Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

A long time ago, I was still in college (UK college, i.e., pre-university), and still learning.

I discovered a classmate was involved in some event, and found the event's website. They didn't have a captcha. By your logic, this was the right choice.

In reality, my dumb ass decided it would be fun to script something that would register millions of users (another classmate ran the script with me). After a few hundred thousand registration, the website was brought to its knees. I was a bit shook, but didn't think much of it.

Next morning I come into class, and was reprimanded by my teacher. Turns out, the owner of said event had threatened to sue the school and me, among other things. What had happened was their servers were down, their email server was brought to its knees, their web servers had died, and generally I had caused a lot of damage without even thinking about it. It caused them to potentially lose some money. None of this was my intention, of course, but I didn't know much better.

Point is, kids will kid, and spammers will spam. There are plenty of bots that just scrape the internet and fill out forms indiscriminately.

Captcha may or may not be the best option here (I'm always of the opinion it's not, especially not reCAPTCHA), but something has to be put in place, even if to stop the majority of bad actors.



you can also just limit the amount of sign ups from one IP each day. There's more simple heuristics to prevent unsophisticated abuse like that


You can, but then you discover that places like Bangladesh and Cambodia, that do a fair bit of freelance work on the 'net use a surprisingly tiny number of IPv4 addresses to do it.

For lots of these countries their total allocation of IPv4 addresses is < 20 per 1000 people and the nature of their access (through glorified internet cafes) mean that you will have some IP addresses that really are totally legit, yet have LOTS of users.

One size fits all is very dangerous on the Internet.


How is the IPv6 roll-out over there?

One the one hand, I assume bad due to cheap equipment. On the other, it's not like v6 addresses are expensive and you need some way of addressing every subscriber anyway. As more people sign up (as the country gets more people with internet access), you need more equipment which could support v6 out of the box, and the excuse for CGNAT I've always heard is old equipment that is harder to upgrade than to put a NAT router in front of. Could go either way from my POV.

If the roll-out is good, then all those people are already taken care of and the minority left on v4 CGNAT aren't bothered by the collective rate limit.

(To preempt the eventual remark that users can generate a billion addresses in v6: rate limiting on v6 works by limiting whatever prefix the ISP gives out to subscribers, like /56, not individual addresses the way it's often done with v4.)

As an aside, it should also be kept in mind that not every use case involves signing entire countries up for their service, even in an ideal case.


To give another example, in spain most mobile carriers will place everyone behind a cgnat with no ipv6.

In fiber some do the same, although thankfuly most place v4 behind a cgnat while offering ipv6.

The whole 1 ip 1 user even if dynamic quite false and is a mess.


That has been my experience on any mobile network, also in 2007 or so when v4 addresses were still available (because my 15-year-old self wanted to seed torrents with my unlimited data bundle ...on GPRS). It's a fair point that one has to consider this part of the market, though I was primarily thinking of wired connections.


It isn't good and purely being on IPv6 is still a terrible web experience in any event. Huge % of major websites don't properly support IPv6 yet. It's ridiculous.


I know, but this is about hosting a service, not about trying to use existing services that got v4 addresses before it was cool


IPv6 doesn’t address disambiguating people using public computers at places like Internet cafes.


Is your site even relevant to Bangladesh and Cambodia?

If you're collecting sign-up data for something local, then most likely not.


Yes.

FWIW, I learnt about this the hard way.


Yes if it is relevant then for all means make it work for them


No way. In the B2B world at least, I expect hundreds of users coming from behind the same corporate proxies.


> you can also just limit the amount of sign ups from one IP each day

This is a classic example of how "just do this" kind of thinking can lead to terrible results.

Do you now see how "just limiting the sign ups from one IP each day" can go very very wrong?


What you could do is, use both. One sign up from each IP per day before you get a CAPTCHA. Then you're not subjecting 99% of your users to training Google's AI for free but the people at a cafe in Bangladesh can still sign up.


This sounds like extra work to solve the problem you said didn't exist.


It's extra work because it's better. You're not subjecting 99% of your users to training Google's AI for free.


> limit the amount of sign ups from one IP each day

one per library per day...


one per coworking space, one per office location for each company




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: