21

New users who have less than 125 reputation are subject to a 40-minute time limit between asking questions, network-wide.

Today, however, this 1-rep user was able to post two questions within 8 minutes of each other, bypassing this rate limit: this one at 8:01:44, and this one at 8:09:43 today. (Both links are 10k-only.)

How was this user able to bypass the network-wide question asking rate limit? (I'd imagine one easy hack would be to exploit a race condition, but if that were the case, the two questions would be posted at exactly the same time, not 8 minutes later.)

Is it because the rate limit only considers the IP address, and not the account, so if the same account makes the post from a different IP address, it's allowed?

This is not a duplicate of How was this user able to ask four spam questions so quickly?, as back when that was asked, the rate limit worked quite differently, and wasn't even enabled on some sites; today, according to the very first link, it is now enabled network-wide.

  • 3
    this applies to all new users from a given IP it could be they switched their TOR exit node / VPN / ISP. – rene Aug 13 '19 at 13:41
  • 8
    @rene well if it checks only IP and not account, it's really silly. But really. lol. – Shadow Wizard Wearing Mask Aug 13 '19 at 13:44
  • 2
    Interesting; the message says I can't post another question for 20 minutes, not 40. It doesn't matter if I use the app or the website. Still, that's more than the 8 minutes in this example. – Glorfindel Aug 13 '19 at 14:07
  • @Glorfindel 1 rep sock, I guess? – Shadow Wizard Wearing Mask Aug 13 '19 at 14:14
  • 2
    @Glorfindel There were a handful of sites that, for whatever reason, had that specific check set to 20 minutes instead of 40 minutes (and Stack Apps was set to 60 minutes). Those overrides all got deleted yesterday. – animuson Aug 14 '19 at 16:38
  • 1
    @animuson The 90-minute limit on Stack Overflow still exists, right? (It's worth noting that 20 minutes was the old limit, before it was later extended to 40 minutes.) – Sonic the Masked Werehog Aug 14 '19 at 16:47
  • 3
  • @animuson ^^^ your comment reads like one can now expect 40 minutes limit to work but two examples referred in above comment were posted in less than 5 minutes, can you please elaborate? – gnat Aug 16 '19 at 11:21
7

Is it because the rate limit only considers the IP address, and not the account, so if the same account makes the post from a different IP address, it's allowed?

Yup!

Well, for this rate limit at least. There are others, although not all of them are enabled on this site.

| improve this answer | |
  • Is the 90-minute limit between questions on Stack Overflow also only per IP address, or does that also check the account? – Sonic the Masked Werehog Jan 7 at 5:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .