23

New users who have less than 125 reputation are subject to a 40-minute time limit between asking questions, network-wide.

Today, however, this 1-rep user was able to post two questions within 8 minutes of each other, bypassing this rate limit: this one at 8:01:44, and this one at 8:09:43 today. (Both links are 10k-only.)

How was this user able to bypass the network-wide question asking rate limit? (I'd imagine one easy hack would be to exploit a race condition, but if that were the case, the two questions would be posted at exactly the same time, not 8 minutes later.)

Is it because the rate limit only considers the IP address, and not the account, so if the same account makes the post from a different IP address, it's allowed?

This is not a duplicate of How was this user able to ask four spam questions so quickly?, as back when that was asked, the rate limit worked quite differently, and wasn't even enabled on some sites; today, according to the very first link, it is now enabled network-wide.

Improve this question
8
  • 3
    this applies to all new users from a given IP it could be they switched their TOR exit node / VPN / ISP.
    – rene Mod
    Commented Aug 13, 2019 at 13:41
  • 9
    @rene well if it checks only IP and not account, it's really silly. But really. lol.
    – Shadow Wizard
    Commented Aug 13, 2019 at 13:44
  • 2
    Interesting; the message says I can't post another question for 20 minutes, not 40. It doesn't matter if I use the app or the website. Still, that's more than the 8 minutes in this example.
    – Glorfindel Mod
    Commented Aug 13, 2019 at 14:07
  • @Glorfindel 1 rep sock, I guess?
    – Shadow Wizard
    Commented Aug 13, 2019 at 14:14
  • 2
    @Glorfindel There were a handful of sites that, for whatever reason, had that specific check set to 20 minutes instead of 40 minutes (and Stack Apps was set to 60 minutes). Those overrides all got deleted yesterday.
    – animuson StaffMod
    Commented Aug 14, 2019 at 16:38
  • 1
    @animuson The 90-minute limit on Stack Overflow still exists, right? (It's worth noting that 20 minutes was the old limit, before it was later extended to 40 minutes.)
    – Sonic the Anonymous Hedgehog
    Commented Aug 14, 2019 at 16:47
  • 3
    Another case today: meta.stackexchange.com/q/332305/295232 and meta.stackexchange.com/q/332306/295232
    – Glorfindel Mod
    Commented Aug 16, 2019 at 10:54
  • @animuson ^^^ your comment reads like one can now expect 40 minutes limit to work but two examples referred in above comment were posted in less than 5 minutes, can you please elaborate?
    – gnat
    Commented Aug 16, 2019 at 11:21

1 Answer 1

Reset to default
10

Is it because the rate limit only considers the IP address, and not the account, so if the same account makes the post from a different IP address, it's allowed?

Yup!

Well, for this rate limit at least. There are others, although not all of them are enabled on this site.

Improve this answer
1
  • Is the 90-minute limit between questions on Stack Overflow also only per IP address, or does that also check the account?
    – Sonic the Anonymous Hedgehog
    Commented Jan 7, 2020 at 5:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .