Live data from Hacker News

End of an era for me: no more self-hosted git

kraxel.org

161–170 of 228 posts

Re: End of an era for me: no more self-hosted git

#161
post #157

Earlier quoted context omitted.

Oh please. That ship has sailed. I'm marginally sympathetic to people who don't run JavaScript on their browsers for a variety of reasons, but they've deliberately opted out of the de facto modern web. JS is as fundamental to current design as CSS. If you turn it off, things might work, but almost no one is testing that setup, nor should they reasonably be expected to. This has zero to do with Adtech for 99.99% of us…

the recent google report claimed that less than 0.1% of users have javascript disabled ... like for every website, or just some, or? your PNG/GIF thing is nonsense (false equivalence, at least) and seems like deliberate attempt to insult > I'm marginally sympathetic you say that as if they've done some harm to you or anyone else. outside of these three words, you actually seem to see anyone doing this as completely i…

It would be literally impossible to know whether a user disabled JavaScript on another site, so I'm going to say that they meant that for their own sites.

> you say that as if they've done some harm to you or anyone else.

I was literally responding to someone referring to themselves as "collateral damage" and saying I'm playing into "Big Adtech's playbook". I explained why they're wrong.

> the correct course of action is to act like they don't exist.

Unless someone is making a site that explicitly targets users unwilling or unable to execute JavaScript, like an alternative browser that disables it by default or such, mathematically, yes, that's the correct course of action.

Re: End of an era for me: no more self-hosted git

#162
post #74

Earlier quoted context omitted.

I had the same issue when I first put up my gitea instance. The bots found the domain through cert registration in minutes, before there were any backlinks. GPTbot, ClaudeBot, PerplexityBot, and others. I added a robots.txt with explicit UAs for known scrapers (they seem to ignore wildcards), and after a few days the traffic died down completely and I've had no problem since. Git frontends are basically a tarpit so a…

Where does one find a good robots.txt? Are there any well maintained out there?

https://github.com/ai-robots-txt/ai.robots.txt

Re: End of an era for me: no more self-hosted git

#163

Earlier quoted context omitted.

I remember back when Anubis came out, some naysayers on here were saying it wouldn't work for long because the scrapers would adapt. Turns out careless, unethical vibecoders aren't very competent.

I still think it is just a matter of time until scrapers catch up. There are more and more scrapers that spin up an full blown chromium.

Well it's a race, just like security. And as long as anubis is in the front, all looks bright

Re: End of an era for me: no more self-hosted git

#164

Earlier quoted context omitted.

I remember back when Anubis came out, some naysayers on here were saying it wouldn't work for long because the scrapers would adapt. Turns out careless, unethical vibecoders aren't very competent.

I still think it is just a matter of time until scrapers catch up. There are more and more scrapers that spin up an full blown chromium.

AFAIK you can bypass it with curl because there's an explicit whitelist for it, no need for a headful browser.

Re: End of an era for me: no more self-hosted git

#166

Is there a way to block it by shibboleth? Curious, since the recent Google hack where you add -(n-word) to the end of your query so the AI automatically shuts down works like a charm.

Alternatively Anthropic has ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86 baked into their models. Maybe OpenAI and other have equivalents.

Re: End of an era for me: no more self-hosted git

#167

Earlier quoted context omitted.

I remember back when Anubis came out, some naysayers on here were saying it wouldn't work for long because the scrapers would adapt. Turns out careless, unethical vibecoders aren't very competent.

I still think it is just a matter of time until scrapers catch up. There are more and more scrapers that spin up an full blown chromium.

Cool, if they're running full blown chromium maybe the next step can be mining bitcoin on any pages served to bots.

Re: End of an era for me: no more self-hosted git

#168

Earlier quoted context omitted.

> I set it and use JavaScript to tell them to reload the page While throwing out all users who opt-in to javascript, using Noscript or uBlock or something like it, may be acceptable collateral damage to you, it might be good to keep in mind that this plays right into Big Adtech's playbook. They spend over two decades to normalize the behavior of running a hundred or more programs of untrusted origin on every page loa…

Oh please. That ship has sailed. I'm marginally sympathetic to people who don't run JavaScript on their browsers for a variety of reasons, but they've deliberately opted out of the de facto modern web. JS is as fundamental to current design as CSS. If you turn it off, things might work, but almost no one is testing that setup, nor should they reasonably be expected to. This has zero to do with Adtech for 99.99% of us…

There are many reasons to accommodate non-JS users beyond accommodating people who have intentionally disabled it, and most of them are in accessibility territory.

Be careful with using percentages for your arguments, because this is not that different from saying that 99.99% of people don't need wheelchair access.

Re: End of an era for me: no more self-hosted git

#169

Is there a way to block it by shibboleth? Curious, since the recent Google hack where you add -(n-word) to the end of your query so the AI automatically shuts down works like a charm.

I have no doubt that it works and it's hilarious that it works, but is there a way that does not involve my Google search history look like I've applied for a KKK membership?

Re: End of an era for me: no more self-hosted git

#170
post #158

I "solved" this by adding a fail2ban rule for everyone accessing specific commits (no one does that 3 times in a row) and then blocking the following ASs completely (just too many IPs coming from those, feel free to look them up yourself): 136907 23724 9808 4808 37963 45102. And after that: sweet silence. How to block ASs? Just write a small script that queries all of their subnets once (even if it changes, its not s…

- 136907 Huawei

- 23724 China Telco

- 9808 China Mobile

- 4808 China Unicom

- 37963 Alibaba

- 45102 Alibaba tech

You may want to add this list as well:

https://docs.aws.amazon.com/vpc/latest/userguide/aws-ip-rang...

Post reply on HN