INFOWORLD GRIPE LINE BY ED FOSTER Bookmark this page

 
Display: Sort:
Borderline searches and seizures | 19 comments (19 topical) | Post A Comment
Missing the obvious?[ Parent | Reply to This ] (none / 0) (#15)
by Anonymous User on Fri Jul 04, 2008 at 12:41:16 PM PDT

The database key "magic cookie" idea is good, but needs a little extra to avoid slowly bloating up to one day become a ludicrous waste of disk space. Entries need to be deleted when a post is submitted (consult, then remove the entry). Also, people who bring up the form and then for whatever reason don't submit anything will still cause it to more slowly bloat up with unused entries. Adding a third, date field and every day at 2am or whatever purging every entry in that table older than 24 hours will get rid of those, without disturbing people that happen to be posting at the time (as their post's entry should be much younger than 24 hours).

But all of this discussion may be missing the obvious.

Nobody has any business posting thousands of posts in the space of only an hour. Why not just enforce a posting volume limit per first-two-octets or first-three-octets IP block of, say, 20 posts in an hour? It's very unlikely that legitimate posters will hit this limit (and it could be waived for long-standing registered users with a history of legit posts, and/or applied solely to posts containing links, so only 20 containing links plus however-many that don't per hour). Any beyond that either fail entirely or have links stripped out or something, and maybe the IP range is blocked from posting for additional time. (Only do the latter if there's measures taken to keep it from ever hitting a legitimate human. If it only kicks in if you post 20 with links in one hour, and are not on a whitelist of registered users, and on the last three posts towards the limit the form comes up with successively more dire warnings that the limit is being approached and don't post any links for a while or else, say.)

Of course, that won't faze someone who commands a botnet, as someone else pointed out. Using a captcha that's difficult to guess (large number of possible right answers) whenever a post contains links will then reduce the volume somewhat.


[ Parent | Reply to This ]



Borderline searches and seizures | 19 comments (19 topical) | Post A Comment
Display: Sort:

Menu
· create account
· faq
· search

Login
Make a new account
Username:
Password:

 HOME  NEWS  COLUMNS  BLOGS  PODCASTS  TECHNOLOGIES  TEST CENTER  EVENTS  CAREERS  IT EXEC-CONNECT   About Awards Contact Us 

Copyright © 2006, Reprints, Permissions, Licensing, IDG Network, Privacy Policy.
All Rights reserved. InfoWorld is a leading publisher of technology information and product reviews on topics including viruses,
phishing, worms, firewalls, security, servers, storage, networking, wireless, databases, and web services.

ComputerWorld :: LinuxWorld :: Network World :: CIO :: PC World :: Darwin :: CMO :: CSO
IT Careers :: JavaWorld :: Macworld :: Mac Central :: Playlist :: GamePro :: GameStar :: Gamerhelp
ITWorld Canada :: Computerwoche :: Techworld UK :: tecChannel :: IDG.se :: IDG.no :: IDG.pl

create account | faq | search