arbol

At the time, reCAPTCHA was the alternative and it was effectively working as a giant ad targeting data collection tool. I'm pretty sure Google have now back tracked from this.

WebGL finger printing is just one of many things you need to do if you actually want to stop automation. There is no way round it other than requiring ID of some sort.

I think we're talking about 2 different things. PoW is annoying for basic scrapers but it really doesn't affect enterprise grade bot operations with access to unlimited residential proxies.

It's either that or you tie tickets to government ID like in France. If the arbitrage opportunity is more than the cost of automation then someone will exploit it.

You literally can't get rid of it without introducing government issued ID to buy any scarce freely accessible items

I'm no CF advocate but those random APIs are literally what differentiates people running Chrome on their computer versus a bot operation with a load of containers. Kubertnetes clusters don't have GPUs. This is why it's used in bot detection (I use brave with no hardware acceleration and I'm captcha everywhere)

Yeah, this doesn't even begin to cut it

- behavioural fingerprinting - ja4 - IP rep - queue mechanism - card country to IP country checks - app attestation - custom metrics based on knowledge of past scalpers

It's hard but it's not impossible. You can make it very inconvenient for scalpers. They need to poll at volume so their behaviour is very much detectable. A hard stance is required on IP rep, especially for more in demand concerts.

LAN parties?!

Or the regulated agents standard that cloudflare is conveniently going to steward alongside Google...

It doesn't. It slows them down. To stop bots you need to employ the full suite of tools, fingerprinting, IP rep, behavioural analysis. Anubis will slow down your basic scrapers that try to crawl the entire web but it is useless against actual bots

Beating fingerprinting and beating traditional captcha is far more expensive than solving pow. Pow doesn't stop anyone, not even the most novice bot operators

Except it doesn't

PoW doesn't stop bots.. It's an annoyance at most. A rate limiter and nothing more

Behavioural requires interaction. Fingerprinting is instantaneous and cloudflare runs on page load for lots of sites

Thanks! We don't penalise privacy browsers or VPN by default. We score JS signals browser side in constantly rotating obfuscated code. This avoids us having to send up the actual data whilst making it difficult to fake the dynamic challenges. Static ones are obviously much easier.

Serious bot activity (e.g. ticket scalping) requires polling with many headless browsers and waiting for tickets to become available. Bot behaviour repeats at scale and so we can get them based on that. A privacy focused user will just be one request in amongst many and pass through.

However, its ultimately the decision of the client how strict we are. A lot of abusive traffic comes from VPN IPs. We don't enable these blocks by default but sometimes you need to, especially if there is a direct monetary gain to be made by faking your country.

Proper bot operators already run long-lived sessions in order to avoid detection. So this inflicts additional financial penalities on basic bots (brute force) but not the more advanced ones, as they're already paying it.

Tin hat folk say Cloudflare is CIA. I dunno

Exploiters might get around them in isolation but they are easily caught at scale due to the opportunity cost being less than the cost of creating unique behaviour over many containers.

They already have. Claude and OpenAI are not trying to write captcha-defying AI agents. These tests wouldn't hold up as well against proper bot operators who mimic user behaviour. However, the signals are still valid as part of a larger toolset.

This doesn't stop the bots - it just makes them hold a private key in their headless browser.

when you block temp mails they just switch to gmail/live/outlook/hotmail

Are you referring to m-pesa?

Very cool signup!

This isn't true anymore.. GitHub are rate limiting people on pro and pro+ pretty hard

GitHub have finally wised up that you could run Copilot on a cron and use almost unlimited tokens. They have since made the product unusable by enforcing extremely strict rate limits, annoying many paid customers.

Twitter should default to xcancel links

The AI companies are using virtually unlimited "clean" residential IPs so this is not a valid strategy.

Nice. A similar win I've found is documentating process flows with mermaid diagrams (.mmd). I would imagine it would work well when combined with your approach.

So is this shared memory as in RAM or a markdown file that they update with their statuses?

This doesn't make any sense. To overwhelm proof of stake you need to have a majority of the crypto. To overwhelm proof of work, you need to have a majority of mining power. AI agents have neither of these.

AI native Blockchains inherently have no value because they're not attached to real world money.

Plus the whole site is AI generated slop