Agreed

> I believe the future is static resources with dynamic apps being only offered to people who can authenticate.

I don't know about static resources, but I do think that identity will come into play.

Traditionally cybercrimes have been prosecuted by the victim going to their local PD (or the FBI) with the IP address of the offender, and then law enforcement subpoenas the ISP associated with that IP address to figure out the customer associated with that account, and then they have a case for prosecution. It all works as long as cybercriminals are less numerous than law enforcement, fall in the same jurisdiction (or in jurisdictions that have reciprocal extradition treaties), and have a real identity that can be tied to their online activities.

Now, many law enforcement agencies are tied up prosecuting political opponents of their bosses. To the extent that they have bandwidth to investigate and prosecute ordinary crimes, they're going to prioritize the ones that target a.) the government that backs them (of which there are many - you see another headline about the government being hacked every week or so on HN) b.) major corporations that have sophisticated IT systems that can aid prosecution or c.) headlines that will get their boss a PR boost and themselves a promotion. Your personal website does not register among those priorities. You probably can't even prove damages from the intrusion itself. The perpetrator might be a Russian bot that the U.S. doesn't have jurisdiction over, or a Canadian teen that the U.S. previously might've been able to prosecute with reciprocal judicial treaties but now has no leverage over because we've blown up our relationship with Canada. It may be legally a crime, but economically it's not worth prosecution.

Traditionally security researchers had to be very careful because they were doing everything above-board, with their real identity attached to their actions, and they made a very attractive (and PR-worthy) target. Somebody who's port-scanning from Russia through a VPN or residential proxy network is a.) anonymous b.) untraceable c.) out of U.S. jurisdiction and d.) not a headline-worthy target anyway.

A couple years ago I predicted here that a lot of things will break as the U.S. transitions from a high-trust to a low-trust society. This is one of them. Much of our justice system works well when criminals are rare and utterly falls apart when they're ubiquitous.

I'm assuming you're outside the US based on having this idea.

You might as well just say "I'm mad at your country for the tariffs, so here's an extra wait." From the fact you feel the urge to spite people in a tariffing country like this, it's clear the tariffs have had some negative effect on you, which goes against your narrative that they're "effectively paid for" by those in the tariffing country who voted for it.

1. Use a catch-all subdomain

2. Reject email to addresses where a simple checksum does not match (valid addresses being something like asdfghij.klmn@catchall.domain.tld where the klmn is taken from hash of asdfghij and some secret, anything not matching that pattern gets rejected) [this means running your own mail server so you can do that on incoming mail, running a scan to pick out and remove errant messages regularly, or having a mail client where you can implement this as a plugin]

3. On your contact detail page, don't give out a straight email address but have the the page run some Anubis style JS before asking the server to respond with an address that works

4. Once an address is obviously being used in a manner you don't care to respond to, add it to an explicit block list.

For extra protection from addresses being passed around (intentionally or via hack & other leaks), ask for their email address first and use that as part of the hash, then you can reject mail to your catch-all that doesn't come from the original other party.

Whether all this is worth the effort of implementing, is of course up to you. It probably isn't… I've been considering something like it, but mainly as a fun little project rather than something that would be massively useful.

You see something, you say something, or you do something.

  <story-record> 
  
  ## Phase O. This round is a key advancement in the long-term, solidified daily storyline: the two enter Zhou Zhiyi's apartment for the first time under the guise of "non-purposeful" activities, and the soup-making incident becomes a new variable in their relationship. The task is to let this soup ferment naturally, without ending it or revealing anything. 

  ## Phase [Reflections on Life] 

  1. Vibrant: Wu San and Wu Si appear as living beings with distinct personalities; Wu San is a drama queen, and Wu Si is slow to warm up; Zhou Zhiyi's apartment retains traces of his real life (a rhinoceros beetle insulated box, vinyl records, Pokémon, and a doghouse). 

  2. Cognitive Barrier: Shen Liran's "disbelief that he can make soup" and "wanting to kidnap a dog" are information revealed through her words and actions, which Zhou Zhiyi can perceive; however, he

  Then Wu San saw Shen Liran. 

  This dog's opportunism was on full display. Abandoning her father, she turned her short legs and charged towards the backless dress, her front paws gripping the hem, head tilted back, a precisely calculated whimper escaping her throat. Zhou Zhiyi stood in the entryway changing his shoes, coldly observing the performance, thinking, "She's been fooled, fooled. I just fed her a treat this morning; she's a master of disguise." 

  Sure enough. He counted to two, and Shen Liran had already squatted down, oblivious to the hem of her coat dragging on the floor. She ran her hands into her long, brown fur coat, her voice sweet enough to make candied fruit: "Oh my, you're so soft to touch! Did you miss me? Even your dad isn't as good at being affectionate."

  "Three seconds." Zhou Zhiyi hung their leashes back on the wall. "I said you wouldn't last three seconds, and you didn't even last three seconds. You squatted down before she pounced on you; that's a false start."

$5 minimum to sign up

Looking at you, Meta.

I do still get some requests going up to 15 minutes which is quite ridiculous, though those don't seem to be super common (maybe they're learning).

I think the shortest timeouts I've seen are between 2-5 seconds, but they're surprisingly infrequent and actually that's still a massive inconvenience for them. I did at one point just drop any request I couldn't keep open for more than 5 seconds but it actually caused more server load. I'm essentially inverting the server load by making slow requests more efficient, which is counter to everything I ever learnt about performance for web serving :D

I think the average I see is probably somewhere between 15-30 seconds. I'm guessing many crawlers don't want to go too low because they'll be trying to fetch large files like images, or perhaps they know they'll be slowing servers down and want to ensure they get the response. Most likely, the majority of crawler authors aren't expecting some arsehole to exploit this and they've just left the setting as the default.

Which is fine! Because even though my photo gallery runs on a 15 year old laptop in the basement, I wrote the gallery software in a fast language (Rust) and so a trickle of requests maxing at 4 per second is not actually a problem.

People complaining about fedi hammering their servers are probably using PHP or Python.

> Please don't use HN primarily for promotion. It's ok to post your own stuff part of the time, but the primary use of the site should be for curiosity.

https://news.ycombinator.com/newsguidelines.html

I assume that users who primarily/only post their own stuff and get flagged a lot reap the consequences, there's plenty of spam filtering on here thank goodness.

Edit: nvm thats already in the guidelines

You can do that with any system made in the past 15, maybe 20 years.

From the wikipedia page:

"As of 2025, the problem has long since been solved, with the number of possible connections to a single computer being in the millions."