Granted, I host a... few handful of sites on that €8 VPS. But the content isn't the problem, the crazy request rate is, and that is outside of my control.

(Hence part of my defense is firewalling crawlers off. Can't TLS handshake if packets are dropped! Problem solved.)

@alice

this concert is already copped

Screen readers get the real words.

ShieldFont hides scrambled passages from accessibility tools by default with aria-hidden="true".

The real words ship sealed in the same page, and the reader’s own browser uncovers them by solving a compute-heavy puzzle — a few seconds of their CPU, and a cost a bulk scraper would rather not pay. It needs JavaScript, the reader waits while everyone else does not, and a shielded block still

There's a tiiiiny little problem with "quit trying": I can't afford to. Without defenses up, a €46/month VPS (4 CPUs, 8GiB RAM) died under the crawler assault in about 2 minutes.

It's not that what I was serving was inefficient... it never got to serving! It died while trying to keep up with TLS handshakes at over 10 thousand requests / second. Yes, that was sustained over multiple days. I temporarily scaled up to 16 cores, and that still died.

For comparison, I currently pay €8/month for my VPS. There is no proof of work, no JavaScript required, no silly fonts. I've been using the same measures for about a year now, the bots have not adapted (and if they do, I have a dozen other tricks up my sleeve, none of which affects the legit visitor any more than the current measures do).

I can afford €8/month. I cannot afford €45+. They can very easily DDoS me if I let my guards down, yet, I can't scale up infinitely.

So defense it is. There are reasonable defenses that work.

@alice