Last year, I wrote a post about how I use zipbombs to deal with bot traffic [0]. It went mega viral over the web, and I regret it. My server was completely overwhelmed with bot traffic. After months of dealing with it, I had to find a better strategy then keep my mouth shut.

[0]: https://news.ycombinator.com/item?id=43826798

▲

driverdan 4 hours ago | parent | next [-]

So it ended up not having a noticeable impact on the bots?

▲

firefoxd 4 hours ago | parent [-]

It worked fine... on a small scale But it's one thing to swat flies versus fighting swarm of yellow jackets. Serving a 1MB file a million times a day on a small digitalocean droplet is not feasible. Let's just say it didn't scale. And AI bots usually come with beefier machines, and recover faster after a bomb.

▲

le_curious 21 minutes ago | parent [-]

Why did you serve it from DigitalOcean?

Why not a CDN?

	▲	firefoxd 10 minutes ago \| parent [-]
		It's the content of the page, the raw html, that is replaced with a zipbomb. Example: https://example.com checks if you are a malicious bot, depending on the result, it will send you gzip html or gzipped bomb. So that can't be swapped or redirected to a CDN. The bots would simply ignore the redirect.

▲

kazinator 4 hours ago | parent | prev | next [-]

Last year, I read your post and implemented it. I had no way to tell whether there is any benefit to it, so I discontinued it. Serving the data, even though it is compressed and the compression is precomputed, was still a waste of bandwidth. It could hit the browsers of legit user (false positive).

The main problem on my site is that bots hit the CGIT repo, where visiting files triggers syntax highlighting scripts.

I put in a skill-testing-question type system where you get a maximally long-lived access cookie if you answer right (so legit users are bothered as infrequently as possible).

▲

chicken-stew 2 hours ago | parent | prev | next [-]

Can that technique be applied to packet compression?

▲

giwook 4 hours ago | parent | prev [-]

What is that improved strategy? :pray:

	▲	firefoxd 9 minutes ago \| parent [-]
		Not telling you this time, Mr. Bot