On Fri, 03 May 2013 12:06:27 +0000, lu...@rankexploits.com wrote: ... > >You mean, when I set up a bit of link farming, you will block Googlebot? :-) > > Oh you silly billy. :-) Everyone knows it's trivially easy to block one > link farmer without blocking google. If I detected you doing rapid or > voracious scraping I would block you.
I wouldn't touch your IP range a single time. I'd just set up a lot of DNS to point there, and have lots of pages point to those domains. Then the googlebot whould try to fetch all the 404 pages, and get blocked. ... > I'm not groking this. Obviously. ... > I don't see how this torslap applied to logins addresses this sort of > misbehavior. It doesn't. It's designed for a different problem set. ... > If you mean the low number of exit nodes means that when I ban one IP I > may ban a large fraction of potential Tor traffic, that's possible. But > very little of that Tor traffic is people coming to my blog. I read a > paper -- now several years old -- that suggested more than half the > traffic was involved in Tor tunnels used to exchange bit Torrent traffic. Problem is, no one really can tell. > >If there a reason you block for several days? I don't see how that > >would help much. As opposed to not directly blocking but instead > >reversing source and destination address in packets coming from > >such IPs. :-) > > Yes. I block for days because blocking for hours is insufficient to solve > the problem. The script-kiddie programs the script to come back and it > likely will as soon as an IP is blocked. Even if the script-kiddie isn't > specifically interested in my blog, they still seems to write these things > to behave like "The Terminator" from the movie. > > I don't know why you think blocking won't "help much". I spoke of the 'for days'. I don't see why blocking the script kiddie again for an hour when he reappears wouldn't equally help. ... > I don't understand what precisely you are proposing by this "not directly > blocking but instead > reversing source and destination address in packets coming from > such IPs. :-)", nor what the smilie is intended to convey in that > statement. Just think what would happen if you did. (I got that idea watching the sustained and stuipd ssh login attacks.) ... > As it happens: when I block an IP at Cloudflare, the packets don't arrive > at my server. I can't reverse packets and send them back. Blocking the > IP that has been sucking my server resources in these pesky "not attacks" > is quick, simple and it prevents bots from crashing my server as a result > of their "not attack" behaviors. Seriously, what kind of 404 page do you have that can't handle requests at line speed? ... > vulnerabilities and so on from wreaking havoc on a server. Because the > smiley may seem friendly, but it really doesn't clarify the otherwise > rather vague suggestion. No; if you can't figure out what's funny about the suggestion, I won't go explain the joke (further). Andreas -- "Totally trivial. Famous last words." From: Linus Torvalds <torvalds@*.org> Date: Fri, 22 Jan 2010 07:29:21 -0800 _______________________________________________ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk