Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why are anime catgirls blocking my access to the Linux kernel?

lock.cmpxchg8b.com

Post reply on HN
Print view View original

521–530 of 968 posts

Re: Why are anime catgirls blocking my access to the Linux kernel?

#521

Post by gambiting »

marcus_holmes wrote: post #321
overfeed wrote: post #298

Earlier quoted context omitted.

> The bots will eventually be indistinguishable from humans Not until they get issued government IDs they won't! Extrapolating from current trends, some form of online ID attestation (likely based on government-issued ID[1]) will become normal in the next decade, and naturally, this will be included in the anti-bot arsenal. It will be up to the site operator to trust identities signed by the Russian government. 1. De…

How does this work, though? We can't just have "send me a picture of your ID" because that is pointlessly easy to spoof - just copy someone else's ID. So there must be some verification that you, the person at the keyboard, is the same person as that ID identifies. The UK is rapidly finding out that that is extremely difficult to do reliably. Video doesn't really work reliably on all cases, and still images are too e…

UK is stupidly far behind on this though. On one hand the digitization of government services is really well done(thanks to the fantastic team behind .gov websites), but on the other it's like being in the dark ages of tech. My native country has physical ID cards that contain my personal certificate that I can use to sign things or to - gasp! - prove that I am who I say I am. There is a government app that you can use to scan your ID card using the NFC chip in your phone, after providing it with a password that you set when you got the card it produces a token that can then be used to verify your identy or sign documents digitally - and those signatures legally have the same weight as real paper signatures.

UK is in this weird place where there isn't one kind of ID that everyone has - for most people it's the driving licence, but obviously that's not good enough. But my general point is that UK could just look over at how other countries are doing it and copy good solutions to this problem, instead of whatever nonsense is being done right now with the age verification process being entirely outsourced to private companies.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#522

Post by Imustaskforhelp »

starkparker wrote: post #227
Imustaskforhelp wrote: post #111

Earlier quoted context omitted.

https://sourcehut.org/blog/2025-04-15-you-cannot-have-our-us... > As you may have noticed, SourceHut has deployed Anubis to parts of our services to protect ourselves from aggressive LLM crawlers. Its nice that sourcehut themselves have talked about it on their own blog but I had discovered this through the anubis website themselves showcases or soemthing like that iirc.

https://sourcehut.org/blog/2025-05-29-whats-cooking-q2/ > A few weeks after this blog post, I moved us from Anubis to go-away, which is more configurable and allows us to reduce the user impact of Anubis (e.g. by offering challenges that don’t require JavaScript, or support text-mode browsers better). We have rolled this out on several services now, and unfortunately I think they’re going to remain necessary for a wh…

Oh sorry, Didn't know about the fact that you started using go away after anubis, my bad.

But if I remember correctly, when you were using anubis, you had changed the logo of the anime catgirl to something related to sourcehut/ its logo right?

Re: Why are anime catgirls blocking my access to the Linux kernel?

#523

Post by palata »

overfeed wrote: post #382
ummonk wrote: post #357

Earlier quoted context omitted.

How would it prevent you from renting your identity out to a bot farm?

Besides making yourself party to a criminal conspiracy, I suspect it would be partly the same reason you won't sell/rent your real-world identity to other people today; an illegal immigrant may be willing to rent it from you right now. Mostly, it will because online identifies will be a market for lemons: there will be so many fake/expired/revoked identities being sold that the value of each one will be worth pennies…

> the same reason you won't sell/rent your real-world identity to other people today

If you sell your real-world identity to other people today, and they get arrested, then the police will know your identity (obviously). How does that work with a privacy-preserving scheme? If you sell your anonymous token that says that you are a human to a machine and the machine gets arrested, then the police won't be able to know who you are, right? That was the whole point of the privacy-preserving token.

I'm genuinely interested, I don't understand how it can work technically and be privacy-preserving.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#524

Post by Dilettante_ »

dijit wrote: post #471
mlyle wrote: post #379

Earlier quoted context omitted.

I don't trip over CloudFlare except when in a weird VPN, and then it always gets out of my way after the challenge. Anubis screws with me a lot, and often doesn't work.

The annoying thing about cloudflare is that most of the time once you’re blocked: you’re blocked. There’s literally no way for you to bypass the block if you’re affected. Its incredibly scary, I once had a bad useragent (without knowing it) and half the internet went offline, I couldn’t even access documentation or my email providers site, and there was no contact information or debugging information to help me resol…

A "digital no-fly-list" is hella cyberpunk, though.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#525

Post by palata »

kjkjadksj wrote: post #417
cakealert wrote: post #276

Earlier quoted context omitted.

This arms race will have a terminus. The bots will eventually be indistinguishable from humans. Some already are.

Maybe there will be a way to certify humanness. Human testing facility could be a local office you walk over to get your “I am a human” hardware key. Maybe it expires after a week or so to ensure that you are still alive.

But if that hardware key is privacy-preserving (i.e. websites don't get your identity when you use it), what prevents you from using it for your illegal activity? Scrapers and spam are built by humans, who could get such a hardware key.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#526

Post by landhar »

tptacek wrote: post #279
johnklos wrote: post #244

This is a usually technical crowd, so I can't help but wonder if many people genuinely don't get it, or if they are just feigning a lack of understanding to be dismissive of Anubis. Sure, the people who make the AI scraper bots are going to figure out how to actually do the work. The point is that they hadn't, and this worked for quite a while. As the botmakers circumvent, new methods of proof-of-notbot will be made…

Respectfully, I think it's you missing the point here. None of this is to say you shouldn't use Anubis, but Tavis Ormandy is offering a computer science critique of how it purports to function. You don't have to care about computer science in this instance! But you can't dismiss it because it's computer science. Consider: An adaptive password hash like bcrypt or Argon2 uses a work function to apply asymmetric costs t…

> But here we're talking about a system where legitimate users (human browsers) and scrapers get the same value for every application of the work function. The cost:value ratio is unchanged; it's just that everything is more expensive for everybody. You're getting the worst of both worlds: user-visible costs and a system that favors large centralized well-capitalized clients.

Based on my own experience fighting these AI scrappers, I feel that the way they are actually implemented makes it that in practice there is asymmetry in the work scrappers have to do vs humans.

The pattern these scrappers follow is that they are highly distributed. I’ll see a given {ip, UA} pair make a request to /foo immediately followed by _hundreds_ of requests from completely different {ip, UA} pairs to all the links from that page (ie: /foo/a, /foo/b, /foo/c, etc..).

This is a big part of what makes these AI crawlers such a challenge for us admins. There isn’t a whole lot we can do to apply regular rate limiting techniques: the IPs are always changing and are no longer limited to corporate ASN (I’m now seeing IPs belonging to consumer ISPs and even cell phone companies), and the User Agents all look genuine. But when looking through the logs you can see the pattern that all these unrelated requests are actually working together to perform a BFS traversal of your site.

Given this pattern, I believe that’s what makes the Anubis approach actually work well in practice. For a given user, they will encounter the challenge once when accessing the site the first time, then they’ll be able to navigate through it without incurring any cost. While the AI scrappers would need to solve the challenge for every single one of their “nodes” (or whatever it is they would call their {ip, UA} pairs). From a site reliability perspective, I don’t even care if the crawlers manage to solve the challenge or not. That it manages to slow them down enough to rate limit them as a network is enough.

To be clear: I don’t disagree with you that the cost incurred by regular human users is still high. But I don’t think it’s fair to say that this is not a situation in which the cost to the adversary is not asymmetrical. It wouldn’t be if the AI crawlers hadn’t converged towards an implementation that behaves as a DDOS botnet.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#527

Post by JimDabell »

overfeed wrote: post #298
cakealert wrote: post #276

Earlier quoted context omitted.

This arms race will have a terminus. The bots will eventually be indistinguishable from humans. Some already are.

> The bots will eventually be indistinguishable from humans Not until they get issued government IDs they won't! Extrapolating from current trends, some form of online ID attestation (likely based on government-issued ID[1]) will become normal in the next decade, and naturally, this will be included in the anti-bot arsenal. It will be up to the site operator to trust identities signed by the Russian government. 1. De…

> some form of online ID attestation (likely based on government-issued ID[1]) will become normal in the next decade

I believe this is likely, and implemented in the right way, I think it will be a good thing.

A zero-knowledge way of attesting persistent pseudonymous identity would solve a lot of problems. If the government doesn’t know who you are attesting to, the service doesn’t know your real identity, services can’t correlate users, and a service always sees the same identity, then this is about as privacy-preserving as you can get with huge upside.

A social media site can ban an abusive user without them being able to simply register a new account. One person cannot operate tens of thousands of bot profiles. Crawlers can be banned once. Spammers can be locked out of email.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#529

Post by JimDabell »

necovek wrote: post #515
JimDabell wrote: post #507

Earlier quoted context omitted.

> Anubis is a better experience than all those pesky CAPTCHAs (I am bored of trying to recognize bikes, pedestrian crossings, buses, hydrants). Most CAPTCHAs are invisible these days, and Anubis is worse than them. Also, CAPTCHAs are not normally deployed just for visiting a site, they are mostly used when you want to submit something.

We are obviously living a different Internet reality, and that's the whole point — we need numbers to really establish baseline truth. FTR, I am mostly browsing from Serbia using Firefox browser on a Linux or MacOS machine.

I don’t think we are living in a different reality, I just don’t think you are accounting for all the CAPTCHAs you successfully pass without seeing.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#530

Post by zorked »

dijit wrote: post #471
mlyle wrote: post #379

Earlier quoted context omitted.

I don't trip over CloudFlare except when in a weird VPN, and then it always gets out of my way after the challenge. Anubis screws with me a lot, and often doesn't work.

The annoying thing about cloudflare is that most of the time once you’re blocked: you’re blocked. There’s literally no way for you to bypass the block if you’re affected. Its incredibly scary, I once had a bad useragent (without knowing it) and half the internet went offline, I couldn’t even access documentation or my email providers site, and there was no contact information or debugging information to help me resol…

CloudFlare is dystopic. It centralizes even the part of the Internet that hadn't been centralized before. It is a perfect Trojan horse to bypass all encryption. And it chooses who accesses (a considerable chunk of) the Internet and who doesn't.

Anubis looks much better than this.

Post reply on HN