@avsm@amok.recoil.org reminds me of Turris's dynamic firewall (https://docs.turris.cz/basics/sentinel/dynfw/) and Razor2 antispam (https://notes.sagredo.eu/en/qmail-notes-185/razor2-pyzor-spamcop-and-dcc-setup-251.html). Would be interesting to see how distributed defense approaches could be integrated with an antibotty-like system. (The 2 examples I mention are still largely static once they get an update, but what if each host got a slightly different update, e.g. to A/B test defenses and evolve a better defense using a model)