Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FOSS infrastructure is under attack by AI companies

thelibre.news

Post reply on HN
Print view View original

511–520 of 631 posts

Re: FOSS infrastructure is under attack by AI companies

#511

Post by Aachen »

aspir wrote: post #440
structural wrote: post #401

Earlier quoted context omitted.

The underlying issue is that many sites aren't going to get feedback from the real people they've blocked, so their operators won't actually know that tuning is required (also, the more strict the system, the higher percentage of requests will be marked as bots, which might lead an operator to want things to be even more strict...)

I will say -- a higher-end bot detection service should provide paper trails on the block actions they take (this may not be available for freemium tiers, depending on the vendor). But to your point, the real kicker is the "many sites aren't going to get feedback from the real people they've blocked" since those tools inherently decided that the traffic was not human. You start getting into Westworld "doesn't look li…

I'm not into westworld so can't speak to the latter paragraph, but as for "high-end" vendors' paper trail: how do log files help uncover false blocks? Any vendor will be able to look up these request IDs printed on the blocking page, but how does it help?

You don't know if each entry in the log is a real customer until they buy products proportional to some fraction of their page load rate, or real people until they submit useful content or whatever your site is about. Many people just read information without contributing to the site itself and that's okay, too. A list of blocked systems won't help; I run a server myself, I see the legit-looking user agent strings doing hundreds of thousands of requests, crawling past every page in sequence, but if there wasn't this inhuman request pattern and I just saw this user agent and IP address and other metadata among a list of blocked access attempts, I'd have no clue if the ban is legit or not

With these protection services, you can't know how much frustration is hiding in that paper trail, so I'm not blocking anyone from my sites; I'm making the system stand up to crawling. You have to do that regardless for search engines and traffic spikes like from HN

Re: FOSS infrastructure is under attack by AI companies

#512

Post by myaccountonhn »

diggan wrote: post #402
myaccountonhn wrote: post #397

Earlier quoted context omitted.

There is nothing that says you can't charge money for FOSS software. FOSS is more about having the ability to inspect and freely change your software to your use-cases.

> There is nothing that says you can't charge money for FOSS software Well, yes and no. If you had a cost to access the source code, I'm pretty sure I'd stop calling that FOSS. If you only have a price for downloading binaries, sure, still FOSS, since we're talking source code licensing. > Nothing should be $$ free I took this statement at face value, and assumed parent argued for basically eliminating FOSS.

> Well, yes and no. If you had a cost to access the source code, I'm pretty sure I'd stop calling that FOSS

Even the FSF thinks you can charge money for free software and still call it FOSS: https://www.gnu.org/philosophy/selling.html.

Re: FOSS infrastructure is under attack by AI companies

#513

Post by biophysboy »

xena wrote: post #77
biophysboy wrote: post #62

Can someone with more experience developing AI tools explain what these bots are mostly doing? Are they collecting data for training, or are they for the more recent search functionality? Or are they enhancing responses with links?

AI expert here. It's probably for collecting training data and the crawlers are probably very unsupervised. I'd guess that they're literally the most simplistic crawler code you can imagine combined with parallelism across machines. The good news is that it's easy to disrupt these crawlers with some easy hacks. Tactical reverse slowloris is probably gonna make a comeback.

If its for training data, why are they straining FOSS so much? Is there thousands of actors repeatedly making training data all the time? I thought it was a sort of one-off thing w/ the big tech players.

Re: FOSS infrastructure is under attack by AI companies

#514

Post by Aachen »

999900000999 wrote: post #372
Aachen wrote: post #234

Earlier quoted context omitted.

I've been running into bot detection on at least five different websites in the past two months (not even including captcha walls) Not sure what to tell you but I surely feel quite human Three of the pages told me to contact customer support and the other two were a hard and useless block wall. Only from Codeberg did I get a useful response, the other two customer supports were the typical "have you tried clearing yo…

To be fair, >I'm Not a Robot (film) https://en.m.wikipedia.org/wiki/I%27m_Not_a_Robot_(film)

Oh my, a Dutch film that actually sounds good?! I get to watch a movie that's originally in my native language for perhaps the second time in my life, thanks for linking this :D

Edit: and it's on YouTube in full! Was wondering which streaming service I'd have to buy for this niche genre of Dutch sci-fi but that makes life easy: https://www.youtube.com/watch?v=4VrLQXR7mKU

Final update: well, that was certainly special. Favorite moment was 10:26–10:36 ^^. Don't think that comes fully across in the baked-in subtitles in English though. Overall it could have been an episode of Dark Mirror, just shorter. Thanks again for the tip :)

Re: FOSS infrastructure is under attack by AI companies

#515

Post by dalke »

QuadrupleA wrote: post #437
mrweasel wrote: post #120

Earlier quoted context omitted.

From reading Drew Devaults angry post from earlier this week, my take is that not only is it poorly implemented crawlers, it's also that it's cheaper to scrape, rather than keep copies on hand. Effectively these companies are outsourcing the storage of "their" training data to everyone on the internet. Ideally a site would get scraped once, and then the scraper would check if content has changed, e.g. etag, while als…

That seems crazy - millions of $ on GPUs but they can't afford some cheap storage? And direct network scraping seems super high latency. Although I guess a massive pretaining run might cycle through the corpus very slowly. Dunno, sounds fishy.

I see ChatGPT's bots pull down all of my Python wheels every couple of weeks.

Wheels that haven't changed in years, with a "Last-Modified" and "ETag" that haven't changed.

The only thing that makes sense to me is it's cheaper them to re-pull and re-analyze the data than to develop a cache.

Re: FOSS infrastructure is under attack by AI companies

#516

Post by devit »

Ndymium wrote: post #215

I was also under attack recently [0]. The little Forgejo instance where I host my code (of several open source packages so it needs to be open) was run into the ground and the disk was filled with generated zip archives. I'm not the only one who has suffered the same fate. For me, the attacks subsided (for now) when I banned Alibaba Cloud's IP range. If you are hosting a Forgejo instance, I strongly recommend setting…

Or perhaps switch to well-engineered software actually properly designed to be served on the public Internet.

Clearly generating zip files, writing them fully to disk and then sending them to the client all at once is a completely awful and unusable design, compared to the proper design of incrementally generating and transmitting them to the client with minimal memory consumption and no disk usage at all.

The fact that such an absurd design is present is a sign that most likely the developers completely disregarded efficiency when making the software, and it's thus probably full of similar catastrophic issues.

For example, from a cursory look at the Forgejo source code, it appears that it spawns "git" processes to perform all git operations rather than using a dedicated library and while I haven't checked, I wouldn't be surprised if those operations were extremely far from the most efficient way of performing a given operation.

It's not surprising that the CPU is pegged at 100% load and the server is unavailable when running such extremely poor software.

Re: FOSS infrastructure is under attack by AI companies

#517

Post by lousken »

I think both sides are partially at fault here.

LLM bots are doing a great job of stress testing infra, so if you are running abominations like Gitlab or any terribly coded site and you are exposing it to the internet, you are just asking for trouble. If anything, Gitlab should stop pumping bloat and focus on some performance, because it's really bad. I would hope FOSS projects would stick to something like Forgejo, although I am not sure of their CI/CD state. Though my guess is that they are 85% there with 1/10 of Gitlabs resources.

On the other side are of course badly coded bots that are aggressively trying to download everything. This was happening before LLMs and it just increased significantly because of them. I think we will reach a tipping point soon and then we will just assume those bots are just another malicious actor (like regular DDOS), and we will start actively taking them down, even with help of law enforcement.

Last thing I wanna see is 3 second bot challanges on every single site I visit, cookie banners are more than enough of a nightmare already.

Re: FOSS infrastructure is under attack by AI companies

#518

Post by ranger_danger »

xena wrote: post #187
diggan wrote: post #177

Earlier quoted context omitted.

Nice work :) One piece of feedback: Could you add some explanation (for humans) what we're supposed to do and what is happening when met by that page? I know there is a loading animation widget thingy, but the first time I saw that page (some weeks ago at the Gnome issue tracker), it was proof-of-work'ing for like 20 seconds, and I wasn't sure what was going on, I initially thought I got blocked or that the captcha f…

> One piece of feedback: Could you add some explanation (for humans) what we're supposed to do and what is happening when met by that page? Will do! https://github.com/TecharoHQ/anubis/issues/25

also if you're using JShelter, which blocks Worker by default, there is no indication that it's never going to work, and the spinner just goes on forever doing nothing

Re: FOSS infrastructure is under attack by AI companies

#520

Post by xena »

ranger_danger wrote: post #518
xena wrote: post #187

Earlier quoted context omitted.

> One piece of feedback: Could you add some explanation (for humans) what we're supposed to do and what is happening when met by that page? Will do! https://github.com/TecharoHQ/anubis/issues/25

also if you're using JShelter, which blocks Worker by default, there is no indication that it's never going to work, and the spinner just goes on forever doing nothing

Noted! I filed a bug: https://github.com/TecharoHQ/anubis/issues/38

All of this is placeholder wording, layouts, CSS, and more. It'll be fixed in time. This is teething pain that I will get through.

Post reply on HN