我不知道这是否可行:……主动出击。

搞清楚机器人在扫描什么数据。给他们提供他们正在寻找的数据，当你不卖垃圾时。以一种不会打扰或迷惑人类用户的方式进行此操作。当机器人触发第二阶段时，他们将登录并填写表格，购买100美元的roomba，而不是BOC。当然，这是假设机器人不是特别健壮。

另一个想法是在促销期间随机降价。当你明确声明它只值20美元时，谁会花150美元买一袋垃圾?没有人，只有狂热的机器人。但9分钟后就变成了35美元…17分钟后是9美元。之类的。

当然，僵尸国王能够做出反应。关键是要让他们的错误变得非常昂贵(并让他们付钱给你来与他们战斗)。

所有这些都假设你想要惹恼一些机器人领主，这可能不是100%可取的。

您可以通过同时更新RSS和HTML来减少服务器上的负载，这样机器人就不会对您的站点进行屏幕抓取。当然，这给了机器人和购买你的装备的优势。

如果你只接受信用卡支付(可能是这样，也可能不是，但这显示了我的思路)，只允许用户每10次使用同一个账户和/或信用卡购买一次BOC。对一个脚本小子来说，搞到一大堆ip很容易，但搞到一大堆信用卡就不那么容易了。正如你所说的，ip很难被禁止，而暂时禁止信用卡应该是在公园里散步。

你可以让每个人都知道限制是什么，或者你可以告诉他们，因为高需求和/或机器人的兴趣，在不具体说明机制的情况下，对购买实施了限制。

在节流期间的每一次购买尝试都可能引发指数级的倒退——你买了一个BOC，在你再次尝试之前，你必须通过10次销售。不管怎样，你还是会在下一次促销时再次尝试，现在你不得不等待20次、40次、80次……

只有在人类用户不太可能在不到10次销售中获得两次BOC的情况下，这才真正有用。适当地调整数字。

首先，让我回顾一下我们需要做的事情。我意识到我只是在转述最初的问题，但重要的是我们要百分之百地理解这个问题，因为有很多很好的建议，4个中有2个或3个是正确的，但正如我将演示的那样，您将需要一个多方面的方法来满足所有的需求。

要求1:摆脱“机器人抨击”:

首页的快速“猛击”正在损害网站的性能，这是问题的核心。这种“猛击”既来自单ip机器人，也可能来自僵尸网络。我们想把两者都去掉。

要求二:不要破坏用户体验:

我们可以通过实施一个讨厌的验证程序来有效地解决机器人的情况，比如打电话给操作员，解决一堆验证码，或类似的问题，但这就像强迫每个无辜的飞机乘客跳过疯狂的安全圈，只是为了抓住最愚蠢的恐怖分子的渺茫机会。哦，等等，我们真的这么做了。但让我们看看在woot.com上能否做到这一点。

要求三:避免“军备竞赛”

正如您所提到的，您不希望卷入垃圾邮件机器人军备竞赛。因此，您不能使用隐藏或混乱的表单字段、数学问题等简单的调整，因为它们本质上是可以简单地自动检测和规避的模糊度量。

需求4:挫败“警报”机器人:

这可能是您的要求中最困难的。即使我们可以进行有效的人类验证挑战，机器人仍然可以在你的首页上投票，并在有新报价时提醒编剧。我们也想让那些机器人变得不可行。这是第一个需求的更强版本，因为机器人不仅不能发出破坏性能的快速请求——它们甚至不能发出足够多的重复请求来及时向脚本人员发送“警报”以赢得报价。

好，让我们看看是否能满足这四个条件。首先，正如我提到的，没有一种测量方法能达到目的。你将不得不结合一些技巧来实现它，你将不得不忍受两个烦恼:

少数用户将被要求经历重重考验 少数用户将无法获得特别优惠

我知道这些都很烦人，但如果我们能让“小”的数字足够小，我希望你会同意利大于弊。

第一个措施:基于用户的节流:

这个很简单，我相信你已经做过了。如果用户已登录，并保持每秒刷新600次(或其他)，您将停止响应并告诉他冷却。事实上，你可能会更早地限制他的请求，但你明白我的意思。这样，一个登录的机器人将被禁止/节流一旦它开始投票你的网站。这是简单的部分。那些未经验证的机器人才是我们真正的问题，下面就来谈谈它们:

第二个措施:某种形式的知识产权限制，正如几乎所有人都建议的那样:

No matter what, you will have to do some IP based throttling to thwart the 'bot slamming'. Since it seems important to you to allow unauthenticated (non-logged-in) visitors to get the special offers, you only have IPs to go by initially, and although they're not perfect, they do work against single-IP bots. Botnets are a different beast, but I'll come back to those. For now, we will do some simple throttling to beat rapid-fire single-IP bots. The performance hit is negligable if you run the IP check before all other processing, use a proxy server for the throttling logic, and store the IPs in a memcached lookup-optimized tree structure.

第三种方法:用缓存的响应掩盖油门:

With rapid-fire single-IP bots throttled, we still have to address slow single-IP bots, ie. bots that are specifically tweaked to 'fly under the radar' by spacing requests slightly further apart than the throttling prevents. To instantly render slow single-IP bots useless, simply use the strategy suggested by abelenky: serve 10-minute-old cached pages to all IPs that have been spotted in the last 24 hours (or so). That way, every IP gets one 'chance' per day/hour/week (depending on the period you choose), and there will be no visible annoyance to real users who are just hitting 'reload', except that they don't win the offer. The beauty of this measure is that is also thwarts 'alarm bots', as long as they don't originate from a botnet. (I know you would probably prefer it if real users were allowed to refresh over and over, but there is no way to tell a refresh-spamming human from a request-spamming bot apart without a CAPTCHA or similar)

第四项措施:

You are right that CAPTCHAs hurt the user experience and should be avoided. However, in _one_ situation they can be your best friend: If you've designed a very restrictive system to thwart bots, that - because of its restrictiveness - also catches a number of false positives; then a CAPTCHA served as a last resort will allow those real users who get caught to slip by your throttling (thus avoiding annoying DoS situations). The sweet spot, of course, is when ALL the bots get caught in your net, while extremely few real users get bothered by the CAPTCHA. If you, when serving up the 10-minute-old cached pages, also offer an alternative, optional, CAPTCHA-verified 'front page refresher', then humans who really want to keep refreshing, can still do so without getting the old cached page, but at the cost of having to solve a CAPTCHA for each refresh. That is an annoyance, but an optional one just for the die-hard users, who tend to be more forgiving because they know they're gaming the system to improve their chances, and that improved chances don't come free.

第五种方法:诱饵废话:

Christopher Mahan had an idea that I rather liked, but I would put a different spin on it. Every time you are preparing a new offer, prepare two other 'offers' as well, that no human would pick, like a 12mm wingnut for $20. When the offer appears on the front page, put all three 'offers' in the same picture, with numbers corresponding to each offer. When the user/bot actually goes on to order the item, they will have to pick (a radio button) which offer they want, and since most bots would merely be guessing, in two out of three cases, the bots would be buying worthless junk. Naturally, this doesn't address 'alarm bots', and there is a (slim) chance that someone could build a bot that was able to pick the correct item. However, the risk of accidentally buying junk should make scripters turn entirely from the fully automated bots.

第六项措施:僵尸网络节流:

(删除)

Okay............ I've now spent most of my evening thinking about this, trying different approaches.... global delays.... cookie-based tokens.. queued serving... 'stranger throttling'.... And it just doesn't work. It doesn't. I realized the main reason why you hadn't accepted any answer yet was that noone had proposed a way to thwart a distributed/zombie net/botnet attack.... so I really wanted to crack it. I believe I cracked the botnet problem for authentication in a different thread, so I had high hopes for your problem as well. But my approach doesn't translate to this. You only have IPs to go by, and a large enough botnet doesn't reveal itself in any analysis based on IP addresses.

所以你知道了，第六小节是零。没什么。邮政编码。除非僵尸网络很小，或者足够快，可以被通常的IP限制，否则我不认为有任何有效的措施可以对抗僵尸网络，而不涉及明确的人类验证，如CAPTHAs。我很抱歉，但我认为结合以上五种方法是你最好的选择。你可能只需要abelenky的10分钟缓存技巧就可以了。

这个问题的解决方案可能是在登录和购买操作中附加一些客户端处理。处理量可以忽略不计，因此个人不会受到影响，但多次尝试执行任务的机器人将受到额外工作负载的阻碍。

处理过程可以是一个用javascript解决的简单方程，除非你不想在你的网站上需要javascript。

我认为你最好的选择是关注即将到来的IP，但要从几个方面缓解你提到的问题。首先，使用概率散列(例如，Bloom Filter)来标记之前见过的IP。这类算法非常快，并且可以很好地扩展到绝对庞大的集合大小。其次，使用渐变响应，即服务器延迟添加到每个请求中，根据您“最近”看到该IP的次数来预测。

您可以尝试让脚本更难阅读价格。最简单的方法是将其转换为图像，但文本识别算法仍然可以解决这个问题。如果有足够多的脚本编写人员能够解决这个问题，您可以尝试对该图像应用类似验证码的东西，但显然是以牺牲用户体验为代价的。而不是图像，价格可以在一个flash应用程序。

或者，您可以尝试设计一种方法，以某种不影响呈现的方式在页面中“洗牌”HTML。我一时想不出一个好的例子，但我确信它在某种程度上是可行的。