The entire point of using bots is speed. I would be a little surprised if botnet admins started programming long delays between filling out the form and clicking submit. It sort of defeats the purpose of using bots.
Agreed. After posting, I realized that we are likely being hammered by armies of bots instead of one persistent bot, so the likelihood that one would be determined is probably small.
Quote:
Originally Posted by Max Taxable
It would have to be a pretty long delay - page load times are a factor in this, and sometimes with some of the really bad proxies these bots are on, page load time can be really slow. Add to that, there is no way for the botnet admin to determine what your time differential setting is.
Perhaps not a bot, but a frustrated person not paid by the hour might take a keen interest in probing the defenses. However, as stated earlier, time is money and we are but one of millions of potential victims.
Quote:
Originally Posted by Max Taxable
I'll be curious to see if your 30 second setting catches any humans, I fear it might. Please update us with that. Increasing the time is far preferable to reducing it - reducing it only helps the bots.
I'll likely adjust the time downward when I see more reporting times. As with any countermeasure, there must be a balance between preventing an unwanted event and not allowing a wanted event. Unfortunately, it is unlikely that I will know if a human was denied registration (unless they use the "Contact Us" process to complain), but I will certainly know if the bots breach the walls.
11-19-2012, 04:56 PM
Threaded Mode