Live data from Hacker News

A year of fighting scrapers on my 1.5 million-page website

patronview.com

321–330 of 450 posts

Re: A year of fighting scrapers on my 1.5 million-page website

#321
post #117

Earlier quoted context omitted.

> If I run a local script or an LLM that needs to fetch a web page from your site and you block that script or LLM as being a bot, you hurt me, the user. No; in this case you are not a user, you are a bot user.

Scenario one: you use software to connect to their server and download a webpage. You are a user. Scenario two: you use software to connect to their server and download a webpage. You are a "bot". Make it make sense

You’re missing the part about the human who interacts with the webpage.

Re: A year of fighting scrapers on my 1.5 million-page website

#322
Original HN title: "99% of My Website Traffic Is Bots"

Not clear how the author arrived at the precise 99% figure; perhaps "99%" is a figure of speech

"And yes, my site gets its data by scraping those public documents. So I'm a scraper writing a blog post complaining about scrapers."

"I'm trying to run a business here."

What's the business

(where "business" is defined as "buying and selling")

From https://patronview.com/robots.txt

   # As a condition of accessing this website, you agree to abide by the following
   # content signals:
   
   # (a)  If a Content-Signal = yes, you may collect content for the corresponding
   #      use.
   # (b)  If a Content-Signal = no, you may not collect content for the
   #      corresponding use.
   # (c)  If the website operator does not include a Content-Signal for a
   #      corresponding use, the website operator neither grants nor restricts
   #      permission via Content-Signal with respect to the corresponding use.
   
   # The content signals and their meanings are:
   
   # search:   building a search index and providing search results (e.g., returning
   #           hyperlinks and short excerpts from your website's contents). Search does not
   #           include providing AI-generated search summaries.
   # ai-input: inputting content into one or more AI models (e.g., retrieval
   #           augmented generation, grounding, or other real-time taking of content for
   #           generative AI search answers).
   # ai-train: training or fine-tuning AI models.
   # use:      how AI systems may consume the content (immediate, reference, or full).
   
   # ANY RESTRICTIONS EXPRESSED VIA CONTENT SIGNALS ARE EXPRESS RESERVATIONS OF
   # RIGHTS UNDER ARTICLE 4 OF THE EUROPEAN UNION DIRECTIVE 2019/790 ON COPYRIGHT
   # AND RELATED RIGHTS IN THE DIGITAL SINGLE MARKET.
   
   # BEGIN Cloudflare Managed content
   
   User-agent: *
   Content-Signal: search=yes,ai-train=no,use=reference
   Allow: /
Perhaps this could be construed as a license, e.g., permitting or prohibiting certain uses of the "content"

If, for example, the website operator had enforceable intellectual property rights in the "content", such as copyrights, then perhaps the operator could restrict access to the "content" under the threat of litigation to enforce those rights

Basic questions

1. Is the "content" protected by intellectual property rights, e.g., copyrights

2. Does the website operator have intellectual property rights in the "content", e.g., copyrights

3. Does the website operator have agreements with the rights holders, e.g., granting the operator authorization to restrict access to the "content"

Re: A year of fighting scrapers on my 1.5 million-page website

#323
post #107

Earlier quoted context omitted.

Yeah this is one of those things that hurts some real users and AI scrapers have figured out how to bypass. Not worth it IMO.

How do you figure it hurts real users? The amount of compute/energy used on the proof of work is pretty minimal. You're using more when you watch a YouTube video or browse a JS-heavy web app. Of course a sophisticated scraper can "figure out" how to bypass. It isn't trying to be foolproof, it's adding an extra cost to deter massive amounts of bot traffic. I put it in front of my hobby project because I can't afford t…

1. It makes the web more annoying and time wasting.

2. I'm a real user and I have to enable JavaScript and run arbitrary programs from untrusted websites to access them. One browser that I use doesn't even support JavaScript (w3m). Fortunately it is unaffected because it doesn't have the string "Mozilla" in its UA and Anubis lets every user without that pass to not hurt legitimate bots like search engine crawlers. As said Anubis is trivially bypassed. The only reason it isn't bypassed is because it's simply too irrelevant to the AI companies.

Re: A year of fighting scrapers on my 1.5 million-page website

#324
post #318

Earlier quoted context omitted.

There are false positives. Every time I've used a tool like this, I get reports from my users about it blocking their access. It's especially bad for users who use privacy oriented browsers like Brave or use VPNs. For a personal site where you don't care about 0.1% of your users getting blocked, it's probably fine. For a business, blocking some of your paying customers isn't acceptable.

> For a business, blocking some of your paying customers isn't acceptable. That depends on your business and the costs you're incurring from the bots. It might be justifiable to lose 0.1% of your customers if it means saving server costs from serving useless bot traffic.

I suppose it would depend, yeah. I find having paying customers being blocked to be completely unacceptable. Not only is a bad customer experience, but they tend to be very vocal about it. Posting online, leaving bad reviews, etc.

Re: A year of fighting scrapers on my 1.5 million-page website

#325
post #266

Earlier quoted context omitted.

Okay but the bots are loose and you have a bandwidth cap on most VPSs. Because you have no CDN, all the bots are coming directly to you. Because that's no CDN or distributed WAF, they're hammering your box. Because your IP is directly exposed, you're also showing up on Shodan. Your server may have enough CPU and RAM to handle the load, but does your monthly bandwidth allocation with your provider? Many are finding pr…

Bandwidth is cheap at places that don't call themselves "cloud". You can even get unmetered. 10TB/month is usually enough, even with bots. If you're serving large files, put a simple bot test on the page before the files.

> 10TB/month is usually enough, even with bots.

My single static webpage with no updates in 3 years is doing that, which is (one of the reasons) how I end up where that site (and many others in business and personally) is.

You're chasing a dream for a world that doesn't exist anymore.

Re: A year of fighting scrapers on my 1.5 million-page website

#326
post #192

Earlier quoted context omitted.

Why do you feel that ?

Because AI cannot be trusted as a reliable source of information. Information is more trustworthy when it comes from from primary sources on the open web.

Well then ask the LLM to go find and pull its information from primary sources. Don’t ever rely on its own training data.

Re: A year of fighting scrapers on my 1.5 million-page website

#327
post #101

The worrying thing here is that so many people accepted outsourcing the decision on who can see their website to a large company (Cloudflare). If the company decides that a certain user should not see the website, the user will not see the website, and no one will know about it, and the user will have no recourse. That is not the open web that I would like to see. A second side effect of a knee-jerk reaction to bots…

I'm getting a "browser not supported" by the Cloudflare check. So I guess the "job is well done", and the user is lost.

Re: A year of fighting scrapers on my 1.5 million-page website

#328
post #101

The worrying thing here is that so many people accepted outsourcing the decision on who can see their website to a large company (Cloudflare). If the company decides that a certain user should not see the website, the user will not see the website, and no one will know about it, and the user will have no recourse. That is not the open web that I would like to see. A second side effect of a knee-jerk reaction to bots…

[deleted]

Re: A year of fighting scrapers on my 1.5 million-page website

#329
post #101

The worrying thing here is that so many people accepted outsourcing the decision on who can see their website to a large company (Cloudflare). If the company decides that a certain user should not see the website, the user will not see the website, and no one will know about it, and the user will have no recourse. That is not the open web that I would like to see. A second side effect of a knee-jerk reaction to bots…

> I wanted the information and I have no way of getting at it without investing my own time and effort in going to your website. Substitute the word “website” for book, or training course, or documentary or published paper, or patent or one of hundreds of examples. Now you see the problem.

And if you believe that blocking bots is bad, then by all means provide a better alternative that doesn't increase costs for sysadmins. If you believe that the website should just be improved, then by all means feel free to provide instructions on what should be improved and exactly how so that we don't ever have to block bots anymore. I'm sure all the sysadmins having to deal with issues like this one will thank you

Re: A year of fighting scrapers on my 1.5 million-page website

#330

Earlier quoted context omitted.

> I don’t see the sliding scale - if the website didn’t want a bot they could have blocked you. The point is that not all bots are bad. Assuming as much / implementing policies to that effect won't block all bots but it _will_ block the portion of bots that represent users considering giving you money. I have a series of bots that monitor various eCom sites to monitor prices over time for big-ticket items I am consid…

If this is the case, they probably outright do not want you as a customer. Significant sales (beyond for excess stock clearance/discontinued items) exist largely to generate some excitement from potential customers and to lure them in to taking a look at the site/store and to hopefully get them to buy some extra stuff that's less discounted while they're there. The actual on-sale item is potentially losing money for…

> If this is the case, they probably outright do not want you as a customer.

Almost certainly! No eComm site wants the cautious shopper that's done their comparisons and knows price trends; they want the impulsive people with a line of credit. I doubt that my local grocery store is happy that I index all of my receipts so I know what I buy, how often and when the prices change so I know when a discount on something I buy every once in a while is actually a discount.

When I built this a few years ago, I had to write a lot of code to make all this work.

Now that's a simple "hey $agent, check the price of https://some-site.com/appliances/that-new-fridge.html and https://other-site.com/shop/appliances/that-new-fridge.aspx daily and notify me when it's on sale or has a promotion"

I would expect that more and more people will discover that their LLM of choice can do this, that their LLM of choice can help them comparison shop and do analysis of when - historically - is the best time to buy that new TV or whatever (yes, pricing on this stuff is seasonal!).

Maybe _most_ people will never do this, maybe I'm wrong. But if i'm not, blocking all bots "because bots are bad, mmmkay" is how you loose a sale.

Ignoring the specific price data example, more and more and more people _are_ browsing the web through an LLM. Assuming that continues, blocking bots is going to have the same effect on your traffic as doing everything in the "what not to do" section of the google SEO guide book.

Post reply on HN