
And in general, I'm pro-VPN, anti-surveillance... the obvious automated technical solution here kinda goes against both of those principles.
That said... interesting conversation at work now about whether sites could log the request identifier (cf-ray header) and later report "That was a bad request" where bad means "spam" or "L7 attack" or "harrassment", whatever. And then the system could look at those requests to determine the correlation at a more granular level, or across a huge number of sites, and if it is determined to actually be bad, could then mitigate on either a single website (LFGSS) or on the network (all CF sites).