Yeah, I had the same question myself. I think that's what you would want to do to make it airtight (plus some amount of rate limiting or flagging for devices that are part of dedicated device farms).

But even if not, there's still value in raising the barrier to entry. For example, you can buy 1000 reCaptcha solves for $1-2 from various captcha-solver services. And yet that $0.001-per-request fee does discourage mass-scale bot attacks.

▲

Hizonner 6 hours ago | parent [-]

... You... think... it would be a good thing.

Don't you...

▲

IshKebab 5 hours ago | parent [-]

I do. It has downsides of course, but what's the alternative at this point?

▲

Hizonner 3 hours ago | parent | next [-]

Depends on your specific problem. Usually redesign your system not to need to care if the other end is a bot or not.

▲

IshKebab 2 hours ago | parent [-]

How though? Can you also avoid DDoS simply by designing your system to not care if the requester is a bot or not.

Let's say I'm running https://grep.app/ for example. AI bots start heavily using it, costing me a ton of money. How would you magically design this so it doesn't matter if the end bots are using it?

	▲	Hizonner 2 hours ago \| parent [-]
		Rate limit individual clients.

▲

intended 4 hours ago | parent | prev [-]

I suspect that the HN crowd is somehow insulated from the river of crap and fraud that is the internet experience for a majority of the population.