Build a Maze, Not a Wall

In June, a scanner found Bruce Ediger's server and started doing what scanners do: hunting for a .git/config file. It's a good thing to hunt for. Developers leak them all the time — commit a repo's guts to a public folder and you've handed over remote URLs, sometimes credentials, sometimes the keys to the whole account. Automated crawlers sweep the internet looking for exactly this, all day, every day. If you run anything with a public IP, one has already knocked.

The normal response is a wall. Block the path. Return a 403. Add the IP to a denylist, install fail2ban, tighten the firewall. Say no louder.

Ediger said yes.

His server handed the scanner a .git/config — a real-looking one, fully fabricated, generated on the spot by a PHP script he calls bork.php. Inside were remote URLs pointing at more paths on his own server. The scanner, being a scanner, followed them. Those paths returned more fabricated configs, pointing at more paths. And the machine kept going. And going. 654,278 times — the whole flood crammed into a few furious hours across those two days — each request costing Ediger a few milliseconds of random text, each one costing the attacker real compute, real bandwidth, real time, all spent mapping a maze with no center.

i · the wall is a losing trade

Here's the thing about walls: the math runs against you.

An attacker automates. You patch by hand. They fire 56 requests a second from a rented offshore server; you're the one waking up to log alerts. Every wall you build is a fixed cost you pay up front and maintain forever, and it only has to fail once. The whole posture is reactive — always one step behind the last technique, always spending energy in proportion to the attack.

Coherenceism has a name for the alternative: alignment over force. Don't push against the thing coming at you. Position yourself so its own momentum carries it where you want it to go. A wall meets force with force. A maze meets force with shape — and lets the force exhaust itself.

That's what bork.php is. Not a wall. A shape. The scanner's own logic — find a config, parse it, follow the URLs — became the leash. Ediger didn't lecture the crawler about ethics or try to out-muscle its automation. He changed the ground it walked on and let it walk. The more aggressive the crawler, the deeper it dug its own hole. Fifty-six requests a second stops being a threat and becomes the sound of an attacker doing your defending for you.

ii · the asymmetry flips

Look at who's spending what.

Building the wall: you audit paths, configure the firewall, tune fail2ban, watch it break when the attacker rotates IPs, do it again. Ongoing labor, and the attacker sets the pace.

Building the maze: Ediger wrote one PHP script. It generates gibberish. It will keep generating gibberish for every scanner that ever finds it, forever, at essentially zero marginal cost. He built it once; it defends indefinitely. Build once, use forever — the whole point of a permanent capability is that you pay for it a single time and it compounds while you sleep.

And the asymmetry doesn't just flip the cost, it flips who the cost lands on. A wall costs you energy proportional to the attack. A tarpit — a trap that holds instead of blocking — costs the attacker energy proportional to their own aggression. The harder they push, the more they lose. You've turned their strength into their tax.

There's intelligence in it too, for free. Everything hitting the maze is, by definition, something that shouldn't be there — so Ediger's logs became a clean signal of who's scanning, from where, with what tools. No false positives to sift; legitimate users don't crawl a fake .git/config at 56 requests a second. The defense and the sensor are the same object.

iii · know which problem you have

Now the part the enthusiasm skips.

A maze is not a fix for a real hole. If you actually committed your credentials to a public repo, bork.php does nothing — you still have to rotate the keys and stop doing that. Tarpits handle noise, not targets. They're brilliant against the dumb, tireless, automated flood that makes up most of what hits a server, and useless against a human who has decided to get into your specific thing. Don't confuse wasting a bot's afternoon with security.

The hygiene still matters: don't leak the config, patch the vuln, rotate the secret. The maze is what you build on top of a clean house, to make the endless knocking work for you instead of against you. Alignment over force is a posture for the flood. Force is still the answer for the breach.

iv · build one tomorrow

You don't need bork.php to use this.

The reusable move is the reframe: when something automated keeps hammering a thing you own, stop asking how do I block this? and start asking how do I let its own behavior carry it nowhere? That question has cheap answers at every scale.

The pattern already has tools. endlessh is an SSH tarpit — instead of refusing the thousands of bots probing port 22, it accepts the connection and sends an endless, byte-by-byte SSH banner, holding the bot open for hours while it waits for a handshake that never finishes. Same shape, different door: the scanner's own patience becomes the trap. Newer versions of the idea now point at AI scrapers — feeding crawlers infinite generated pages until they drown in content that costs nothing to produce and everything to consume.

Start smaller if you want. Point your known-bad paths — /wp-config.php, /.env, /.git/config — at an endpoint that responds slowly and returns generated garbage instead of a fast, clean 403. A 403 tells the scanner to move on efficiently. A slow trickle of plausible nonsense tells it to stay, and dig, and waste. You spend one afternoon; it defends every day after.

That's what it means to defend what you own. Not a higher wall — a better shape. Build the maze once, and let every attacker who finds it spend their two days doing your defending for you.