Live data from Hacker News

Show HN: I built an SDK that scrambles HTML so scrapers get garbage

obscrd.dev

11–20 of 46 posts

Re: Show HN: I built an SDK that scrambles HTML so scrapers get garbage

#11

    function decodeObscrd(htmlOrElement) {
      let root;
      if (typeof htmlOrElement === 'string') {
        root = new DOMParser().parseFromString(htmlOrElement, 'text/html').body;
      } else {
        root = htmlOrElement || document;
      }
    
      const container = root.querySelector('[class*="obscrd-"]');
      if (!container) { return; }
    
      const words = [...container.children].filter(el => el.hasAttribute('data-o'));
      words.sort((a, b) => +a.dataset.o - +b.dataset.o);
    
      const result = words.map(word => {
        const chars = [...word.querySelectorAll('[data-o]')]
          .filter(el => el.querySelector('[data-o]') === null);
        chars.sort((a, b) => +a.dataset.o - +b.dataset.o);
        return chars.map(c => c.textContent).join('');
      }).join('');
    
      console.log(result);
      return result;
    }

Re: Show HN: I built an SDK that scrambles HTML so scrapers get garbage

#13

You break highlighting and copy-and-paste. If I want to share or comment on a piece of your website... I can't. I guess this can be a "feature" in some rare cases, but a major usability pain otherwise. I'm not a fan of all the documentation and marketing content for this project evidently being AI-generated because I don't know which parts of it are the things you believe and designed for, and which are just LLM verb…

Copy-paste breaking is intentional for protected content but it's opt-in per component, not whole-site.

On the AI docs concern, fair point. To answer directly: I've confirmed the obfuscation defeats any scraper reading raw HTML via HTTP requests. Whether GPTBot or ClaudeBot use headless browsers internally, I honestly don't know. The README threat model lists headless browsers under "what it does NOT stop" for that reason.

Re: Show HN: I built an SDK that scrambles HTML so scrapers get garbage

#15

function decodeObscrd(htmlOrElement) { let root; if (typeof htmlOrElement === 'string') { root = new DOMParser().parseFromString(htmlOrElement, 'text/html').body; } else { root = htmlOrElement || document; } const container = root.querySelector('[class*="obscrd-"]'); if (!container) { return; } const words = [...container.children].filter(el => el.hasAttribute('data-o')); words.sort((a, b) => +a.dataset.o - +b.datase…

Yep, that works. The data-o attributes are readable in the DOM so you can reverse it with custom code. That's in the threat model. The goal is raising the cost from "curl + cheerio" to "write a custom decoder per site." Most scrapers move on to easier targets.

Re: Show HN: I built an SDK that scrambles HTML so scrapers get garbage

#16
post #9

Another thing you can do is to install a font with jumbled characters: "a" looks like "x", "b" looks like "n", and so on. Then instead of writing "abc" you write "jmw" and it looks like "abc" on the screen. This has been used as a form of DRM for eBooks. It breaks copy/paste and screen readers, but so does your idea.

Font remapping is actually on the v2 roadmap. The reason v1 uses CSS ordering instead is it preserves screen reader access. Tradeoff is it's reversible (as another commenter just showed). Font remapping is stronger but breaks assistive tech. Solving both is the hard problem.

Re: Show HN: I built an SDK that scrambles HTML so scrapers get garbage

#18
post #4

This is also what Facebook does. Same result: screen readers and assistive software is rendered useless. Basically is a sign of "I hate disabled people, and AI too"

Fair concern. obscrd actually preserves screen reader access. CSS flexbox order is a visual reordering property, so assistive tech follows the visual order and reads the text correctly. Contact components use sr-only spans with clean text and aria-hidden on the obfuscated layer. We target WCAG 2.2 AA compliance. Happy to have a11y experts poke at it and point out gaps.

Accessibility APIs have long been the royal road to automation. If scrapers were well-written they'd be using this already, but of course if scrapers were well-written they would scrape your site and you'd never notice.
Post reply on HN