HellPot – A portal to endless suffering meant to punish unruly HTTP bots

by mikae1 • 2 years ago

56 17 2 years ago

I feel like this is cool, but is also a harbinger of how the Internet is becoming a bunch of bots trying to trick other bots away from the real content, which is how often being written by bots (at least in part).

blantonl• 2 years ago

It's bots all the way down...

supportengineer• 2 years ago

We should turn all of this shit off, go outside, and breathe some fresh air.

throwway120385• 2 years ago

I often dream of working my great grandfather's job as a finish carpenter.

derefr• 2 years ago

"Becoming"? Dumb overzealous bots (e.g. broken API clients that retry immediately forever; scrapers that want your 5PB dataset right now; etc) that won't go away — so you have to confuse/stall/crash them to keep your service up — have been a thing since the '90s. They're the reason that some NOC admins block entire ranges of APNIC and AFRINIC, and why DNSRBLs exist.

Here's a fun read on dealing with this sort of thing in the context of a Tor Hidden Service: https://www.hackerfactor.com/blog/index.php?/archives/777-St...

alyandon• 2 years ago

I wrote a similar tool years ago to get better acquainted with Go. It was an endless procedurally generated website of linked pages that contained things that looked like email addresses along with username/password combinations.

The logs were fun to watch.

surfingdino• 2 years ago

We need this to punish all those AI scrapers... I approve!

Bluestein• 2 years ago

Lets call it "AI ay ay!" :)

  PS. Unofficial slogan:
  "PAIn where you need it,
  when you need it!"

metadat• 2 years ago

Is there a demo site where we can see this in action?

ChrisMarshallNY• 2 years ago

Sounds fun, but it also sounds like something they could learn, quickly.

gessha• 2 years ago

Two can play the learning game. Set up an adversarial ML-enabled honeypot and the giant waste of electricity begins.

cratermoon• 2 years ago

Years and YEARS ago Ronald F. Guilmette came up with wpoison, a CGI script that generated random web content containing made-up e-mail addresses. It existed to poison spammer's email address databases.

The spirit of that effort lives on in an improved version at https://gitlab.com/gloomytrousers/wpoison

axpvms• 2 years ago

There's also Lenny, the voice chatbot for wasting the time of telemarketers, scammers etc.

https://www.youtube.com/watch?v=HEmHTS2UGlc

OutOfHere2• 2 years ago

I don't know why this is necessary. If a particular IP is hammering your site, it's sufficient to intelligently give HTTP 429 errors to encourage the IP to discipline and temper its requests. It works as well as anything else. If you don't want clients to access data, put it behind a login, not on the open internet.

Doxin2• 2 years ago

There's a LOT of misbehaving bots out there that will just relentlessly keep hammering an endpoint that returns error codes.

OutOfHere2• 2 years ago

Well, that's because the site too is misbehaving there by always erroring. The site should give the correct response based on a bucket algorithm, and this will cause the bot to ease off. Effectively a rate limit is implemented for mutually satisfactory operations.

HellPot – A portal to endless suffering meant to punish unruly HTTP bots

Related Stories