Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who does Anubis actually stop?

fzakaria.com

Post reply on HN
Print view View original

61–70 of 84 posts

Re: Who does Anubis actually stop?

#61

Post by throw0101d »

aboardRat4 wrote: post #18
throw0101d wrote: post #13

I was curious about the name: > Anubis is a Web AI Firewall Utility that weighs the soul of your connection[1] using one or more challenges in order to protect upstream resources from scraper bots. * https://anubis.techaro.lol/docs/ > The Weighing of the Heart would take place in Duat (the Underworld), in which the dead were judged by Anubis, using a feather, representing Ma'at, the goddess of truth and justice respo…

>>I was curious about the name: That's knowledge usually learnt in primary school.

> That's knowledge usually learnt in primary school.

Anubis may be known generally as an Ancient Egyptian god, but what he was a god of specifically is a little more obscure. I.e., what 'trait' of Anubis led the developers to choose that name?

I would have thought of something 'defensive', like a shield; to use a Greek example:

* https://en.wikipedia.org/wiki/Aegis

The association of weighing (human(!)) souls is not something that would have come to my mind.

Re: Who does Anubis actually stop?

#62

Post by object-a »

Maybe free market principles apply here: if Anubis fails to reduce scraper/bot load on servers, or blocks too many desired users, then the sites that adopt it would probably scrap it.

If they’re keeping it even after all these posts, it must be stopping _some_ sort of undesirable traffic without costing too much desirable traffic.

Re: Who does Anubis actually stop?

#63

Post by dlcarrier »

throw0101d wrote: post #13

I was curious about the name: > Anubis is a Web AI Firewall Utility that weighs the soul of your connection[1] using one or more challenges in order to protect upstream resources from scraper bots. * https://anubis.techaro.lol/docs/ > The Weighing of the Heart would take place in Duat (the Underworld), in which the dead were judged by Anubis, using a feather, representing Ma'at, the goddess of truth and justice respo…

I'm not familiar with the firewall utility, and my initial thought, in response to the question, was "anyone who's heart weighs more than a feather".

Re: Who does Anubis actually stop?

#64

Post by dlcarrier »

satvikpendem wrote: post #2

Exactly, it's the same as Cloudflare captchas where only certain blessed devices and browsers can seem to actually pass it. Ironically, adding Anubis accelerates the death of the open web.

It's getting to the point that the only way to get past the bot filters is to have bots do everything.

Re: Who does Anubis actually stop?

#65

Post by cedws »

nitwit005 wrote: post #14

This mistakes the goal. It's not to block the scrapers, but to discourage excessive (and costly) scraping. The Anubis cookies are bound to particular IP address. The scrapers are often using a large set of IP addresses, so they'll be paying a far higher cost than this suggests.

The cost is nothing. The browser implementation is too slow, mobile devices are too slow, and hash algorithms with hardware acceleration are too fast. You can’t balance these three constraints in a way that only keeps out the bad guys.

The hashing is just elaborate obfuscation. Anubis uses SHA256 which isn’t ASIC-resistant, and thanks to Bitcoin you could probably buy one off the shelf.

Re: Who does Anubis actually stop?

#66

Post by kstrauser »

jsnell wrote: post #12
jdlshore wrote: post #4

Hmm, I don’t think I agree. The author is claiming that Anubis is meant to stop individuals using LLMs, but I don’t think that’s its purpose. I believe its purpose is to reduce mass scraping of data that puts excessive load on systems. It does that by increasing the cost of scraping, not by preventing it entirely. Specifically, bad actors were ignoring robots.txt and rotating IPs to make blocking difficult. Anubis se…

Except it does not actually increase the cost of scraping meaningfully. Compute is really cheap. The compute for minting an Anubis cookie will cost less than a thousandth of a cent even assuming the attacker uses the same JS implementation of proof of work rather than an optimized native implementation. That cookie can then be used for hundreds of requests. How big of a deterrent is a millionth of a cent per page goi…

Excellent! When I put Anubis in front of my home Forgejo server, it blocked about 600,000 IO-expensive queries a day. I’d love to think it’s costing some moron $2000 to scrape my site the most idiotic way possible instead of just running git clone and analyzing it to their heart’s content.

Re: Who does Anubis actually stop?

#67

Post by kstrauser »

what wrote: post #55
arn3n wrote: post #37

Earlier quoted context omitted.

It’s meant to be both funny AND highly unprofessional; Anubis makes money of licensing a version of the firewall where you can change the image. It’s a good strategy; personal websites and blogs can display the anime girl without fear, and companies that care about their image end up paying. Win-win.

There’s nothing funny about it? Also seems like a lose for the personal websites and blogs when people bounce because of it.

Anubis’s silly, harmless images do a good job of driving away the traffic I don’t want on my personal site. Anyone who couldn’t abide seeing a cartoon for half a second wouldn’t likely be fun to interact with.

Re: Who does Anubis actually stop?

#68

Post by jdlshore »

ssl-3 wrote: post #57
jdlshore wrote: post #56

Earlier quoted context omitted.

If you care that much, you can donate money to Arch to buy a commercial license, or inform your sales rep that you find their conduct unprofessional. Or, yes, you can take the presence of the free version as a sign that the professional service is freeloading, and take your business elsewhere.

I see. I take this to mean that we have some kind of (perhaps-fundamental) difference in the ways in which we understand how free software works. (That's OK, comrade. I'm not here to change you.)

I suspect we do. In my view, people using free software take the gift they were given as-is, and if they don’t like it, they either contribute in a way the giver appreciates, or move on. They certainly don’t whine about their free gift online, and especially don’t complain that their free gift isn’t professional enough for them.

Re: Who does Anubis actually stop?

#69

Post by eqvinox »

cedws wrote: post #65
nitwit005 wrote: post #14

This mistakes the goal. It's not to block the scrapers, but to discourage excessive (and costly) scraping. The Anubis cookies are bound to particular IP address. The scrapers are often using a large set of IP addresses, so they'll be paying a far higher cost than this suggests.

The cost is nothing. The browser implementation is too slow, mobile devices are too slow, and hash algorithms with hardware acceleration are too fast. You can’t balance these three constraints in a way that only keeps out the bad guys. The hashing is just elaborate obfuscation. Anubis uses SHA256 which isn’t ASIC-resistant, and thanks to Bitcoin you could probably buy one off the shelf.

and yet, it works.
Post reply on HN