Live data from Hacker News

Creepy Crawlies

people.kernel.org

41–50 of 683 posts

Re: Creepy Crawlies

#41
Hm, interesting - how will it look the actual solution for such problems in the future. I suppose the issue will continue to grow.

First idea - there should be some cost for sending traffic somewhere. And the server owner also should receive pay - not only the internet provider.

So, in with this idea, the server owner can potentially increase the amount of computing power to satisfy all requests.

Re: Creepy Crawlies

#42
> Why is git.kernel.org “interesting” to crawlers

Interesting to crawlers is not a narrow scope. We have the same problem on a B2B car wash site.

Re: Creepy Crawlies

#43
WordPress powered a huge number of websites. Yet the crawlers all go straight for the HTML of those sites rather than the more efficient and structured JSON API which all WordPress sites have.

If these crawlers are so smart, why aren't they following the rel="alternate" which is provided explicitly for them?

Re: Creepy Crawlies

#44
Tavis Ormandy called this, about Anubis, almost exactly a year ago:

https://news.ycombinator.com/item?id=44962529

It never really cohered as a solution. High-powered scrapers are better equipped to handle proof-of-work challenges than end users. Proof of work makes sense for a password hash, where any one guess at a password provides zero marginal utility. But every request from a scraper is productive to the scraper.

Re: Creepy Crawlies

#45
I wonder if one solution here could be to turn up Anubis difficulty if the first page hit is not one of the obvious entry-points to cgit. It could even have a little hint that says something to the effect of “go visit the home page if this is taking too long”. (Better not to ban them entirely, in case people really did click on some random link e.g. in a news story or mailing list message).

Distributed scrapers are going to generally try and hit their assigned list of pages; it’s a bigger waste of time if they have to go off to visit other pages first to get the cookie challenge.

Re: Creepy Crawlies

#46
post #14

Given the nature of git, wouldn't all that HTML be highly cacheable? I get that's not free either, but it's got to be a lot less intensive than having cgit generate it every single time.

Or, html generation could be very, very fast in the first place. For example, serving static files is usually just as fast as a reverse-proxy cache. Interestingly enough, cgit bills itself as "a hyperfast web frontend for git repositories" [0]. Alas, nothing is fast enough for the bots, it would appear. [0] https://git.zx2c4.com/cgit/about/

he said its fast enough for now actually...

Re: Creepy Crawlies

#47

Hm, interesting - how will it look the actual solution for such problems in the future. I suppose the issue will continue to grow. First idea - there should be some cost for sending traffic somewhere. And the server owner also should receive pay - not only the internet provider. So, in with this idea, the server owner can potentially increase the amount of computing power to satisfy all requests.

> there should be some cost for sending traffic somewher

So now, because of bad actors, I need to pay for the privilege of watching a website or using a service that was meant to be free? No, thanks.

I don't have a solution, but "break how the web currently works" is not one I would accept all willy nilly.

EDIT: yes, I realize we already broke the web (with Anubis, cloudflare, recaptcha etc) but I think we should resist slowly breaking it further.

Re: Creepy Crawlies

#48
They're the exception, not the rule. They get crawled like any other site, but happen to host git repositories. It's not obvious that these are targeted crawls and they likely may just end up in crawling queues a lot generally

Re: Creepy Crawlies

#49
Maybe you could have a system that heuristicially detects when an crawler is making the request and then feeds them a modified page, itself generated from an LLM, that injects vulnerabilities and bad code and discussion and such.

Re: Creepy Crawlies

#50
> But no, let's in fact choose the stupidest possible way of doing it — by rendering everything as HTML commit by commit and then parsing it.

I feel like I'm at work.

We had some web crawler using Selenium to make queries and scrape the data instead of just downloading the whole file.

Every day it seems like we have some people that know just enough to be dangerous creating things like that. And then of course it's our fault that things are slow, or we won't give them infinite system resources, etc

Post reply on HN