Post B821tiVNPhN1LIlwcS by mia@movsw.0x0.st
 (DIR) More posts by mia@movsw.0x0.st
 (DIR) Post #B821t6IHTwJepgLwvo by scathach@stereophonic.space
       0 likes, 0 repeats
       
       @sun For some reason that stupid catgirl pisses me off even more than a cloudflare browser cavity search page
       
 (DIR) Post #B821t6XWZGVdaxU7gu by mia@movsw.0x0.st
       0 likes, 0 repeats
       
       @scathach @sun i wish people would just use go-away…(reminds me i wanted to update my nginx plugin for ja4+ fingerprinting)
       
 (DIR) Post #B821tiVNPhN1LIlwcS by mia@movsw.0x0.st
       0 likes, 0 repeats
       
       @scathach @sun like 99% of bots you can detect by checking for the ALPN extension in the TLS ClientHello. if the user agent string looks like a web browser released in the last 10 years but there’s no ALPN, that is 100% a bot. if you only expect web browsers to begin with, you don’t need to check the UA string and can block access without even completing the handshake
       
 (DIR) Post #B821tpH6FB6qL398q0 by mia@movsw.0x0.st
       0 likes, 0 repeats
       
       @scathach @sun (unfortunately openssl has no API for this, but boringssl does)