Yes, bots being >50% of all traffic is bonkers, but at the same time I'm increasingly becoming convinced that bot defenses are (largely? equally? also?) harmful to the overall ecosystem.
Everything bot detection relies on is basically ossification: TLS fingerprinting, protocol offering and preference, HTTP header presence and ordering, ...
Assuming / enforcing those is overall bad for the web, and all browsers and clients should really grease all of that.
Jan Schaumann
@jschauma@mstdn.social
Yeah. I mean, there's _some_ value in trivial defenses to somewhat tone down the noise (akin to e.g., run sshd on a different port than 22, just to avoid the very noisy trivial scanners), but it's never going to be effective against dedicated actors.
August 19, 2025 at 3:06:16 PM
