Browsing ain't fun anymore
-
I am skeptical about the real level of protection that Anubis really provides.
At the end is an automated test. Meaning that any machine could easily solve it.
Most "attackers" wont bother solving it because they don't really care. But if they would want they could. It's sort of protection by obscurity.
The more Anubis it's used the more we see attacks that actually equip a way to solve the challenges. Then is when Anubis up the challenge and the battle begin, between how much can Anubis up the challenge so normal users can still browse and how much cost the attacker is willing to eat.
Giving that these attackers tend to have high budgets I'm not that certain about its actual capabilities to reject a targeted ddos.
As for crawling for big data. I do think that it does nothing here. Companies willing yo scrape big amounts of data, for AI training or other purposes, have massive budgets and the electricity cost of solving the JavaScript challenges become nothing in comparison. They also doesn't need ro deny the service so they could spread the scrape to keep the challenge low reducing the cost even more.
Once again, positive results we currently see in practice I believe that are caused just because most scrappers and ddos attackers are just blindly attacking and doesn't really equip themselves for Anubis. Protection by obscurity. But a well equiped attacker I don't think it would have that much trouble getting past it, specially for scrapping, or other type of bot attacks that could be slowed down.
You're right, although my understanding is that there are a lot of poorly implemented scrapers for AI services unintentionally DDoSing websites with requests, so Anubis is more of a mitigation against those.
-
(Not so) fun fact: The Anubis image is itself AI slop
https://github.com/TecharoHQ/anubis/commit/3e9a93f629e9c5a69bd7fcd6613d27ce9f5231f9
funner fact: anubis itself is slop
-
This post did not contain any content.
Much better than cludflare and Google recapha
-
You're right, although my understanding is that there are a lot of poorly implemented scrapers for AI services unintentionally DDoSing websites with requests, so Anubis is more of a mitigation against those.
Yeah, seems like the problem is that fundamentally it could work by upping the difficulty a smidge making it then meaningfully expensive, but the spread between slowest edge device and high end means it's impossible to chase that difficulty without screwing over low end device users..
-
https://anubis.techaro.lol/docs/admin/configuration/challenges/metarefresh/
Apparently it just tells your browser to refresh after x seconds.
Seems utterly pointless though...
With the proof of work approach, at least it's demanding the client consume some resources, though the 'right' amount is a tricky question, either it's so trivial as to hardly matter to the scrapers, or it's hard enough to put a dent in the scrapers' build, but human operated low end devices are royally screwed..
Here the crawler simply schedules a resumption and moves on to other work. The crawler doesn't need it right now and it's free for it to wait.
-
This post did not contain any content.
your blog does not need an anime girl web ai firewall utility
-
I had a captcha a few days ago that was something like "click on all the pictures that go with this" with a picture of a saucepan and the grid was food items and other things.
I pointed my phone at it and asked Gemini and almost instantly it said "the potato in the top left and the carrots look the middle of the bottom row".
While I despise the captchas from a human perspective, the fact that an LLM can solve the challenge isn't a deal breaker. It doesn't need to be impossible for a non-human to solve, it just has to be too expensive.
It does certainly shift the equation to stuff like proof of work since a computer can solve it anyway, might as well not annoy the human.
-
your blog does not need an anime girl web ai firewall utility
Watch out, you'll anger the hive mind.
-
This post did not contain any content.
If you're going to increase my compute to access your site, at least give me a crypto token that may or may not be worth anything
-
your blog does not need an anime girl web ai firewall utility
Unfortunately, yes it does. Unless I want it to collapse regularly.
-
Spot on. There were some complaints recently made by people being afraid to be seen as a furry because she has ears and a tail. It's hilarious
Oh man. Those people are so gd cringe it IS hilarious.
-
This post did not contain any content.
Looks way better than half the ads I normally see.
-
your blog does not need an anime girl web ai firewall utility
it kinda does when the web is being scraped by bots to fuel the LLMs
-
I am skeptical about the real level of protection that Anubis really provides.
At the end is an automated test. Meaning that any machine could easily solve it.
Most "attackers" wont bother solving it because they don't really care. But if they would want they could. It's sort of protection by obscurity.
The more Anubis it's used the more we see attacks that actually equip a way to solve the challenges. Then is when Anubis up the challenge and the battle begin, between how much can Anubis up the challenge so normal users can still browse and how much cost the attacker is willing to eat.
Giving that these attackers tend to have high budgets I'm not that certain about its actual capabilities to reject a targeted ddos.
As for crawling for big data. I do think that it does nothing here. Companies willing yo scrape big amounts of data, for AI training or other purposes, have massive budgets and the electricity cost of solving the JavaScript challenges become nothing in comparison. They also doesn't need ro deny the service so they could spread the scrape to keep the challenge low reducing the cost even more.
Once again, positive results we currently see in practice I believe that are caused just because most scrappers and ddos attackers are just blindly attacking and doesn't really equip themselves for Anubis. Protection by obscurity. But a well equiped attacker I don't think it would have that much trouble getting past it, specially for scrapping, or other type of bot attacks that could be slowed down.
-
(Not so) fun fact: The Anubis image is itself AI slop
https://github.com/TecharoHQ/anubis/commit/3e9a93f629e9c5a69bd7fcd6613d27ce9f5231f9
The repo credits a real artist for the anubis image
https://github.com/TecharoHQ/anubis/blob/main/web/static/img/ATTRIBUTIONS.txt
-
Anubis is open source, self-hosted, doesn't block me just because I use a VPN and the later versions work even with JavaScript disabled!
Fuck Cloudflare, long live Anubis!
Cloudflare is great compared to Recaptcha.
Anubis is the best by far.
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Εγγραφή Σύνδεση