Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who does Anubis actually stop?

fzakaria.com

Post reply on HN
Print view View original

51–60 of 84 posts

Re: Who does Anubis actually stop?

#51

Post by Krutonium »

greyface- wrote: post #33
Macha wrote: post #25

Earlier quoted context omitted.

And then people will move to a new solution. I think this is a pragmatist vs idealist debate. The pragmatic answer is that Anubis solves a problem now, and so it will be used until either it doesn't or a better solution presents itself. The idealist approach is that it's obvious that there's ways to get around Anubis, and so some people argue from there that it shouldn't be used. But the only other alternatives being…

Anubis is the penicillin of web hosting. Every individual practitioner has a strong incentive to overuse it, because it's extremely effective for them individually. Every additional practitioner that uses it increases the selection pressure on their collective adversary to develop resistance. Eventually, it reaches a tipping point and becomes ineffective. But the ecosystem-level impact of its historical use remains,…

I do want to note that my website has Anubis, and does not require Javascript. You can configure Anubis to test in other ways, JS is just the default.

Re: Who does Anubis actually stop?

#52

Post by jsnell »

xboxnolifes wrote: post #22
jsnell wrote: post #12

Earlier quoted context omitted.

Except it does not actually increase the cost of scraping meaningfully. Compute is really cheap. The compute for minting an Anubis cookie will cost less than a thousandth of a cent even assuming the attacker uses the same JS implementation of proof of work rather than an optimized native implementation. That cookie can then be used for hundreds of requests. How big of a deterrent is a millionth of a cent per page goi…

Your theoretical counterargument falls apart by the reality of just putting up anubis and comparing the before and after. I don't understand why this argument shows up in every thread about anubis. There are plenty of people and orgs who have empirical before and after results. We don't need theoretical arguments when there exists actual data.

The exact claim I was replying to "It does that by increasing the cost of scraping, not by preventing it entirely." In that context, quantifying the cost isn't theoretical nitpicking!

Anubis works to the extent it does because in counter-abuse security by obscurity tends to be the best security of them all. Right now Anubis isn't popular enough for many scrapers to try working around, so they don't. But they will pour resources into working around Turnstile and Recapcha. In this regime, the exact challenge is irrelevant. Anubis would be just as effective if the challenge was running a javascript function to add two numbers instead of a proof of work.

Proof of work is just a uniquely dismal basis for a counter-abuse challenge.

Re: Who does Anubis actually stop?

#53

Post by greyface- »

Krutonium wrote: post #51
greyface- wrote: post #33

Earlier quoted context omitted.

Anubis is the penicillin of web hosting. Every individual practitioner has a strong incentive to overuse it, because it's extremely effective for them individually. Every additional practitioner that uses it increases the selection pressure on their collective adversary to develop resistance. Eventually, it reaches a tipping point and becomes ineffective. But the ecosystem-level impact of its historical use remains,…

I do want to note that my website has Anubis, and does not require Javascript. You can configure Anubis to test in other ways, JS is just the default.

Thank you. I decrement my Anubis-ire counter by 1 whenever I encounter a site configured like this.

Re: Who does Anubis actually stop?

#54

Post by ssl-3 »

arn3n wrote: post #37
what wrote: post #34

Earlier quoted context omitted.

>tries not to be annoying The little anime girl is pretty off putting. I bounce when I see it.

It’s meant to be both funny AND highly unprofessional; Anubis makes money of licensing a version of the firewall where you can change the image. It’s a good strategy; personal websites and blogs can display the anime girl without fear, and companies that care about their image end up paying. Win-win.

It appears in places where that are neither personal websites nor blogs, and that are places where professionals conduct work.

For instance: The act of searching the Arch Linux wiki produces a picture of the anime girl.

(Should I just not use Arch professionally?)

Re: Who does Anubis actually stop?

#55

Post by what »

arn3n wrote: post #37
what wrote: post #34

Earlier quoted context omitted.

>tries not to be annoying The little anime girl is pretty off putting. I bounce when I see it.

It’s meant to be both funny AND highly unprofessional; Anubis makes money of licensing a version of the firewall where you can change the image. It’s a good strategy; personal websites and blogs can display the anime girl without fear, and companies that care about their image end up paying. Win-win.

There’s nothing funny about it? Also seems like a lose for the personal websites and blogs when people bounce because of it.

Re: Who does Anubis actually stop?

#56

Post by jdlshore »

ssl-3 wrote: post #54
arn3n wrote: post #37

Earlier quoted context omitted.

It’s meant to be both funny AND highly unprofessional; Anubis makes money of licensing a version of the firewall where you can change the image. It’s a good strategy; personal websites and blogs can display the anime girl without fear, and companies that care about their image end up paying. Win-win.

It appears in places where that are neither personal websites nor blogs, and that are places where professionals conduct work. For instance: The act of searching the Arch Linux wiki produces a picture of the anime girl. (Should I just not use Arch professionally?)

If you care that much, you can donate money to Arch to buy a commercial license, or inform your sales rep that you find their conduct unprofessional.

Or, yes, you can take the presence of the free version as a sign that the professional service is freeloading, and take your business elsewhere.

Re: Who does Anubis actually stop?

#57

Post by ssl-3 »

jdlshore wrote: post #56
ssl-3 wrote: post #54

Earlier quoted context omitted.

It appears in places where that are neither personal websites nor blogs, and that are places where professionals conduct work. For instance: The act of searching the Arch Linux wiki produces a picture of the anime girl. (Should I just not use Arch professionally?)

If you care that much, you can donate money to Arch to buy a commercial license, or inform your sales rep that you find their conduct unprofessional. Or, yes, you can take the presence of the free version as a sign that the professional service is freeloading, and take your business elsewhere.

I see.

I take this to mean that we have some kind of (perhaps-fundamental) difference in the ways in which we understand how free software works.

(That's OK, comrade. I'm not here to change you.)

Re: Who does Anubis actually stop?

#58

Post by himata4113 »

what wrote: post #34
novafunc wrote: post #8

Anubis's primary goal is to prevent web scrapers from DDoSing a website. It's not meant to be an unbeatable challenge or only allow humans like Google's more privacy-invasive captchas. You do the proof of work, you get the content. Not all web scrapers are willing to do the work, which reduces the strain put on web servers. It's by no means a perfect system. It's goals in part prevent it from doing so. It tries to no…

>tries not to be annoying The little anime girl is pretty off putting. I bounce when I see it.

People are mysterious indeed. Letting a widely accepted png cause that much discomfort sure is interesting.

Re: Who does Anubis actually stop?

#59

Post by margalabargala »

jsnell wrote: post #52
xboxnolifes wrote: post #22

Earlier quoted context omitted.

Your theoretical counterargument falls apart by the reality of just putting up anubis and comparing the before and after. I don't understand why this argument shows up in every thread about anubis. There are plenty of people and orgs who have empirical before and after results. We don't need theoretical arguments when there exists actual data.

The exact claim I was replying to "It does that by increasing the cost of scraping, not by preventing it entirely." In that context, quantifying the cost isn't theoretical nitpicking! Anubis works to the extent it does because in counter-abuse security by obscurity tends to be the best security of them all. Right now Anubis isn't popular enough for many scrapers to try working around, so they don't. But they will pou…

Proof of work is fine if you can make it demonstrably take a few seconds. If 100 IPs are scraping you as fast as they can, making every 100ms request take 2.1 seconds means you're getting hit with 20x less traffic per unit time.

Re: Who does Anubis actually stop?

#60

Post by m463 »

Anubis does not stop me from browsing a site (not scraping, browsing with a human at the wheel)

On the other hand, Cloudflare and the others stop me dead. "enable javascript and cookies." Ok. "your browser is too old". (I have an old OS with the newest firefox esr that supports it).

sigh.

Post reply on HN