[colejohnson66]

But how do you distinguish an abnormal traffic spike (HN hug-of-death) vs a botnet? Cloudflare’s solution is a CAPTCHA, but are there better options?

[jgrahamc]

Cloudflare's solution is not a CAPTCHA. We have a ton of stuff going on that detects bots. CAPTCHAs are a small part of the tools we use. https://blog.cloudflare.com/cloudflare-bot-management-machin...

[colejohnson66]

Sorry. I didn’t mean to imply that you don’t have anything but CAPTCHAs. My wording could’ve been better.

[geitir]

Do you have a scraper that looks for mentions of Cloudflare or did you just happen upon this?

[jgrahamc]

Yeah. I use something like this: https://github.com/jgrahamc/hncomments

Although I really need to commit the final version as that one isn't quite what I use.

[mleonhard]

Cloudflare uses CAPTCHA to drive away proxy users. Privacy conflicts with Cloudflare's endgame of profiling every Internet user and then monetizing that data.

[smasher164]

An attack-resistant trust metric? Although I haven’t seen them used against denial of service attacks.

[aj3]

Generally you don't. Just be prepared to scale resources and handle everyone.