Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why are anime catgirls blocking my access to the Linux kernel?

lock.cmpxchg8b.com

Post reply on HN
Print view View original

331–340 of 968 posts

Re: Why are anime catgirls blocking my access to the Linux kernel?

#331

Post by userbinator »

As I've been saying for a while now - if you want to filter for only humans, ask questions only a human can easily answer; counting the number of letters in a word seems to be a good way to filter out LLMs, for example. Yes, that can be relatively easily gotten around, just like Anubis, but with the benefit that it doesn't filter out humans and has absolutely minimal system requirements (a browser that can submit HTML forms), possibly even less than the site itself.

There are forums which ask domain-specific questions as a CAPTCHA upon attempting to register an account, and as someone who has employed such a method, it is very effective. (Example: what nominal diameter is the intake valve stem on a 1954 Buick Nailhead?)

Re: Why are anime catgirls blocking my access to the Linux kernel?

#332

Post by tern »

marcus_holmes wrote: post #321
overfeed wrote: post #298

Earlier quoted context omitted.

> The bots will eventually be indistinguishable from humans Not until they get issued government IDs they won't! Extrapolating from current trends, some form of online ID attestation (likely based on government-issued ID[1]) will become normal in the next decade, and naturally, this will be included in the anti-bot arsenal. It will be up to the site operator to trust identities signed by the Russian government. 1. De…

How does this work, though? We can't just have "send me a picture of your ID" because that is pointlessly easy to spoof - just copy someone else's ID. So there must be some verification that you, the person at the keyboard, is the same person as that ID identifies. The UK is rapidly finding out that that is extremely difficult to do reliably. Video doesn't really work reliably on all cases, and still images are too e…

If you're really curious about this, there's a place where people discuss these problems annually: https://internetidentityworkshop.com/

Various things you're not thinking of:

- "The person at the keyboard, is the same person as that ID identifies" is a high expectation, and can probably be avoided—you just need verifiable credentials and you gotta trust they're not spoofed

- Many official government IDs are digital now

- Most architectures for solving this problem involve bundling multiple identity "attestations," so proof of personhood would ultimately be a gradient. (This does, admittedly, seem complicated though ... but World is already doing it, and there are many examples of services where providing additional information confers additional trust. Blue checkmarks to name the most obvious one.)

As for what it might look like to start from the ground up and solve this problem, https://urbit.org/, for all its flaws, is the only serious attempt I know of and proves it's possible in principle, though perhaps not in practice

Re: Why are anime catgirls blocking my access to the Linux kernel?

#333

Post by tptacek »

seba_dos1 wrote: post #322
tptacek wrote: post #279

Earlier quoted context omitted.

Respectfully, I think it's you missing the point here. None of this is to say you shouldn't use Anubis, but Tavis Ormandy is offering a computer science critique of how it purports to function. You don't have to care about computer science in this instance! But you can't dismiss it because it's computer science. Consider: An adaptive password hash like bcrypt or Argon2 uses a work function to apply asymmetric costs t…

> The term of art for these systems is "content protection", which is what I think Anubis actually wants to be, but really isn't (yet?). No, that's missing the point. Anubis is effectively a DDoS protection system, all the talking about AI bots comes from the fact that the latest wave of DDoS attacks was initiated by AI scrapers, whether intentionally or not. If these bots would clone git repos instead of unleashing…

I'm not moralizing, I'm talking about whether it can work. If it's your site, you don't need to justify putting anything in front of it.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#334

Post by tptacek »

akoboldfrying wrote: post #312
tptacek wrote: post #279

Earlier quoted context omitted.

Respectfully, I think it's you missing the point here. None of this is to say you shouldn't use Anubis, but Tavis Ormandy is offering a computer science critique of how it purports to function. You don't have to care about computer science in this instance! But you can't dismiss it because it's computer science. Consider: An adaptive password hash like bcrypt or Argon2 uses a work function to apply asymmetric costs t…

The (almost only?) distinguishing factor between genuine users and bots is the total volume of requests, but this can still be used for asymmetric costs. If botPain > botPainThreshold and humanPain botPain = nBotRequests * cpuWorkPerRequest * dollarsPerCpuSecond humanPain = c_1 * max(elapsedTimePerRequest) + c_2 * avg(elapsedTimePerRequest) The article points out that the botPain Anubis currently generates is unfortu…

That's exactly what I'm saying isn't happening: the user pays some cost C per article, and the bot pays exactly the same cost C. Both obtain the same reward. That's not how Hashcash works.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#335

Post by xlbuttplug2 »

marcus_holmes wrote: post #321
overfeed wrote: post #298

Earlier quoted context omitted.

> The bots will eventually be indistinguishable from humans Not until they get issued government IDs they won't! Extrapolating from current trends, some form of online ID attestation (likely based on government-issued ID[1]) will become normal in the next decade, and naturally, this will be included in the anti-bot arsenal. It will be up to the site operator to trust identities signed by the Russian government. 1. De…

How does this work, though? We can't just have "send me a picture of your ID" because that is pointlessly easy to spoof - just copy someone else's ID. So there must be some verification that you, the person at the keyboard, is the same person as that ID identifies. The UK is rapidly finding out that that is extremely difficult to do reliably. Video doesn't really work reliably on all cases, and still images are too e…

IDs would have to be reissued with a public/private key model you can use to sign your requests.

> the person at the keyboard, is the same person as that ID identifies

This won't be possible to verify - you could lend your ID out to bots but that would come at the risk of being detected and blanket banned from the internet.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#336

Post by seba_dos1 »

tptacek wrote: post #333
seba_dos1 wrote: post #322

Earlier quoted context omitted.

> The term of art for these systems is "content protection", which is what I think Anubis actually wants to be, but really isn't (yet?). No, that's missing the point. Anubis is effectively a DDoS protection system, all the talking about AI bots comes from the fact that the latest wave of DDoS attacks was initiated by AI scrapers, whether intentionally or not. If these bots would clone git repos instead of unleashing…

I'm not moralizing, I'm talking about whether it can work. If it's your site, you don't need to justify putting anything in front of it.

Did you accidentally reply to a wrong comment? (not trying to be snarky, just confused)

The only "justification" there would be is that it keeps the server online that struggled under load before deploying it. That's the whole reason why major FLOSS projects and code forges have deployed Anubis. Nobody cares about bots downloading FLOSS code or kernel mailing lists archives; they care about keeping their infrastructure running and whether it's being DDoSed or not.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#338

Post by kaszanka »

agwa wrote: post #315
johnklos wrote: post #244

This is a usually technical crowd, so I can't help but wonder if many people genuinely don't get it, or if they are just feigning a lack of understanding to be dismissive of Anubis. Sure, the people who make the AI scraper bots are going to figure out how to actually do the work. The point is that they hadn't, and this worked for quite a while. As the botmakers circumvent, new methods of proof-of-notbot will be made…

It sounds like you're saying that it's not the proof-of-work that's stopping AI scrapers, but the fact that Anubis imposes an unusual flow to load the site. If that's true Anubis should just remove the proof-of-work part, so legitimate human visitors don't have to stare at a loading screen for several seconds while their device wastes electricity.

This is basically what most of the challenge types in go-away (https://git.gammaspectra.live/git/go-away/wiki/Challenges) do.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#339

Post by amarant »

agwa wrote: post #315
johnklos wrote: post #244

This is a usually technical crowd, so I can't help but wonder if many people genuinely don't get it, or if they are just feigning a lack of understanding to be dismissive of Anubis. Sure, the people who make the AI scraper bots are going to figure out how to actually do the work. The point is that they hadn't, and this worked for quite a while. As the botmakers circumvent, new methods of proof-of-notbot will be made…

It sounds like you're saying that it's not the proof-of-work that's stopping AI scrapers, but the fact that Anubis imposes an unusual flow to load the site. If that's true Anubis should just remove the proof-of-work part, so legitimate human visitors don't have to stare at a loading screen for several seconds while their device wastes electricity.

I feel like the future will have this, plus ads displayed while the work is done, so websites can profit while they profit.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#340

Post by xlbuttplug2 »

overfeed wrote: post #298
cakealert wrote: post #276

Earlier quoted context omitted.

This arms race will have a terminus. The bots will eventually be indistinguishable from humans. Some already are.

> The bots will eventually be indistinguishable from humans Not until they get issued government IDs they won't! Extrapolating from current trends, some form of online ID attestation (likely based on government-issued ID[1]) will become normal in the next decade, and naturally, this will be included in the anti-bot arsenal. It will be up to the site operator to trust identities signed by the Russian government. 1. De…

The internet would come to a grinding halt as everyone would suddenly become mindful of their browsing. It's not hard to imagine a situation where, say, pornhub sells its access data and the next day you get sacked at your teaching job.
Post reply on HN