[GNC] Excessive Quote Lookups

[Paul Kroitor]

Well, yes, that's certainly all true.

But there's still a difference between "someone somewhere's doing 10k 
requests per month" and "someone in Chicago with ISP xyz is doing 10k 
requests per month". The latter post would allow 99% of your users to 
immediately eliminate themselves.

One assumes that the main chance is that this is someone with a 
misconfigured set up, and in this scenario any of us would presumably 
want to be alerted so they could take corrective action. On the other 
hand, if it's malicious or just uncaring abuse, the problem would be 
harder to deal with.

Paul

PS: I do realize there's an http request log by default, and it's an 
interesting moral question about whether keeping such a log but never 
looking at it is or is not an invasion of privacy. But if you're not 
sure, a simple frequency histogram function (awk?) that went through the 
log and listed the top one or two users would presumably maintain one's 
moral high ground.


On 2026-09-14 1:41 p.m., Bruce Schuck wrote:
> On 9/14/26 10:03, Paul Kroitor wrote:
>
>
>> Sorry, I’m wrong.
>
>> Can’t your private web page be modified to report (only) IP addresses 
>> guilty of abusive use?
>
>> Then individual innocent users aren’t revealed.
>
> An IP address does not necessarily mean an individual user. And while 
> one can use arin.net, ripe.net, or apnic.net to identify the ISP that 
> an address is allotted to, it would pretty much take a warrant or 
> court order to connect that address to a particular street address.
>
>
> That still doesn't identify an individual user. Example,  I'm working 
> from a shared office location. There are a few hundred people from 
> different employers in this building. To web and application servers 
> on the internet, we all appear as the same handful of source addresses.
>
>
> Having the stats page only list those methods with huge numbers of 
> hits, is not the reason I am keeping track.