Geohashing.site's Better Banhammer

A blunt instrument Yesterday, Terence Eden shared the technique he's been using to make a PHP-powered honeypot that bans badly-behaved bots that disregard his robots.txt file. The essence of his technique is this: A URL is explicitly disallowed in robots.txt. A disallowed link, hidden to humans, appears on web pages. Anybody visiting the link has their IP address (carefully) written to a .htaccess file. His (Apache) webserver uses this .htaccess file as a blocklist. There are a few problems with this approach, but I picked up on the potential for abuse: an attacker who derives the "if you visit this then you get banned" URL can easily trick legitimate users into visiting it. I've demonstrated this potential for abuse before: an asset load, a redirect, a form submission, a link, an iframe... any of these and more besides can be used to turn this kind of honeypot into a denial-of-service attack against legitimate users of the site. A sharper instrument Here's my solution: one extra…

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town