alt Hacker NewsLimiting by referrer seems strange — if you know a normal user makes 10-20 requests (let’s assume per minute), can’t you just rate limit requests to 100 requests per minute per IP (5x the average load) and still block the majority of these cases?
Or, if it’s just a few bad actors, block based on JA4/JA3 fingerprint?
Replies
toast0 • last Saturday at 5:36 PM
Limiting by referrer is probably the right first step. (And changing the front page text)
You want to track usage by the site, not the person, because you can ask a site to change usage patterns in a way you can't really ask a site's users. Maybe a per IP limit makes sense too, but you wouldn't want them low enough that it would be effective for something like this.
What if one user really wants to browse around the world and explore the map. I remember spending half an hour in Google Earth desktop, just exploring around interesting places.
I think referer based limits are better, this way I can ask high users to please choose self-hosting instead of the public instance.