Instagram story viewer> @rhetthunter9777> Post

Rhett Hunter

@rhetthunter9777

7 years ago

Drippy 💧💯

78

3

Posted On: August 17th 2019, 01:26 am

Tagged Users:

@cutedude

@luke.taegtmeyer

luke.taegtmeyer

@austinboone_

@nathanhforrester

nathanhforrester

@chloehastingss

@parkerlellis

@tyler_webster9

@bostick.will

@carsonhobbs__

@trevorboone9

Drippy 💧💯

Comments (3)

alexismcdaniel_

7 years ago

alexismcdaniel_

Stud

chloehastingss

7 years ago

chloehastingss

i honeslty feel so appreciated thank u for the tag 🤧🤧

luke.taegtmeyer

7 years ago

luke.taegtmeyer

🥶😱

More posts

Love is still alive

For the joy of movement @ganni x @lululemon

📹 by @kalseyjay

Jazz Haven’t Caught On To The Rage Bait

NEW YORK, #NewYork!! 🔥 The BADDIES are coming to your CITY this SATURDAY, October 17 at @matriarchnyc with doors opening at 8pm | Showtime at 9pm!! 🥂 Tag your BADDIES FRIENDS & grab y’all TICKETS NOW!!

📍: 512 West 42nd Street
New York, New York 10036

LINK in BIO for TICKETS 🎟️!!

🚨 Interview question: 10,000 bots are hammering your login API. How do you stop them without locking out real users?
Most people say "just block them." Here's why that fails 👇
❌ Blocking IPs doesn't work. The bots come from thousands of different IPs, each sending only a few requests, so no single source looks suspicious.
❌ Login is expensive on purpose. bcrypt is deliberately slow so attackers can't guess passwords quickly. But that means every fake attempt burns real CPU, and enough of them turns an attack into an outage.
❌ Rate limits don't catch it. Attackers use email and password pairs leaked from other sites, with only 1-2 tries per account. Your "5 attempts" rule never triggers.
❌ Lockouts backfire. Now attackers can lock real users out on purpose.
✅ The real fix: decide earlier. Put a cheap risk check in front of the expensive one, and only spend CPU on requests that look real.
What the risk check looks at:
🔹 TLS fingerprint: a real iPhone app and a Python script connect differently, even if both claim to be an iPhone
🔹 Failure rate: a client failing most of its logins is suspicious
🔹 Known device: have we seen this device before?
No single signal is enough, so you combine them and respond in proportion:
🟢 Low risk → straight through
🟡 Medium risk → CAPTCHA
🔴 High risk → dropped before it touches bcrypt
Real users barely notice. Bots get expensive. 💸
Interview answer in one line: score each request cheaply, challenge the doubtful ones, and protect the slow, expensive step behind them.
📌 Save this for your next system design interview
💬 Comment "SECURITY" if you want the next one on rate limiting
➕ Follow for more backend concepts explained visually
Hashtags:
#systemdesign #softwareengineering #backend #cybersecurity #codinginterview techinterview programming developer bcrypt webdevelopment learncoding computerscience botprotection apidesign tech

** GIVEAWAY CLOSED! ** TICKET GIVEAWAY 🗣️ wanna go see @thundercatmusic at @thenationalva on October 17th FOR FREE? We’ve teamed up with the venue to send you and a pal to the show!

To enter to win, all you’ve gotta do is:
- LIKE this post 🐈‍⬛
- make sure you’re FOLLOWING both us and @boweryvirginias here on Instagram 🐈‍⬛
- and TAG A FRIEND that you’d bring with you to the show! 🐈‍⬛

That’s it! We’ll pick and contact a winner privately on October 15th! You can tag as many pals as you’d like but your username will only count once in the giveaway! Good luck! 🍀