Who does Anubis actually stop? • Hacker News Board

Re: Who does Anubis actually stop?

#21

Post by ragall » Sat, Jul 25, 2026, 10:43 PM UTC

jsnell wrote: post #12

jdlshore wrote: post #4

Hmm, I don’t think I agree. The author is claiming that Anubis is meant to stop individuals using LLMs, but I don’t think that’s its purpose. I believe its purpose is to reduce mass scraping of data that puts excessive load on systems. It does that by increasing the cost of scraping, not by preventing it entirely. Specifically, bad actors were ignoring robots.txt and rotating IPs to make blocking difficult. Anubis se…

Except it does not actually increase the cost of scraping meaningfully. Compute is really cheap. The compute for minting an Anubis cookie will cost less than a thousandth of a cent even assuming the attacker uses the same JS implementation of proof of work rather than an optimized native implementation. That cookie can then be used for hundreds of requests. How big of a deterrent is a millionth of a cent per page goi…

> How big of a deterrent is a millionth of a cent per page going to be? A non-existent one.

In practice, this would seem to be false, according to the admins of said sites.

Re: Who does Anubis actually stop?

#22

Post by xboxnolifes » Sat, Jul 25, 2026, 10:44 PM UTC

jsnell wrote: post #12

jdlshore wrote: post #4

Hmm, I don’t think I agree. The author is claiming that Anubis is meant to stop individuals using LLMs, but I don’t think that’s its purpose. I believe its purpose is to reduce mass scraping of data that puts excessive load on systems. It does that by increasing the cost of scraping, not by preventing it entirely. Specifically, bad actors were ignoring robots.txt and rotating IPs to make blocking difficult. Anubis se…

Except it does not actually increase the cost of scraping meaningfully. Compute is really cheap. The compute for minting an Anubis cookie will cost less than a thousandth of a cent even assuming the attacker uses the same JS implementation of proof of work rather than an optimized native implementation. That cookie can then be used for hundreds of requests. How big of a deterrent is a millionth of a cent per page goi…

Your theoretical counterargument falls apart by the reality of just putting up anubis and comparing the before and after. I don't understand why this argument shows up in every thread about anubis. There are plenty of people and orgs who have empirical before and after results. We don't need theoretical arguments when there exists actual data.

Re: Who does Anubis actually stop?

#23

Post by theshackleford » Sat, Jul 25, 2026, 10:46 PM UTC

aboardRat4 wrote: post #18

throw0101d wrote: post #13

I was curious about the name: > Anubis is a Web AI Firewall Utility that weighs the soul of your connection[1] using one or more challenges in order to protect upstream resources from scraper bots. * https://anubis.techaro.lol/docs/ > The Weighing of the Heart would take place in Duat (the Underworld), in which the dead were judged by Anubis, using a feather, representing Ma'at, the goddess of truth and justice respo…

>>I was curious about the name: That's knowledge usually learnt in primary school.

> That's knowledge usually learnt in primary school.

Perhaps where you reside, I’m unsure why you would believe it to be universal.

Re: Who does Anubis actually stop?

#24

Post by j-bos » Sat, Jul 25, 2026, 10:51 PM UTC

aboardRat4 wrote: post #18

throw0101d wrote: post #13

I was curious about the name: > Anubis is a Web AI Firewall Utility that weighs the soul of your connection[1] using one or more challenges in order to protect upstream resources from scraper bots. * https://anubis.techaro.lol/docs/ > The Weighing of the Heart would take place in Duat (the Underworld), in which the dead were judged by Anubis, using a feather, representing Ma'at, the goddess of truth and justice respo…

>>I was curious about the name: That's knowledge usually learnt in primary school.

Or scholastic book fairs (showing my age)

Re: Who does Anubis actually stop?

#25

Post by Macha » Sat, Jul 25, 2026, 10:54 PM UTC

greyface- wrote: post #20

Macha wrote: post #15

Earlier quoted context omitted.

Practically, the people indiscriminately scraping don't bother to do the work to bypass it or implement the POW test, which results in reduced CPU load for all the properties that were having trouble with scrapers before. Until scrapers start implementing it en masse then, it still serves its purpose.

> Until scrapers start implementing it en masse If it becomes widespread (as it has been doing), they will. Anubis' strategy only works while it remains a niche approach only adopted by a small number of sites.

And then people will move to a new solution.

I think this is a pragmatist vs idealist debate. The pragmatic answer is that Anubis solves a problem now, and so it will be used until either it doesn't or a better solution presents itself. The idealist approach is that it's obvious that there's ways to get around Anubis, and so some people argue from there that it shouldn't be used. But the only other alternatives being offered are to either eat up the costs (in server resources or engineering time), or to go behind cloudflare with its own tradeoffs.

Re: Who does Anubis actually stop?

#26

Post by patchtopic » Sat, Jul 25, 2026, 10:57 PM UTC

perhaps the author, instead of the "I'm so clever" theoretical arguments from the client side, actually implemented Anubis on the server side and observe the results.

I have set it up on a few sites being relentlessly hammered by clearly idiotic bot traffic, and it drops bot the traffic levels from insane to manageable. I don't even care if the traffic is AI or bots, if the bot has gone to the same effort as the author has the bot may even just access the site in a responsible manner and that's fine.

Re: Who does Anubis actually stop?

#27

Post by drum55 » Sat, Jul 25, 2026, 10:58 PM UTC

Kuinox wrote: post #16

drum55 wrote: post #11

Earlier quoted context omitted.

Claude Opus can make an optimized version of the proof of work solver that’s more than 10000x faster than the javascript one, in about 5 minutes time. Who is this stopping exactly? It’s the wrong tool in the wrong place.

The difficulty is increased when the server get heavy traffic.

Then the only people who can use it are the ones with a GPU implementation.

Re: Who does Anubis actually stop?

#28

Post by drum55 » Sat, Jul 25, 2026, 11:00 PM UTC

greyface- wrote: post #20

Macha wrote: post #15

Earlier quoted context omitted.

Practically, the people indiscriminately scraping don't bother to do the work to bypass it or implement the POW test, which results in reduced CPU load for all the properties that were having trouble with scrapers before. Until scrapers start implementing it en masse then, it still serves its purpose.

> Until scrapers start implementing it en masse If it becomes widespread (as it has been doing), they will. Anubis' strategy only works while it remains a niche approach only adopted by a small number of sites.

The barrier is a two sentence prompt to Claude to add a patch to curl that does 500MH/s to the 50kh/s the javascript version does on the same hardware, it only works because it’s obscure and largely irrelevant.

Re: Who does Anubis actually stop?

#29

Post by mike_hock » Sat, Jul 25, 2026, 11:03 PM UTC

satvikpendem wrote: post #2

Exactly, it's the same as Cloudflare captchas where only certain blessed devices and browsers can seem to actually pass it. Ironically, adding Anubis accelerates the death of the open web.

No, this is not the same as Cloudflare fascism. You're free to use any JS runtime to solve the challenge.

Re: Who does Anubis actually stop?

#30

Post by PunchyHamster » Sat, Jul 25, 2026, 11:06 PM UTC

Well, my call on this thing being useless waste of time of everyone involved was correct. Compute wasted on AI tokens alone is probably far more than some cpu for token solving, better invest time into caching it well (or blocking agentic traffic entirely if that's your jam)