Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why are anime catgirls blocking my access to the Linux kernel?

lock.cmpxchg8b.com

Post reply on HN
Print view View original

511–520 of 968 posts

Re: Why are anime catgirls blocking my access to the Linux kernel?

#511

Post by kedihacker »

dijit wrote: post #471
mlyle wrote: post #379

Earlier quoted context omitted.

I don't trip over CloudFlare except when in a weird VPN, and then it always gets out of my way after the challenge. Anubis screws with me a lot, and often doesn't work.

The annoying thing about cloudflare is that most of the time once you’re blocked: you’re blocked. There’s literally no way for you to bypass the block if you’re affected. Its incredibly scary, I once had a bad useragent (without knowing it) and half the internet went offline, I couldn’t even access documentation or my email providers site, and there was no contact information or debugging information to help me resol…

Anubis checks proof of work so as long as JavaScript runs you will pass it.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#512

Post by palata »

chmod775 wrote: post #355
xlbuttplug2 wrote: post #340

Earlier quoted context omitted.

The internet would come to a grinding halt as everyone would suddenly become mindful of their browsing. It's not hard to imagine a situation where, say, pornhub sells its access data and the next day you get sacked at your teaching job.

It doesn't need to. Thanks to asymmetric cryptography governments can in theory provide you with a way to prove you are a human (or of a certain age) without: 1. the government knowing who you are authenticating yourself to 2. or the recipient learning anything but the fact that you are a human 3. or the recipient being able to link you to a previous session if you authenticate yourself again later The EU is trying t…

But I don't get how is goes for spam or scrapping: if I can pass the test "anonymously", then what prevents me from doing it for illegal purposes?

I get it for age verification: it is difficult for a child to get a token that says they are allowed to access porn because adults around them don't want them to access porn (and even though one could sell tokens online, it effectively makes it harder to access porn as a child).

But how does it prevent someone from using their ID to get tokens for their scrapper? If it's anonymous, then there is no risk in doing it, is there?

Re: Why are anime catgirls blocking my access to the Linux kernel?

#515

Post by necovek »

JimDabell wrote: post #507
necovek wrote: post #438

Earlier quoted context omitted.

But for actual live users who don't see anything but a transient screen, Anubis is a better experience than all those pesky CAPTCHAs (I am bored of trying to recognize bikes, pedestrian crossings, buses, hydrants). The question is if this is the sweet spot, and I can't find anyone doing the comparative study (how many annoyed human visitors, how many humans stopped and, obviously, how many bots stopped).

> Anubis is a better experience than all those pesky CAPTCHAs (I am bored of trying to recognize bikes, pedestrian crossings, buses, hydrants). Most CAPTCHAs are invisible these days, and Anubis is worse than them. Also, CAPTCHAs are not normally deployed just for visiting a site, they are mostly used when you want to submit something.

We are obviously living a different Internet reality, and that's the whole point — we need numbers to really establish baseline truth.

FTR, I am mostly browsing from Serbia using Firefox browser on a Linux or MacOS machine.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#516

Post by palata »

heavyset_go wrote: post #485
debugnik wrote: post #450

Earlier quoted context omitted.

You already provided proof of a living legal identity when you got the ID, and it already expires to make you provide proof again every few years.

That's not not the kind of proof of life the government and companies want online. They want to make sure their video identification 1) is of a living person right now , and 2) that living person matches their government ID. It's a solution to the "grandma died but we've been collecting her Social Security benefits anyway", or "my son stole my wallet with my ID & credit card", or (god forbid) "We incapacitated/killed…

> That's not not the kind of proof of life the government and companies want online.

Well that's your assumption about governments, but it doesn't have to be true. There are governments that don't try to exploit their people. The question is whether such governments can have technical solutions to achieve that or not (I'm genuinely interested in understanding whether or not it's technically feasible).

Re: Why are anime catgirls blocking my access to the Linux kernel?

#517

Post by rendx »

username332211 wrote: post #505
chrismorgan wrote: post #448

Earlier quoted context omitted.

> If that's true Anubis should just remove the proof-of-work part This is my very strong belief. To make it even clearer how absurd the present situation is, every single one of the proof-of-work systems I’ve looked at has been using SHA-256, which is basically the worst choice possible. Proof-of-work is bad rate limiting which depends on a level playing field between real users and attackers. This is already a doome…

All this is true, but also somewhat irrelevant. In reality the amount of actual hash work is completely negligible. For usability reasons Anubus only requires that you to go trough a the proof of work flow only once in a given period. (I think the default is once per week.) That's just very little work. Detecting you need to occasionally send a request trough a headless browser far more of a hassle than the PoW. If y…

> For usability reasons Anubus only requires that you to go trough a the proof of work flow only once in a given period. (I think the default is once per week.) That's just very little work.

If you keep cookies. I do not want to keep cookies for otherwise "stateless" sites. I have maybe a dozen sites whitelisted, every other site loses cookies when I close the tab.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#518

Post by akoboldfrying »

tptacek wrote: post #373
akoboldfrying wrote: post #364

Earlier quoted context omitted.

I'm saying your notion of "the same cost" is off. They pay the same total CPU cost, but that isn't the actual perceived cost in each case.

Can you flesh that out more? In the case of AI scrapers it seems especially clear: the model companies just want tokens, and are paying a (one-time) cost of C for N tokens. Again, with Hashcash, this isn't how it works: most outbound spam messages are worthless. The point of the system is to exploit the negative exponent on the attacker's value function.

Perhaps I caused confusion by writing "If botPain > botPainThreshold and humanPain currently ineffective against bots. (The article makes that point and I agree with it.) I'm arguing against what I take to be your stronger claim, namely that no "Anubis-like" countermeasure (meaning no countermeasure that charges each request the same amount of CPU in expectation) can work.

I claim that the cost for the two classes of user are meaningfully different: bots care exclusively about the total CPU usage, while humans care about some subjective combination of average and worst-case elapsed times on page loads. Because the sheer number of requests done by bots is so much higher, there's an opportunity to hurt them disproportionately according to their cost model by tweaking Anubis to increase the frequency of checks but decrease each check's elapsed time below the threshold of human annoyance.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#519

Post by palata »

Almondsetat wrote: post #440
cakealert wrote: post #358

Earlier quoted context omitted.

Such schemes have the fatal flaw that they can be trivially abused. All you need are a couple of stolen/sold identities and bots start proving their humanness and adultness to everyone.

Blatant automatic behavior can still be detected, and much more definitive actions can be takes in such a system

Detecting is a thing, but how do you identify the origin if it was done in a privacy-preserving manner? The whole point was that you couldn't, right?

Re: Why are anime catgirls blocking my access to the Linux kernel?

#520

Post by inejge »

binaryturtle wrote: post #464
mlyle wrote: post #379

Earlier quoted context omitted.

I don't trip over CloudFlare except when in a weird VPN, and then it always gets out of my way after the challenge. Anubis screws with me a lot, and often doesn't work.

I'm on an older system here, and both Cloudflare and Anubis entirely block me out of sites. Once you start blocking actual users out of your sites, it simply has gone too far. At least provide an alternative method to enter your site (e.g. via login) that's not hampered by erroneous human checks. Same for the captchas where you help train AIs by choosing out of a set of tiny/ noisy pictures. I often struggle for 5 to…

> Once you start blocking actual users out of your sites, it simply has gone too far.

It has, scrapers are out of control. Anubis and its ilk are a desperate measure, and some fallout is expected. And you don't get to dictate how a non-commercial site tries to avoid throttling and/or bandwidth overage bills.

Post reply on HN