Oh Dear
Oh Dear's weekly changelogs have carried a security section five weeks running.
Comparison · Infra & APIs
CrowdSec vs TestingBot
A side-by-side editorial comparison of CrowdSec and TestingBot — release velocity, themes, recent moves, and the top alternatives to consider.
CrowdSec vs TestingBot: at a glance
What is CrowdSec?
CrowdSec's 1.8.2 candidates let operators write their own bot fingerprints.
The bot detection introduced with 1.8 is now being opened to customization. The 1.8.2 candidates add custom JavaScript fingerprinting, a cscli bot subcommand and a FlagSubmission helper, and rc2 adds a RateLimit helper for the WAF plus a cookie option for embedded contexts. Operational work runs alongside it: a cs_features metric, optional limits on concurrent decision streams and TLS certificate reloads.
What is TestingBot?
TestingBot's autumn work is plumbing: a rebuilt tunnel and another bug-tracker link.
TestingBot runs a cross-browser and real-device cloud. October brought Tunnel v5, a rewrite of its local-testing tunnel with host allowlists, SSH host key checks, SOCKS5, Kerberos and PAC proxy support, self-contained builds without Java, and health endpoints with JSON logs. A Linear integration files bugs from manual sessions, and an iPhone Duo simulator lets teams test a foldable iPhone before Apple ships it. Vibium's agent-driven automation joined the grid in August and Mobilewright tests in October.
CrowdSec vs TestingBot: editorial side-by-side
CrowdSec
5.0INFRA · APIS
CrowdSec's 1.8.2 candidates let operators write their own bot fingerprints.
◆ Current state
The bot detection introduced with 1.8 is now being opened to customization. The 1.8.2 candidates add custom JavaScript fingerprinting, a cscli bot subcommand and a FlagSubmission helper, and rc2 adds a RateLimit helper for the WAF plus a cookie option for embedded contexts. Operational work runs alongside it: a cs_features metric, optional limits on concurrent decision streams and TLS certificate reloads.
◆ Where it's heading
The WAF remains the center of gravity, and the direction is programmability. RateLimit, SkipProcessing and the fingerprinting hooks give rule authors primitives rather than fixed behavior. The LAPI changes point at larger deployments, where decision streaming puts load on the central API.
◆ Prediction
The final 1.8.2 is dated 26 October on GitHub, though it has not reached this feed yet. Whether fingerprint data ever joins the community blocklist remains unanswered in these notes.
TestingBot
5.0INFRA · APIS
TestingBot's autumn work is plumbing: a rebuilt tunnel and another bug-tracker link.
◆ Current state
TestingBot runs a cross-browser and real-device cloud. October brought Tunnel v5, a rewrite of its local-testing tunnel with host allowlists, SSH host key checks, SOCKS5, Kerberos and PAC proxy support, self-contained builds without Java, and health endpoints with JSON logs. A Linear integration files bugs from manual sessions, and an iPhone Duo simulator lets teams test a foldable iPhone before Apple ships it. Vibium's agent-driven automation joined the grid in August and Mobilewright tests in October.
◆ Where it's heading
The summer made the platform fit for teams; the autumn makes it fit for corporate networks and CI. Tunnel v5 targets the place enterprise trials usually stall, behind proxies and security reviews, and its config-file and environment-variable setup suits pipelines and Docker. The integration list keeps growing one tracker at a time, while the device catalogue continues its usual rotation.
◆ Prediction
Expect further CI-oriented tunnel and reporting work, and more automation frameworks on the grid alongside Mobilewright and Vibium. The Vibium MCP path has had no follow-up in these entries.
Alternatives to CrowdSec and TestingBot
Other Infra & APIs products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either CrowdSec or TestingBot.
Apache ShenYu
ShenYu's AI gateway plugins are back in motion, with 2.7.2 candidate tags in October.
KubeArmor
KubeArmor ships fixes as release-candidate tags, and its feed misses the finals.
All Quiet
All Quiet moves from enterprise integrations to the on-call engineer's own day.
Robusta
Robusta's recent releases patch its runner image rather than add features.
Uptrends
Uptrends spent October on account plumbing: vault credentials, bulk edits and a free trial path.
See all CrowdSec alternatives → · See all TestingBot alternatives →
Recent activity from CrowdSec and TestingBot
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
- 10d agoCrowdSec1.8.2 rc2 adds a WAF RateLimit helper and decision stream limits
- 11d agoTestingBotLinear Integration
- 19d agoTestingBotNew TestingBot Tunnel 5.0
- 19d agoCrowdSec1.8.2 rc1 adds custom JS fingerprinting for bot detection
- 26d agoTestingBotMobilewright tests on the TestingBot device cloud
- 1mo agoTestingBotTest on the iPhone Duo simulator before it ships
- 2mo agoCrowdSec1.8 rc2 tunes the bot-detection challenge, hardens acquisition
- 2mo agoTestingBotVibium browser automation
- 2mo agoTestingBotSamsung Galaxy Tab S11 in the real device cloud
- 3mo agoCrowdSecCrowdSec 1.8 RC adds WAF bot detection and a Kubernetes datasource ⚡
- 6mo agoCrowdSec1.7.8 RC: OpenAPI schema validation in the WAF
- 7mo agoCrowdSec1.7.7 RC: flexible WAF rule conditions and RE2 by default
Frequently asked questions
What is the difference between CrowdSec and TestingBot?
They serve adjacent needs but don't currently overlap on shipped themes. CrowdSec and TestingBot are shipping at a similar cadence (velocity 5.0 vs 5.0, both within Sparkpulse's "active" band). See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Is CrowdSec better than TestingBot?
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. CrowdSec and TestingBot are shipping at a similar cadence (velocity 5.0 vs 5.0, both within Sparkpulse's "active" band). For your specific use case, the alternatives sections above list other Infra & APIs products to evaluate alongside.
What are the best alternatives to CrowdSec?
Top CrowdSec alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "CrowdSec alternatives" section above for the current picks, or visit /alternatives/crowdsec for the full list with editorial commentary on each.
What are the best alternatives to TestingBot?
Top TestingBot alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "TestingBot alternatives" section above for the current picks, or visit /alternatives/testingbot for the full list with editorial commentary on each.