points by semiquaver 2 days ago | 0 comments
This is a website about starting businesses.
Let me tell you, at the business I work at, some of our customers work at a company that uses a commercial VDI service for all workstations couldn’t access our service because the VDI egress was in GCP and we had an AWS WAF rule banning datacenter IPs.
Obviously, we removed the rule because it was doing nothing useful but plenty of harm. Real bots come from residential IPs.
[–] hypfer 2 days ago
Hm I mean HN _also_ is that?
But not exclusively.
And even if we run with that assumption, one might still be fine. It's a trade-off, but, depending on the target audience, a few lost sales might be worth savings in other aspects.
[–] wtch98 2 days ago
If you control the connecting device why not use MTLS?
[–] semiquaver 2 days ago
Who said we control the connecting device? This is a website. Websites are usually pretty arms-length things, and that’s the case with us. They’re our customers but we can’t install certificates on their computers and enforce mTLS. Can you do that with any of your customers?
[–] anonreplier 2 days ago
Can use cloudflare turnstile or similar instead
It's really not, unless the only qualifier for that is "hosted by a VC incubator". Most of the people here are here to argue about AI or Crypto or whatever, or read announcements from Nvidia and Google. I would bet less then 1% are starting businesses.