When 80% of traffic from an IP is malicious and the other 20% is regular traffic, but both sources look like the same traffic (impersonating browser headers, sometimes running headless chromium), what else can you do? Cookies and stateful cookie-like objects, such as privacy pass.
Can anyone report how well privacy pass works nowadays?
> When 80% of traffic from an IP is malicious and the other 20% is regular traffic, but both sources look like the same traffic (impersonating browser headers, sometimes running headless chromium), what else can you do?
Accept the traffic, taking the bad with the good. We all know the ills of visitor profiling regardless of effectiveness.
That's an easy position to take when you personally do not bear the expense of the extra bandwidth, increased hardware needed to ensure acceptable response times, and cleanup/reputation damage when you are compromised.
All of these things have a cost, and they should be balanced against the benefit seen by allowing open access.
Can anyone report how well privacy pass works nowadays?