Who does Anubis actually stop? • Hacker News Board

Re: Who does Anubis actually stop?

#81

Post by ssl-3 » Mon, Jul 27, 2026, 12:11 AM UTC

pooploop64 wrote: post #80

ssl-3 wrote: post #54

Earlier quoted context omitted.

It appears in places where that are neither personal websites nor blogs, and that are places where professionals conduct work. For instance: The act of searching the Arch Linux wiki produces a picture of the anime girl. (Should I just not use Arch professionally?)

I don't see what's so offensive about it. If it had huge boobs or something that would be one thing, but it's just a regular mascot character. Out of all the "necessary evils" that get inserted to keep a service above water, that anime girl image is the least offensive one I can think of. It's still completely normalized to show ads for porn on sites like youtube. Captchas are an insult, with the "photo challenge" ty…

I don't know what it is, either. But it creeps me out and makes me feel dirty every time it shows up.

It does this in ways that a boring corpo captcha or Cloudflare prompt do not, so it's presence of this artwork more than it is the temporary time-wasting impediment that seems to do it.

People have irrational reactions to things sometimes, and I am people.

Re: Who does Anubis actually stop?

#82

Post by cedws » Mon, Jul 27, 2026, 9:33 AM UTC

eqvinox wrote: post #69

cedws wrote: post #65

Earlier quoted context omitted.

The cost is nothing. The browser implementation is too slow, mobile devices are too slow, and hash algorithms with hardware acceleration are too fast. You can’t balance these three constraints in a way that only keeps out the bad guys. The hashing is just elaborate obfuscation. Anubis uses SHA256 which isn’t ASIC-resistant, and thanks to Bitcoin you could probably buy one off the shelf.

and yet, it works.

The hashing has nothing to do with it. It's just an arbitrary hoop for clients to jump through that filters out the bots that haven't implemented that hoop. So why not just use the client's fingerprint and call it a day? Use their canvas or JA3 fingerprint and I'm willing to bet it would be just as effective.

Re: Who does Anubis actually stop?

#83

Post by eqvinox » Mon, Jul 27, 2026, 10:43 AM UTC

cedws wrote: post #82

eqvinox wrote: post #69

Earlier quoted context omitted.

and yet, it works.

The hashing has nothing to do with it. It's just an arbitrary hoop for clients to jump through that filters out the bots that haven't implemented that hoop. So why not just use the client's fingerprint and call it a day? Use their canvas or JA3 fingerprint and I'm willing to bet it would be just as effective.

It's impossible to know without trying, but I suspect those checks would be too easy to bypass/fake in a crawler.

You can submit a PR and then we can try…

Re: Who does Anubis actually stop?

#84

Post by cedws » Mon, Jul 27, 2026, 1:29 PM UTC

eqvinox wrote: post #83

cedws wrote: post #82

Earlier quoted context omitted.

The hashing has nothing to do with it. It's just an arbitrary hoop for clients to jump through that filters out the bots that haven't implemented that hoop. So why not just use the client's fingerprint and call it a day? Use their canvas or JA3 fingerprint and I'm willing to bet it would be just as effective.

It's impossible to know without trying, but I suspect those checks would be too easy to bypass/fake in a crawler. You can submit a PR and then we can try…

Most scrapers are unsophisticated, this is why Anubis "works." For this same reason, basic fingerprinting already employed by Cloudflare et al would have the same efficacy.