Are there any solutions to DDoS attacks or spamming that don't involve mass surveillance?

Recently I went back on 4chans /g/ for the first time in a while, out of boredom, and was immediately harassed by a cuckflare captcha. After finally getting into the site it seemed like the whole board was covered in garbage with only a few real discussions of any value. I type out a well thought out response to some sperg spewing blatant lies, head over to the captcha, and am told I need to wait 15 minutes to post a reply. By the time I am finally able to submit the captcha I receive some error message telling me that I seem to be a bot and to please try again later, although I'm paraphrasing. Refresh the page try to submit again and am told I need to wait another 15 minutes. The site is pretty much unusable in its current state. It doesn't seem to be just 4chan though, it looks as though every mainstream site or app these days requires phone number + email verification + some captcha + 2FA to simply log in to your stupid facebook or tiktok account, additionally often times vpn ips are blacklisted. I won't even get into how crypto exchanges are pretty much Orwellian at this point entirely contradicting everything the technology stands for. With all that to say I was wondering if there was, or is, any way to verify that traffic is coming from an individual human without privacy invasive heuristics or a decline in usability?

>>81733 Are you looking for practical solutions, or are you just trying to brainstorm some ideas? I believe the TOR requires some proof of work as defense against DDoS. https://blog.torproject.org/introducing-proof-of-work-defense-for-onion-services/

Technically, traditionally, and theoretically, to protect from DDoS you need to: 1. Block/Drop as much as possible of the attack, 2. Absorb the rest of attack. And to not be a slave to mass-surveillance, you have to control the encryption (e.g. TLS private keys); i.e. no man-in-the-middle actors that you don't own / control. So, you can deploy a network of front-line nodes, reverse-proxying your main application servers. Set up load-balancing between them, possibly through IP Anycast / IPVS, and thus benefit from their collective bandwidth to absorb the attack. Setting up traffic analysis software on those nodes would help you drop traffic that would overload your servers. The cost and technical expertise needed for that is beyond most normal web users; you almost need to own your own big data-center to do it, which gave rise to DDoS-protection services, i.e. data-centers renting capacity, and amortizing it over many users, most of which won't get massive attacks, but some will. If each user had to be ready at capacity all the time, it would cost massively more than if the capacity is dynamically allocated to the users that happen to be currently under attack right now. Slightly similar to how insurance companies work. You cannot do traffic analysis, to drop traffic, without taking off the encryption layer first, hence why Cloudflare et. al. MitM websites. If you don't do traffic analysis you can only direct all the traffic to the customer site, overloading them, which defeats the point of having a DDoS-protection service. So, either the customer controls the analysis software, and the front-line servers, or you have no privacy. Other technologies like proof of work JavaScript or CAPTCHAs are bot-detection methods; they can help reduce automated bot traffic, but they don't protect from network DDoS attacks. An attacker can download your CAPTCHA JS code from a network of 100,000 computers many times a second, and fill your entire pipeline with traffic, taking you down for legit users. Only having more bandwidth than the attack can help you with that, some control over the backbone network hardware might be even needed in some cases (a data center may black-hole traffic coming from some other network to protect itself and its customers). I wonder if Cloudflare themselves are the closest to having a privacy friendly solution. Perhaps, Cloudflare can provide the compute and the networking, but allow users to run open-source traffic analysis software in sealed containers, where the user can put their keys along with the software that uses it. Cloudflare web-assembly workers seem very close to that. Of course you would have to trust Cloudflare to not look into the memory of your container, but it is the same level of trust you give to any hosting provider you use to rent servers or VPSes. And them saying "we will not look into your traffic" is perhaps slightly better than them saying "we look into your traffic for your safety". At least you can sue them for the former if a whistle blower leaked that they broke their contract, their shares would go down, or something. There could be solutions where everyone just switches to new networking protocols, and perhaps they would render DDoS issues irrelevant. If every phone and computer was participating in IPFS, or Tor, and yet everyone's traffic was being routed within those networks, and content was being cached and served from all the clients, or something of that nature, then perhaps we can overcome the problem of DDoS. The reason DDoS works so much in current internet is mostly related to how centralized the network is. As for human-like bot traffic, flooding communication forums, this will only get worse and worse with the AIs. CAPTCHAs are likely going to become useless. Proof of work will only slow the problem down. AIs only keep becoming more human-like, and attack software is becoming more natural (running actual browser instances, etc.) The dead internet theory may become a reality. One path is to have more and more validation, solutions seem to tie internet accounts to humans biologically. An AI doesn't have human finger prints, retinas, DNA, etc. (yet). Some companies are doing that by requiring video of the face of the user from all directions for example. That will soon be possible to fake with generative AI too. Other solutions may include some trust chains, like relying on governments to provide signed IDs that ensure that the person is a real human with parents, and a living place, etc. The country I'm visiting has lot of services that require logging in with a digital government ID. Sadly, all such paths seem to always end up anti-freedom, authoritarian, more surveillance, more government and corporate eyes on everyone. The alternative may be to let go of the global network, in some way or another. Obscure smaller communities, built on private networks, where people validate people through direct relationships, and actually knowing each other. With other strong limits like proof-of-work and private keys, some pockets of living internet might persist. I don't think proof-of-work would be enough if the network is open. Proof of work, if implemented perfectly, only means you raised the price of spam. But as computing becomes cheaper and cheaper you're only fighting a losing battle. Besides, something is bound to be important enough for someone to pay the cost. Maybe another massive country would find it okay to dedicate whole data centers to attacking you during election time or something. I did cybersecurity work for companies that barely amount to anything, and they still got attacked by hundreds of thousands of hacked home computers. Without Cloudflare, even if they had proof-of-work CAPTCHAs, they would still be flooded. I don't see decentralization solving this either. Perhaps it would even make it worse. My answer, which I deem closest to enlightenment, or giving up, is to stop using the public internet as much as possible; no social media, no search engines, no AI agents. Use paper for everything I can (the advantages of which can be a whole other posting), read books, talk to real people in the flesh. Have websites and services only exposed to isolated Wireguard VPN networks, and have family and friends join said networks to use the services. This doesn't protect us, but makes us too small and obscure for anyone to attack us, and no uninvited persons or bots can reach the network to spam.

>>81737 A mix of both, I have been interested in such technology for quite a while now and plan on launching a service for my userbase in the coming months. Sadly the practical solution, which I have used for all my clients in the past, has been quite simply, to use cloudflare; but for this upcoming site I would like to experiment with alternatives. >>81739 This is very interesting but would be to steep a barrier of entry for 99% of users. This is not to say that I do not appreciate the suggestion, thanks for the interesting read. I am more so looking for something that the average normal person can type into their url bar and visit without any additional software. >>81747 You have raised a lot of interesting points, thank you for the massive effort post friend, it was quite the read. I have been using cloudflare for a number of years but I have heard many of these conglomerates break their licensing agreements and whatnot behind closed doors, just look at github copilot spewing out non distributable code which explicitly breaks the tos. I think I will try experimenting with writing my own proof of work js script. I know this is not perfect, and with enough computing power can be easily overcome, but in the webs current state there is no real solution. >CAPTCHAs are likely going to become useless In many cases they already have, in my opinion. I am not exactly sure how the technology works but on chromium I receive far less captchas compared to a hardened firefox. I read somewhere that chromium has some built in captcha solver though I don't know much about the underlying tech. I have seen many projects pop up utilizing headless chrome or chrome driver to auto solve captchas and simulate real world traffic. Perhaps dropping all traffic to and from chrome users would solve this problem :p >If every phone and computer was participating in IPFS, or Tor... and content was being cached and served from all the clients... then perhaps we can overcome the problem of DDoS. Please correct me if I'm wrong but I was always under the impression that the tor network is vulnerable to DDoS attacks. There are only a select few users who actually run nodes in the network, myself included. Of that subset, exit nodes are run by a smaller portion still. As for IPFS I remember hearing a lot of hype around it a couple years ago, it would solve denial of service attacks entirely but I don't think it will ever really take off. Companies have entrenched their entire bottom line in 'Web 2.0' and will fight tooth and nail before giving up their monopolies, I will eat my words if some form of IPFS is bundled with chrome in the coming decades. I was also under the impression that IPFS worked in a similar manner to torrents and was more so, as the name implies, a fs rather than a decentralized web protocol. How would one go about publishing say a blog and updating their site with each new post? Is there some manner of keeping ownership of a piece in IPFS but still having it distributed in a decentralized manner? >My answer, which I deem closest to enlightenment, or giving up, is to stop using the public internet as much as possible; no social media, no search engines, no AI agents. Use paper for everything I can (the advantages of which can be a whole other posting), read books, talk to real people in the flesh. Have websites and services only exposed to isolated Wireguard VPN networks, and have family and friends join said networks to use the services. This doesn't protect us, but makes us too small and obscure for anyone to attack us, and no uninvited persons or bots can reach the network to spam. You lost me at wireguard networks but I agree with everything else you've said, it would be very difficult to put my friends on a closed network vpn. Although they get much hate LLMs can be used as a locally hosted alternative for the internet, say you need a recipe or have a quick question. It has been said that they hallucinate and sometimes outright lie but so do most users on any given website you simply need to practice a healthy amount of skepticism. In an ideal world I would like to cut out as much of the modern web as possible but doing so would cost me my job. The internet is ever changing, sites that I would bookmark to comeback and read at some point disappear, results you have found on this or that search engine will suddenly no longer exist, and with the recent internet archive hack I've come to realize that the entire flow of information can be changed at a moments notice without any evidence. I used to be obsessed with cloud hosting services like google docs when I was much younger but now understand that the world itself is changing and real value can be derived by owning your files, whether physically or digitally. But most importantly, there is no greater satisfaction than the ability to tangibly hold something that you have worked on in your hand. >>81748 I am not sure how much I'm allowed to say on this chan, as I went to respond it seemed as though your comment was deleted by some janny, so I'll refrain a bit. The recent election has really escalated the political climate, many of my apolitical family members and friends are being thrust to this or that side of the spectrum. but you can tell that peoples political sentiments are changing rapidly. I have been connecting groups of average guys and training regularly but do not have a 'naughty or nice list' as I simply don't have the time in my day to draft one, please share yours fren.

>>81766 >and training regularly but do not have a 'naughty or nice list' as I simply don't have the time in my day to draft one, please share yours fren. It seems clear as day to me that social containment algorithms are being run on the populaces social graph, and their max-cutting individuals into two sides, thus roping in apolitical individuals to red team and blue team. I think the real victory is attaining the worlds largest logical clock and the segregation of individuals based on ideas is a huge hampering of this endevour. Throughout ages they talk of the union of upper and lower egypt, the merging of the three kingdoms, the reuniting of the lost tribes. I think signed social graphs wont help this

>>81747 >My answer, which I deem closest to enlightenment, or giving up, is to stop using the public internet as much as possible; no social media, no search engines, no AI agents. Use paper for everything I can (the advantages of which can be a whole other posting), read books, talk to real people in the flesh. Have websites and services only exposed to isolated Wireguard VPN networks, and have family and friends join said networks to use the services. This doesn't protect us, but makes us too small and obscure for anyone to attack us, and no uninvited persons or bots can reach the network to spam. I feel like people that use AI to imitate humans are really only trying to fool the lowest common denominator wrt to information literacy - targeting soykaf like Facebook, Twitter, Reddit just to astroturf with tiny responses that don't cost too much to generate. I don't see the use of AI beyond astroturfing though - like the lowest level of political discourse like "Im a data point and I believe x!". Like, who would pay for an AI to just be friendly to people?

>>81766 & IPFS I didn't mean Tor or IPFS as they are now, but something like a hybrid of both, perhaps built on top of them, or from scratch, most likely not compatible with current web (i.e. no exit nodes). All clients Tor-like nodes relaying and load-balancing encrypted traffic to a distributed replicated file-system as in IPFS. Key point is to retain the distributed nature of IPFS, while allowing anonymity of the replication storage nodes. IPFS alone is not enough to protect against DDoS if the serving nodes are unconditionally known and exposed to everyone; you can always DDoS all serving nodes. Such a hybrid network will of course raise its own challenges, but perhaps non as final and terminal in the extreme as DDoS and bot spam for current internet. Currently, I know the I2P network encourages torrenting on top of their anonymous peer-to-peer network (you can only connect to torrent peers running I2P, not to clearnet). It could be as close as we got to that ideal, at least for relatively static content. Hyphanet (formerly Freenet) might be close to that too. > I was also under the impression that IPFS > worked in a similar manner to torrents and > was more so, as the name implies, a fs > rather than a decentralized web protocol. > How would one go about publishing say a > blog and updating their site with each new > post? I'm not experienced in IPFS, but I know they have a protocol for dynamic naming, called IPNS[1], allowing you to change the content, keeping the same name; you broadcast the changes in naming using records signed with a secret private key you own. [1]: https://specs.ipfs.tech/ipns/ipns-record/#introduction > You lost me at wireguard networks but I > agree with everything else you've said, it > would be very difficult to put my friends > on a closed network vpn. I found it to be surprisingly easy with Wireguard. Tell your friends: 1. Here's the link to the service: https://10.99.0.1/cool-service 2. You can't access it until you install the encryption software from: https://www.wireguard.com/install/ 3. Click add a new tunnel, and choose this config file: amazing-friends-network.conf With screenshots as needed. I managed to get a dozen people or two, some not very technical, onto various networks (I host half a dozen networks or so myself). If you want a DNS name, other than e.g. 10.99.0.1 then either use a DNS name, and risk being easier to target by attackers, or, hijack your friends' DNS (not nice) using the option in Wireguard configs, and provide your own DNS server that serves your names (even with custom TLDs e.g. https://cool.friends/nice-service). Of course, when I say Wireguard VPN, I don't mean tunnel all your friends' traffic through it. Set the configs to only route traffic to 10.99.0.0/24 through the VPN. The rest of their traffic goes over their normal networks. But of course, this has a high barrier of entry, and a good amount of work (and fun) for the host, i.e. you ;) > Although they get much hate LLMs can be > used as a locally hosted alternative for > the internet Only if you have the horse power to run them. Something like ChatGPT knows everything about everything on the internet, but a LLAMA 7b hosted on your local machine doesn't know much. It knows how to form acceptable writing, but doesn't encode much knowledge about the world. Perhaps, combined with a local copy of Wikipedia, and a vector embedding database of Wikipedia's content, would allow you to have most of that knowledge in under 120GiB of storage. But then, just download Wikipedia locally, do full-text search, and skip the LLM. Or go to the local library. A lot of the usefulness of the internet comes from it being a dynamic medium, new things happen, and the internet relays them all over the world very quickly. That can't be replaced by a local LLM, or a local copy of Wikipedia. > sites that I would bookmark to comeback > and read at some point disappear, results > you have found on this or that search > engine will suddenly no longer exist, and > with the recent internet archive hack I've > come to realize that the entire flow of > information can be changed at a moments > notice without any evidence. I'm so angry at myself for giving the Internet Archive an exemption from my typical mistrust of depending on 3rd parties. I've been archiving pages I care about on IA for a decade now, and now all of that is endangered, because someone there thought they can discard copyright at whim. I'm half hoping that the hack was a cover that doesn't make sense because they wanted to have an alibi to allow someone later to anonymously redistribute the archive over torrents or something, after the IA goes bankrupt due to lawsuits, without anyone at IA taking the blame (oh no they hacked us and stole the archive! we didn't give it away no way~). But one can dream. From now on, I think I will only wget sites I care about myself, locally. But I haven't gotten around to setting up a good system / script for that yet.

>>81775 The issue is that this is enough to fool the search engines and the social media algorithms, and then over time SEO spam and propaganda will flood everything that is good. You would know it to be AI when you read it, but you would have to read hundreds of AI pieces before you find something human. Besides, the AIs are getting really good. With some of them connected to databases providing them with more knowledge than just what is embedded within them. We're way beyond lowest common denominator, we're even arguably beyond the average; current AI tech can easily fool an average unsuspecting human on most topics.

Some more practical ideas I think about to protect from DDoS and bot spam right now, on current clearnet: Keep everything simple, static data mostly, easy to replicate, cache it on as many nodes as you can afford around the world. People overuse databases and dynamic generation, making it cheaper to take them down, and making it more complicated to have replication and redundancy. I've had clients whose powerful dedicated servers went down under the load of a 100 legit users, let alone when they got attacked by a botnet of 200,000 devices. Don't make powerful enemies, as much as reasonably possible. Sometimes it is not within your control, but one can do their best. If you piss off a script kiddie on IRC he might spam or flood you with $50 worth of attack, if you are successful in a business, you might be attacked by hackers paid by your competitors, a few $1000s, and if you criticize a government you might be attacked by their cyber-warfare people with hundreds of millions of dollars of manpower and equipment. The bigger the enemies you make, the bigger the resources you need to stay up. You can't be 100% safe, whether on the internet, or in meat-space. There are trade-offs for safety. You wear a bullet-proof vest, you hide in a bunker, but you lose out on parts of life. You can invest time and infrastructure in your sites, but you pay for that with dev time, worse user experience, money, resources you could have used on other things, etc. A formula to balance; for example, I had a client who lost $30,000 of revenue every day their site was down, so for them, investing a $1000 per month to get the server side resources to stay up, instead of the $40 thing they were hosting on, is well worth the cost, even if they're go into denial at first. (They got kicked off of three popular hosting providers because attacks against them were too big for the providers themselves). If what you're publishing is of interest to a community, more than just a proprietary interest to you, then encourage the community to mirror and share the content; to distribute it collectively. Attackers might be able to DDoS your site, but not be able to stop thousands of people sending a PDF to each other over varied mediums. Some communities, like Free Software people, or even Lain here, might mirror the content for you on their web servers, if they deem it important enough. One person or one organization can be censored, but it is much harder to censor 100% of everyone who cares about something. And just like being attacked IRL, a lot of what you can do can only be done while under attack. You can prepare and train beforehand, but only when you actually get attacked, you see where you can do something. Depending on how determined your attackers might be, you can kick their butt by putting a CAPTCHA on your search bar if you search more than 3 times per minute. Or, you may have to black-hole all traffic SYN flooding you from Romania for a few hours, or you might have to have a call with the data-center, or more like they will call you, because their whole backbone is taken down by the attack. What doesn't kill you makes you stronger, so learn and adapt. In the end, the current internet is set up in a way that makes DoS fundamentally a power struggle. Who has more power can take the other down, no matter what. Knowledge is only an amplifier in attack or defense. Compute, bandwidth, and more importantly, manpower, are true power on the Wired. As an individual, you have the power to protect yourself with a $50 per month from a script kiddie trying to ransom your site with his tiny botnet, but you cannot do soykaf against a government actor. And most of your power is going to be rented power anyway, provided to you by some not so benevolent powerful force, because you paid them their fees, and didn't do anything they'd want you gone for. One thing I wish existed (if it does, I don't know of it), is FOSS software that acts as command and control for a swarm of reverse proxy instances. You install it somewhere, you add a dozen servers from different data centers, different regions and jurisdictions, and then it allows you to write rules for those swarms, to drop traffic that looks like this or that, etc. Basically something like a FOSS Cloudflare where you bring your own compute, storage, and bandwidth nodes, then wire in the backend servers. I know you can do almost everything on NGINX or Apache, writing custom filters and scripts from scratch (e.g. NGINX Lua modules), then distributing the rules yourself, then gathering metrics yourself, but again, advanced sysadmin, and a lot of time, required. Some contraption of Kubernetes and a two dozen Helm Charts might work too, but I wish for something that a mildly techy person can use, and can help with a personal site, or maybe a small business. Anyway, fundamentally curing DDoS on current internet architecture is like trying to cure death in human bio-architecture. You can't. You have to radically redefine the architecture for that (a massive rock can "live" way more than a human). Or, you keep the architecture, and hope, that one day maybe, with enough investment, and by solving a billion tiny obstacles, you might reach a complete solution to the massively complex problem. But right now, all you can do, is follow basic health advice. If we want to get more cynical and paranoid, all providers of software and hardware, rented or bought, can be spying on your TLS traffic right now, because, fundamentally, our world of computing is built on trust, and the entities at the bottom of it lost our trust. We worry about Cloudflare, but what about AWS? What about OVH or Hetzner or Vulture? What about Intel or AMD or HP or Dell? What guarantee do we have that they don't break our trust? None. So we try, and we learn, we fight for a better world, but perhaps it is all too big, it will take time, be patient, it may not even be solved in our lifetime, or perhaps, the true answer all along, for this test, was to stop, to walk back, away from the screen, away from the mind-trap, disconnect from the machines, reconnect home. Keep your wits about you Lain, true tests, never end.

Cloudflare was never about solving DDoS. It's surveillance capitalism. Quoting nullius' excellent comment (in a Tor Browser proposal to block Cloudflare which was shut down https://web.archive.org/web/20200301013104/https://trac.torproject.org/projects/tor/ticket/24351#comment:8 >Cloudflare is a MITM, by design. That is the primary (only?) service they offer. It does not matter what the site’s service level with them is. >Cloudflare always, always has the symmetric key to the session; and within the ostensibly encrypted session, Cloudflare is by definition a Man-In-The-Middle which decrypts, modifies, and proxies the plaintext. >Why, it is exactly as if Cloudflare were designed as a mass surveillance tool! So, what rationalizations could be supposed for those who use their services, or ignore them as a global threat? >“But Cloudflare is a trustworthy provider of Internet infrastructure.” Then, why do we need TLS at all? >By design, TLS promises end-to-end encryption. Meaning, with the endpoint. By design, Cloudflare makes a mockery of this promise. >As of today, Cloudflare has access to the plaintext data of more TLS sessions to more endpoints than anybody else on Earth. It's obvious how valuable their man-in-the-middle position is. A surveillance wet dream. 10% of the world's traffic, zero encryption. They see everything, alter content, inject JavaScript into browsers. >"Approximately 25 million Internet properties rely on Cloudflare's network to reach their audiences." All Cloudflared websites should have a red padlock. TLS intercept on this scale should be illegal. But nobody cares. "My surveillance doesn't affect me at the moment, let's pretend it doesn't exist." 4chan for example, it's not a far stretch to assume that through client fingerprinting and observing all traffic, they can file all your posts and all your browsing history under your real name and address in the NSA dragnet database. How long you looked at each thread, your scrolling progress on the page (lazy image loading), what images and webms you opened. Even if 4chan itself never shared any user data. >is there any way to verify that traffic is coming from a human No. Not as long as the digital-analog barrier exists. When our brains become like Ghost in the Shell and they find a way to put minds in corpo owned boxes, then yes. Until then they'll continue the arms race of locking out users from their "own" devices. >is there any way to fix spamming and DDoS without surveillance Of course, dozens of ways. Null route a provider or country until they make their underlings behave. Did you know some of them allow outgoing forged source IPs to this day? Design protocols where spamming is expensive and reflection, amplification isn't a thing. Our reliance on the fossilized spaghetti internet infra would make any solution an inconvenience and an herculean effort. As if that wasn't bad enough, big tech and friends actively sabotage any effort that would take data and power from them, and continue ratcheting up surveillance. >every mainstream site or app these days requires phone number + email verification + some captcha + 2FA to simply log in Corporations live on user data and this de facto government ID'd online account system that emerged is heaven for them. Users, retards that they are, couldn't care less, enabling this dystopia. >>81747 >I wonder if Cloudflare themselves are the closest to having a privacy friendly solution They have some top tier engineers and could figure something out, but hell will freeze over before that happens. Centralized MITM is their raison d'être. >My answer, which I deem closest to enlightenment, or giving up, is to stop using the public internet as much as possible Realistically speaking, pretty much this. >>81766 >>Have websites and services only exposed to isolated Wireguard VPN networks, and have family and friends join >it would be very difficult to put my friends on a closed network vpn. From devices that leak everything to corpo clouds Present Day, Present Time! AHAHAHAHAHA! Here's the solution: Simply don't be useds of any of the abysmal spyware software and hardware products. This is too much to ask of the average person which is why we're here. Are you the 0.001% of people who hosts something and gets DDoS'd? Try different hosts and CDNs, ones that don't destroy user security and privacy. Block Cloudflare IPs and Cloudflare will be gone, alternatives appearing as 90% of demand isn't sucked up by CF's too good to be true offer. Pay with money, not user data. Move to Tor. >>81737 >Without the Cloudflare MITM proxy, little-newbie-web-shop.com ’s TLS is handled by cheap-shared-web-host.com ; chic-trendy-cloud-buzzword-startup.com ’s TLS is handled by AWS; at-risk-controversial-activism.org and high-security-bitcoin-services.com should (we hope) do all their crypto on hardware under their respective owners’ physical control. The site visitor is responsible for deciding which endpoints to trust with private information. (N.b.: Reading interests and “clicktrails” are private information.) When all these sites sign up for Cloudflare, then Cloudflare becomes the one-stop decryption shop. Do you trust Cloudflare to be the “secure” Internet, or some huge proportion thereof?

Oh noo american company cloudflare spies on us what do we do what do we do Bullshit. Every fuarrrking thing spies on you. The only way to stop it is to explain the bulk of retards who use the internet that they're fuarrrking cancer and should fuarrrk off and die. But that's not happening ever. Every fuarrrking low iq glitterboy out there will simply use cloudflare because it's "convenient". They don't give a fuarrrk. In their head, it's " if u wanna C my website, u shld be an muh honest prsn". This is what you get for allowing normal users on your fuarrrking board.

>>81797 True, that's the condensed TL;DR Cloudflare is more insidious than Discord or Facebook because now any random website can be compromised. Imagine there's dragondildo.gr , a Greek webshop shipping only to Greece. Admin set up Cloudflare because it's free and: >because it's "convenient" If a Greek person orders a 2 ft dragon dildo, they trust the webshop to keep their info private, that's a given. But the IP, name, shipping address and more is visible to a US company and partners who have fuarrrk all legitimate interest, even if email or phone is somehow omitted for privacy. The user isn't informed in any way, the browser says Connection secure, when the situation is worse than a self-signed cert. It's not "maybe MITM'd" like a red padlock, it's worse than that and "100% definitely MITM'd".

>>81831 >>81797 We all agree that the Creepflare MitMing your dildo purchases is bad and the devil, and that Eternal September was a disaster for the Wired and all of mankind. Now this thread is about technical solutions that allow websites and forums to stay online despite the DDoS and bot spam, without needing Creepflare and other glowcorps. This thread is not about circle-jerking over our collective hate of Creepflares and the modern internet. Please add to the interesting technical discussion that has been going on so far, instead of derailing it.

>>81796 >All Cloudflared websites should have a red padlock. TLS intercept on this scale should be illegal. But nobody cares. "My surveillance doesn't affect me at the moment, let's pretend it doesn't exist." The problem is drawing the line. What is "scale"? All hosting providers, especially the virtual ones, can in theory be listening on your traffic and collecting it. Very few people host on dedicated servers, and fewer still host on dedis they own, and even rarer are the ones who host it in a place where only they have physical access to it. > Null route a provider or country until they make their underlings behave. Did you know some of them allow outgoing forged source IPs to this day? "Null route" is something you can only do if you own the data center, or have access to a firewall which has way more bandwidth than your server. You can't just "null route" DDoS if you have a $30 server. And even then, blanket blocking whole countries because someone attacked you from there is the most brain-dead thing that can be done ever. Modern DDoS attacks are a kid who paid a couple of hundred dollars for DDoS as a Service, and you get a few hours of 100,000 real home computers flooding you from 100,000 real IPs from all over the world. Good luck "null routing" anything. The reason Cloudflare works is that it has massive resources, including machine learning, that detects those coordinated efforts, and doesn't even block them, but challenges them as needed with CAPTCHA, or JS challenges, and maintains reputation for each of those clients to determine how harsh it will be with challenging them. > Design protocols where spamming is expensive and reflection, amplification isn't a thing. Solutions might exist in the abstract protocol space, but this is a long-term and radical view, which will probably not happen. Good luck telling everyone on the internet to switch to a whole other protocol, only to find that there's a fundamental flaw to DDoS it 5 years down the line. > Are you the 0.001% of people who hosts something and gets DDoS'd? Try different hosts and CDNs, ones that don't destroy user security and privacy. "CDN" means they destroy your privacy. No other way. A CDN serves your files for you, thus, they have to be able to pretend to be you and control your TLS private keys. All hosts can see your traffic in theory anyway, if they wanted to. The only "real" and perfect way is for you to have physical control over many machines all over the world, with a big collective bandwidth, and strong physical security to protect the private keys. So, as an admin, assume all communication between you and your clients are being seen by someone in the middle if you're using the normal web (your host, your CDN, a TLS proxy on their side of the network, etc.) Cloudflare is theoretically just as bad as anything else. If you want your clients to have true privacy, don't use the modern web. Use anonymous networks, other protocols, sneaker net, etc.

>>81836 >technical solutions that allow websites and forums to stay online despite the DDoS and bot spam Bot spam -> very expensive proof of work tests that would take, lets say, a week to get an access token. DDoS -> hang yourself, realistically. Or fuarrrk off to Tor, make super extensive proof of work test and cross fingers.

>>81842 > lets say, a week to get an access token. Who would churn their CPU for a week to join a site. Let alone do that for _each_ site they want to join. At that point, just make them pay $50, or equivalent in monero, or cash in mail, to register an account or something; would kill bot spam completely, especially if a real person reviewed the applications. > DDoS -> hang yourself, realistically. Or fuarrrk off to Tor No project, business, or source of knowledge, of any public interest, will ever just "fuarrrk off to Tor", hence everyone using Cloudflare and friends. Also, what is this defeatist attitude? There will be solutions. We will fix it, one way or another. I think with enough interest, it is probably possible to build a fleet management / clustering solution that allows you to use consumer VPSes or dedicated servers from varied hosting providers as your edge routers. The cost of that would of course be more than a $5 VPS, but at least it can be something. Perhaps a federated anti-DDoS system might be due; many clusters, each built by a collective of people who host their sites behind it, and trust each other, but all clusters share information about attacks, and potential botnets and compromised machines. Cloudflare basically does that, but in a centralized manner. Maybe many small actors pooling resources and sharing intel can work. I don't think the reason this doesn't already exist is because it is impossible. I think people just recently finished encrypting everything on the internet, and are just realizing that the DDoS magic pill they all hyped about basically invalidates that. The interest in solutions is growing. I can speak of personal experience that at least in two commercial tech companies I worked at someone on the business / lawyers' side was at least mildly worried that Cloudflare as an American company is going to see their customers' data, which was surprising to me. The Wired was, is, a dream world for all of us, lain, don't give up on it for the brutes and idiots flooding it, fight back, lain, we

Random idea... hijack Cloudflare somehow? For example, Cloudflare itself would serve something that would be itself encrypted with a second layer, and then the user on the other side would decrypt it themselves automatically? For example, site serves user a JS script that generates a public / private key pair locally in the browser cache, in addition to a public key from site itself, the user then sends a request to website that is encrypted with the public key in addition to the usual TLS encryption. Cloudflare can take off the TLS encryption to analyze the request's headers and patterns, but cannot see into the payload because it is encrypted with the site's public key. The site then decrypts the request, since it has the private key, and within it it finds the user's just-generated public key, the site then prepares the response, and encrypts it especially for the user, using the user's public key, and sends the response. Cloudflare can again see the response under the TLS, but it will only see the encrypted payload, not the content itself. All Cloudflare could infer from this is what site the user visited, some header info, but nothing beyond that. The user data would be preserved, and only visible to site itself. The downside of this is that clients have to have JavaScript enabled, and the browser has to generate secure crypto randomness, and the server will do a lot of work per-request, and will not be able to cache responses across different users. On the other hand, DDoS attackers will have their attacks absorbed by Cloudflare, unless they invest in writing custom code, or running full headless browsers for the attack. And in either cases, they would have to pay the cost of creating massive numbers of valid public/private key pairs, because you can very easily limit requests per-key using a simple counter in the req header, which can be checked by a simple Cloudflare worker script.

>>81733 Trying to post hashchan again in this thread as it is an actual solution i dont know why jannies are nuking it . I thought lainchan would be the most cypherpunk of image boards, is this too a cia honeypot? hashchan can run on localhost and its way more difficult to ddos ethereum than a single site. No cloudflare required,

>>81853 >allows you to use consumer VPSes or dedicated servers from varied hosting providers as your edge routers. How the heck would you route the traffic between "dedicated servers from varied hosting providers"? A load-balancer? You have a single point of failure that will MitM all cluster traffic. Anycast? That requires access to the routing hardware, you can't just do that across different providers.

>>81855 Probably because you're spamming it everywhere; I think I saw your posts 3 times by now. Hashchan is a chan, and will help you only if you want an image board. The internet is more than just image boards, we're discussing ideas to protect websites in general, not just chans. Besides, is an internet where people have to pay money every time they want to say something the internet we want? Because that sounds like the more money you have the more you can talk just like current internet, but with the added "benefit" of completely silencing people from poorer countries with lower GDP.

>>81855 >I thought lainchan would be the most cypherpunk of image boards, is this too a cia honeypot? Yes.

>>81857 >we're discussing ideas to protect websites in general thats just it, this localhost+distributed database+self host big files can work for just about anything. > is an internet where people have to pay money every time they want to say something the internet we want? the saying if its free, your the product is the reason these things appear free but their not. So one is already paying for access, and its a really bad deal once one figures out how their data is being fed into high dimensional neural nets to 1) feed you ads, 2) brainwash you 3) pimp you into different social circles , 4) resell you your data back to you with GPT subscriptions. If anons new the true value of their data, and how they wern't compensated for it at all, they'd make the switch over night. > but with the added "benefit" of completely silencing people from poorer countries with lower GDP. current situation is if they cant be monetized, their not given a platform to play in at all. Its bizarre, but designing public forums as public infrastructure (etheruem gas is the competiitve price floor) will be in the long run, the cheapest form of communication

Go full Stallman. Refuse these services. Discover more free alternatives. "Only surveillance can solve DDoS" is a false premise, there are plenty of non MITM websites that survive DDoS attacks, large and small. Website with functioning TLS aren't down all the time because of a DDoS. The solution isn't technical. Whatever big brain scheme you come up with, they'll twist it for profit, like they did: >personal computing >TLS >end-to-end encryption >cryptographic signatures >email >private messages >javascript >the web standard >democracy Block Cloudflare IPs in the firewall if you don't like it, or get a browser extension to do it. Stop using MITMed online services, politely let them know why, blogpost about it. https://www.cloudflare.com/ips/

What about …? Bunkerweb https://www.bunkerity.com/en https://github.com/bunkerity/bunkerweb Open-Appsec https://www.openappsec.io/ https://github.com/openappsec/openappsec

>>81945 >https://www.openappsec.io/ >Error: Forbidden >Your client does not have permission to get URL / from this server. lol blocks Tor so no thanks

>>81946 >Blocks tor. >Also hashchan discord. Yea I guess I'm not the only one that just stops in my tracks when I see a privacy developer that doesn't know the basics of privacy when you try to connect with them. For instance that hashchan. Looks friggin amazing! But then I saw the dev uses discord. Nevermind. I can't take them seriously at that point. I guess I'm a privacy extremist, and maybe I'm the only one. But what if I'm not? What if there are 100s of privacy projects in the graveyard because they couldn't generate interest, investment or just network power simply because those who would use such solution just cannot connect with them "Tor blocked". Just some food for thought to any dev listening. Yea yea I can fix this all on qubes running sessions through mobile proxies bought with monero and google chrome user agent to trick cloudflare. But why should I have to jump through so many hoops?

>>81733 Holy soykaf take ur meds now

>>81838 > "CDN" means they destroy your privacy. No other way. Has no one tried to just deliver content through a site itself just once and these assets stored client side to be called on when needed?

>>81975 Thanks for your enlightening take on the matter. Off you go to a CF website, those freedoms ain't gonna destroy themselves.

>>81976 you can do so by telling the browser to aggresively cache everything using certain headers. not sure how efficient that is though

>>81985 Well I was thinking of it doing it like a prefetch to load certain things needed for the site before it is actually needed. Not sure if a good idea or terrible idea.

>>81952 >>Also hashchan discord. Yea I guess I'm not the only one that just stops in my tracks when I see a privacy developer that doesn't know the basics of privacy when you try to connect with them. For instance that hashchan. Looks friggin amazing! But then I saw the dev uses discord. Nevermind. I can't take them seriously at that point. Fair enough, all of web3 is in a Faustian bargin with that app -not something I like to use either. Open to suggestions but i do need at least a couple things with some composability / reach. To the point of privacy though, hashchan wont proclaim to be a privacy chans gold standard. the onramp and offramps to get crypto are the surveillance capitalists cash cow. and developers need to be running off airgapped XP lenovos in remote south east asian jungles or islands to build the stuff that brings privacy back to public chains. hashchan provides a level of pseudoanonymity depending on how a user funds their addresses. If you post with one ens name, everyone will know, if you fund a fresh wallet through a KYC exchange they will know. If you fund it through a non KYC less will know, if you use a chip mixer, who knows who knows.

>>81976 >Has no one tried to just deliver content through a site itself just once and these assets stored client side to be called on when needed? This is already widely used on the web. Browsers cache content if the cache headers sent by the server advise that. You can have a TTL (Time to Live) limit on the caching, so the browser re-requests the data after that time, or, you can bust the cache using ETags, which check some kind of a hash of the file, and if the hash is changed then the file is sent. But client side caching is only an optimization, and it only works if the client "behaves". If the client is an aggressive attacker, then client side caching will not help protect you from DDoS attacks, unlike CDNs in that case.

>>81936 >Website with functioning TLS aren't down all the time because of a DDoS. This is like saying "why are you people discussing car armor and body armor? I know plenty of people that aren't shot dead!" Of course you do, they just happened to not be shot, or, they happened to be shot at, but had enough resources to protect themselves. You think those sites are up running on $5 VPSes while being DDoSed with a few million requests per-minute? No. They either aren't being DDoSed, or they have way more resources. But what if you: 0. Are a site admin. 1. Are being DDoSed or bot spammed. 2. You don't have thousands of dollars. 3. You don't want to sellout to glowy creepflares. What we were trying to do here, before everyone started derailing the thread with crypto scams and "just block cloudflare ips bro, it evils", is to share solutions and brainstorm ideas for site admins to independently fortify themselves as much as possible. We know to block cloudflare, and we know silly crypto boards exist, now can we go back to technical discussion and advice.

What do you guys think of basedflare as an alternative to cloudflare, supposedly they offer the same services but accept crypto. Do they also mitm websites? https://basedflare.com/

Pirate sites I noticed have started using DDoS Guard. Probably because it is based in Russia so they don't care about copyright claims.

this thread is a prime ex of how nerds are glitterboys with weak character, so much so that ur arrogant cum guzzling incompetence causes global harms. can u cunts get even 1 thing rite: 1. captchas are for posting/acc creation, NOT FOR VIEWING. a website that needs a captcha to prevent ddos doesnt exist, it would just be completely vulnerable to 9000 other things (like just doing the captcha by hand then making a few reqs would take down the whole site). it means the classic ddos strategy of load balancing doesnt work cus their site is 2 inefficient due to inept retard monkeys creating it in ruby on rails + 89997 libraries. cloudflare is just covering for their incompetence BY PROVIDING THEM A SOLUTION THAT IS HARMFUL TO EVERYONE 2. if a captcha requires profiling the user, its not a captcha, thats just spyware 3. its more expensive to gen/verify a captcha than just serving the content 4. the only time a cpatcha for viewing would be arguably valid is if the site was doing an expensive computation like a full text search, then you would still only put it there if u kenw what ur doing 5a. cloudflare uses every excuse possible to show the captcha (its to stop ddos, n-no its to stop phsining, n-no its to stop SQL injection!), which logs your keystrokes / mouse movements, creating a unique profile for every single user that uses any website on teh internet at all (via proxy, its redundant for those who dont) 5b. they likely feed this data rite to the nsa (as exemplified with snowden proving googles does it, but we already assumed so before that) 5c. this combined with glitterboy soykaf like banks and tax websites forcing you to go to their website and using cloudflare (or equivalents that also feed to the NSA themselves) means the moment i do any crime on a website (which soon will include just typing "kys" or "sex"), it will be linked back to my irl identity by matching my kbd/mouse movements on the website in question to that of the bank/tax part of y ur so cancer is cus u say dumb soykaf and shame anyone who doesnt agree : 1. >cloudflare solves ddos it has been solved without them since literally the start of the internet. make a properly optimized website with lots of static content. during a ddos you TEMPORARILY block IP addresses identified as the source of the flood 2. >cloudflare=racket (i.e they just ddos ppl themselves) unproven and it wouldnt make a difference. ddos exists regardles of them. they just have to say "we solve ddos" and heards of morons thunder in, time and again 3. >cloudflare is serving child porn terrorism warez thats how the internet is meant to work you dumb pussy glitterboy there doesnt have to be an employee to verify if every single thing someone posts is legal given meme law of the day that only applies in x number of countries 4. >cloudflare is literally evil and anti free speech cus muh 8chan they are trash but 4 isnt true due to 3. they actually just arbitrarily moderate their soykaf like any other dumb little muppet with a website points 2 and 4 are also important because you WlGG3RS are essentially false opposition. if i argue about cloudflare with an SJW he immediately thinks im a """nazi""" cus of u retards who agree with 1/10 of the points against cloudflare. ironically even on 8chan i argued with retarded glitterboys like u who respoond "cloudfalre is right cus they are doing this to block ddos" thanks to you glitterboys whose soykaf is all retarded, were heading straight to the non-sequiter that "duh innanet is evil u gotta have id to use it". cloudflare is a fighting front on this. cloudflare has to die. matthew prince should be broke, not a 4bn net worth insufferable pseudo-lawyer my-way-or-the-highway glitterboy. this is the cock sucker bitch you defend each time you defend clownflare, btw. lmao. good bye and kill yourselves

Clouflare does 80% of the ddosing themselves, just luigi's mansione them and the entire web heals again (in minecraft)

>>86137 How many options are there that do not use JavaScript and actually work? Until something is better it's over.

>>86566 Cloudflare just has exit nodes on a blacklist so everytime you visit a cloudflare protected website using one, you have to solve their captcha. The blacklist isn't per-site, every website owner who uses Cloudflare with a specific level of DDoS protection gets the same list of "suspicious IPs" which (intentionally or unintentionally) ends up making clearnet unaccessible to TOR users. Also: https://www.devever.net/~hl/cloudflare

>>86567 There is go-away (https://git.gammaspectra.live/git/go-away) that can work without JS (it's used on inv.nadeko.net). I think the developer of anubis is working on non-JS checks too.

>>86570 I like Anubis except for the certain JavaScript functions it relies on making things like JShell not compatible so it is nice to hear they are working on some alternative, or do you mean replacing some of the things Anubis does rather than making something from scratch or forked? As for Go-Away do you know any other websites using it other than inv.nadeko.net?

>>86571 As far as I understand, the plan is to add options to anubis so that it can work without javascript (https://xeiaso.net/blog/2025/anubis-update-m02/ "Half-baked idea: allow users that don't have JavaScript enabled to bypass the challenge". Please set an id attribute for your section headers people). The JS-based PoW will most likely stay the default though, so that doesn't really matter. I don't know other sites using go-away, sorry.

Anubis is garbage. At the moment it's crashing my browser just like Cloudflare was doing a few months ago. I don't know what kind of incompetent Google cruft the dev is choking on, but if you're functionally performing the same role of denying service to non-Google-approved browsers you are Satan's Little Helper performing the same service of entrenching a malicious web monopolist.

>>86604 Did you report it to both the dev of Anubis and the browser devs? It could be a bug with either of them