undefined | Better HN

0 pointsNovemberWhiskey4y ago0 comments

I find this all vaguely baffling; I'm by no means a WP expert. If they're not targeted at users, what are they targeted at? Bots?

0 comments

6 comments · 1 top-level

TurningCanadian4y ago· 5 in thread

The tragedy of the commons that happens when you can't establish the reputation of your visitors because regular users are indistinguishable from malicious actors when signals like IPs are intentionally obscured.

NovemberWhiskeyOP4y ago

The reasoning here just seems perverse. WP wants to allow contributions by anonymous users, which seems noble. But it also realizes that it needs to be able to block some people from anonymous contribution "to protect itself".

The implementation of the blocking mechanism is IP addresses/ranges, which is imprecise (to say the least). But now you have to worry about abusive users bypassing your technical control by obscuring their IP addresses. So you block all IP ranges that implement e.g. CGNAT, VPNs, 464XLAT.

So now you're mass-blocking access to millions of people who have never shown any inkling of malicious intent due to rational technology choices by their service providers or due to a reasonable desire to protect their personal privacy.

If you're OK with blocking users in such an entirely capricious and arbitrary way, why not just insist on registration?

dtech4y ago

Not blocking anything is infeasible due to abuse, requiring registration is effectively blocking anonymous editing access for everyone. If you want anonymous editing, providing it to some is strictly better than providing it to none.

Your argument is as flawed as saying we shouldn't have email because spammers must be blocked.

2 more replies

bdamm4y ago

That's only because they're using weak authentication. If they required users to use something like WebAuthn, the bot problems would be significantly easier to deal with.

mimsee4y ago

How come? Last I checked there was a devtool to create virtual authenticators. Unless there’s a way for wikipedia to permit only certain vendors like Yubico, akin to browsers trusting certain CAs, I don’t see how one couldn’t make a bot register thousands of accounts with virtual authenticators.

1 more reply

drivebycomment4y ago

True, but that would significantly increase the barrier for contributions, especially at the long tail. As always, it's a trade-off, not a black-or-white situation.

j / k navigate · click thread line to collapse