Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It took a year to ship WebAssembly in Anubis

anubis.techaro.lol

Post reply on HN
Print view View original

161–170 of 223 posts

Re: It took a year to ship WebAssembly in Anubis

#161

Post by Gracana »

GuB-42 wrote: post #157
JodieBenitez wrote: post #123

Earlier quoted context omitted.

I'm not a fan of Anubis for various reasons but the idea that bot traffic in only harmful with dynamic pages must die. CPU (yes, even to serve static pages) is not free, bandwidth is definitely not free. There's an idea that serving a static page to a bot has a marginal cost tending to zero, but it's never really zero and serving them by millions definitely has a cost. Also, while some pages may look like static HTML…

Anubis is not free either, it is a matter of how much it costs to run Anubis vs to let bots in. When I see LKML using Anubis when the pages it serves are tens of kB, all presumably static, I wonder if they do it out of spite rather than to protect their servers.

It’s done out of necessity, you can read about why here: https://people.kernel.org/monsieuricon/creepy-crawlies

As a user/reader/viewer I absolutely hate Anubis and usually turn around when I see it pop up (at least on my phone where it takes ages to compute), but with stats like that, I get why a site operator would resort to using it.

Re: It took a year to ship WebAssembly in Anubis

#162

Post by bmacho »

perching_aix wrote: post #135
kstrauser wrote: post #93

Earlier quoted context omitted.

Gotta agree. Turning tracking cookies off? Sure! Turning session cookies off and then complaining that the server doesn’t remember you? Uhhh… And while I’m sympathetic to the idea of not wanting to run JS, to a first approximation modern browsers are JS engines that have graphical displays. How things should be vs how they are is a classic is/ought problem. The world took a vote on what a browser’s meant for and we l…

There's no mechanistic difference between the two types of cookies, let's not pretend this is an actual config choice that people are making. Whenever I hit Anubis, I simply go "keep your secrets then" and take my leave. The vast majority of the sites posted to HN (that catch my fancy) work fine or fine enough, and are better for it. If I really, really desperately want to check something out, I can always just turn…

> There's no mechanistic difference between the two types of cookies, let's not pretend this is an actual config choice that people are making.

They probably meant 3rd party cookies. It's common to block those. 1st party cookies not so much.

Re: It took a year to ship WebAssembly in Anubis

#163

Post by xena »

Aachen wrote: post #42

Is there a place where I can try out if my browser is compatible? Easier to find out now than when I'm trying to get work done and a million websites now have it deployed On https://wasm-feature-detect.surma.technology it shows that I don't have 3 of all these features but I'm not sure if Anubis needs any of them to not kick me back to the pure JS solution Which would apparently be bad because > The WebAssembly that'…

If you don't disable browser features for fun and/or sport, Chrome as of version 120 or later (or another browser of that vintage) will use the optimized flow.

Re: It took a year to ship WebAssembly in Anubis

#164

Post by wiredfool »

gruez wrote: post #43
Jtariiiii wrote: post #40

Earlier quoted context omitted.

>It’s not stopping anyone. You could just spend 30 seconds googling instead of confidently asserting nonsense. There are plenty of people demonstrating that Anubis reduces bot traffic.

>There are plenty of people demonstrating that Anubis reduces bot traffic. "Anubis reduces bot traffic" and "[the proof of work] is not stopping anyone" isn't contradictory, especially if anubis isn't being benchmarked against non-POW alternatives like IP/ASN bans, or tls fingerprinting.

IP blocks don't work, because they're using proxy networks so that you see an ip address 1 or 2 times within 10 minutes. They have effectively infinite ip addresses. (actually, looking at my data from today, I think this relationship holds over ~3 hours, where we're seeing ip address cardinality at about 1/2 of the hits.)

  * Sometimes there's a pattern to the country. Oftentimes, not. 
  * User-agent, rotated between common, valid, current web browsers.
  * Other headers, sec-*, accept, etc, generally valid and rotating. 
  * Bots will load the site to saturation in a denial of wallet attack.
The only thing that's specific is:

  * urls have a pattern.
  * it's obviously invalid traffic.
(non-bot traffic on my sites does not go from 0 to 200r/sec on the search interface in seconds. It does not go away that fast either)

Re: It took a year to ship WebAssembly in Anubis

#165

Post by DrammBA »

xena wrote: post #119
doctor_radium wrote: post #103

I have every copy of Firefox here configured with webassembly disabled...because I don't tend to do what Webassembly was designed for, i.e. online games, video/audio editing, emulation, etc. [1] and because I dislike things running in the background without my knowledge. So this is going to be interesting. My plea (in a small voice) to the OP: just as many sites still do for JavaScript, please add a "This captcha req…

I don't mean to be rude, but please search "wasm2js" in the article.

Some times it's okay to mean it.

Re: It took a year to ship WebAssembly in Anubis

#166

Post by pinocchioruns »

mitxela wrote: post #71
arjie wrote: post #36

Anubis is fine if you want to block bots that are bothering you, but I never understood why they don't have robots.txt at the root level too. I happily obey that for my private crawler. I suppose you don't want to duplicate implementations. Fair enough. I guess I should add an Anubis detector so I can just blacklist because that person clearly doesn't want bots.

In this day and age, only good bots, the ones you actually want, obey robots.txt. You obtain no benefit by having a restrictive one.

[flagged]

Re: It took a year to ship WebAssembly in Anubis

#167

Post by ChocolateGod »

chews wrote: post #2

It's wild to me that PoW systems are how we sort the bot problem... the bummer is that all this "work" is just wasted cycles, at least in crypto there is a token you can sell.

> the bummer is that all this "work" is just wasted cycles

There's probably an overlap with people who think anubis is a good idea and those who think we should be doing more to battle climate change.

The two views are not compatible though.

Re: It took a year to ship WebAssembly in Anubis

#168

Post by worldsavior »

miraline wrote: post #64

The interesting part is that bots mitigation is actually an economic problem. You don't need to make scraping impossible, you only need to just make it expensive enough so that abusive traffic stops being worth it.

It's already expensive, though they still profit. Let's see if this makes it more expensive, since RAM/storage is much harder to come by these days.

Re: It took a year to ship WebAssembly in Anubis

#169

Post by mattstir »

fwip wrote: post #76
lxgr wrote: post #30

Earlier quoted context omitted.

Yes, I also strongly suspect that this is only going to move more parts of scrapers onto consumer devices. The egress proxies are already there, why not use a little bit of the compute as well?

When you force a low end device to burn CPU or fill ram constantly, the owner throws it out and buys a new one.

That's just not possible in many parts of the world.
Post reply on HN