Rate Limiting Clig Creation

Today a friendly Cligs user emailed me with a description of a weakness in Cligs. The weakness basically means that Cligs is suceptible to automated attacks that can potentially bog down the site. I’ve been thinking about a different but related issue, and today’s email prompted me to act quickly before someone not so nice does something.

So as of just now, the Cligs system has a built-in rate limit of creating up to 5 new cligs every minute. If you create cligs at a faster rate, Cligs will ask you to fill out a captcha form. A captcha is an image with a funnily-written image that you need to read and type into the form. Automated robots (bots) cannot fill out that form and so this check stops automation dead.

The question with measures like this is as follows: what is the balance between user convenience (i.e. not overly aggressive checking) and security (i.e. vigilant checking)? I set the balance at 5 new cligs every minute because it’s unlikely a human being would do that. Comments and thoughts welcome below.

This entry was posted on Sonntag, September 28th, 2008 at 10:33 pm and is filed under Cligs News. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.