Egregoros

Signal feed

Timeline

Post

Remote status

Context

1

Replies

2

@scathach @sun like 99% of bots you can detect by checking for the ALPN extension in the TLS ClientHello. if the user agent string looks like a web browser released in the last 10 years but there’s no ALPN, that is 100% a bot. if you only expect web browsers to begin with, you don’t need to check the UA string and can block access without even completing the handshake