Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why are anime catgirls blocking my access to the Linux kernel?

lock.cmpxchg8b.com

Post reply on HN
Print view View original

501–510 of 968 posts

Re: Why are anime catgirls blocking my access to the Linux kernel?

#501

Post by TZubiri »

ChocolateGod wrote: post #430

I have a S24 (flagship of 2024) and Anubis often takes 10-20 seconds to complete, that time is going to add up if more and more sites adopt it, leaning to a worse browsing experience and wasted battery life. Meanwhile AI farms will just run their own nuclear reactors eventually and be unaffected. I really don't understand why someone thought this was a good idea, even if well intentioned.

I remember that LiteCoin briefly had this idea, to be easy on consumer hardware but hard on GPUs. The ASICs didn't take long to obliterate the idea though.

Maybe there's going to be some form of pay per browse system? even if it's some negligible cost on the order of 1$ per month (and packaged with other costs), I think economies of scale would allow servers to perform a lifetime of S24 captchas in a couple of seconds.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#502

Post by jones89176 »

silversmith wrote: post #415
amarant wrote: post #339

Earlier quoted context omitted.

I feel like the future will have this, plus ads displayed while the work is done, so websites can profit while they profit.

Every now and then I consider stepping away from the computer job, and becoming a lumberjack. This is one of those moments.

my family takes care of a large-ish forest, so I have to help since my early teens. Let me tell you: think twice, it's f*ckin dangerous. Chainsaws, winches, heavy trees falling and breaking in unpredictable ways. I had a couple of close calls myself. Recently a guy from a neighbor village was squashed to death by a root plate that tilted.

I often think about quitting tech myself, but becoming a full-time lumberjack is certainly not an alternative for me.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#503

Post by palata »

johnklos wrote: post #244

This is a usually technical crowd, so I can't help but wonder if many people genuinely don't get it, or if they are just feigning a lack of understanding to be dismissive of Anubis. Sure, the people who make the AI scraper bots are going to figure out how to actually do the work. The point is that they hadn't, and this worked for quite a while. As the botmakers circumvent, new methods of proof-of-notbot will be made…

> they are just feigning a lack of understanding to be dismissive of Anubis.

I actually find the featured article very interesting. It doesn't feel dismissive of Anubis, but rather it questions whether this particular solution makes sense or not in a constructive way.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#504

Post by eqvinox »

thayne wrote: post #424
eqvinox wrote: post #412

TFA — and most comments here — seem to completely miss what I thought was the main point of Anubis: it counters the crawler's "identity scattering"/sybil'ing/parallel crawling. Any access will fall into either of the following categories: - client with JS and cookies. In this case the server now has an identity to apply rate limiting to, from the cookie. Humans should never hit it, but crawlers will be slowed down im…

You don't necessarily need JS, you just need something that can detect if Anybis is used and complete the challenge.

Sure, doesn't change anything though; you still need to spend energy on a bunch of hash calculations.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#505

Post by username332211 »

chrismorgan wrote: post #448
agwa wrote: post #315

Earlier quoted context omitted.

It sounds like you're saying that it's not the proof-of-work that's stopping AI scrapers, but the fact that Anubis imposes an unusual flow to load the site. If that's true Anubis should just remove the proof-of-work part, so legitimate human visitors don't have to stare at a loading screen for several seconds while their device wastes electricity.

> If that's true Anubis should just remove the proof-of-work part This is my very strong belief. To make it even clearer how absurd the present situation is, every single one of the proof-of-work systems I’ve looked at has been using SHA-256, which is basically the worst choice possible. Proof-of-work is bad rate limiting which depends on a level playing field between real users and attackers. This is already a doome…

All this is true, but also somewhat irrelevant. In reality the amount of actual hash work is completely negligible.

For usability reasons Anubus only requires that you to go trough a the proof of work flow only once in a given period. (I think the default is once per week.) That's just very little work.

Detecting you need to occasionally send a request trough a headless browser far more of a hassle than the PoW. If you prefer LLMs rather than normal internet search, it'll probably consume far more compute as well.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#506

Post by rocqua »

thayne wrote: post #424
eqvinox wrote: post #412

TFA — and most comments here — seem to completely miss what I thought was the main point of Anubis: it counters the crawler's "identity scattering"/sybil'ing/parallel crawling. Any access will fall into either of the following categories: - client with JS and cookies. In this case the server now has an identity to apply rate limiting to, from the cookie. Humans should never hit it, but crawlers will be slowed down im…

You don't necessarily need JS, you just need something that can detect if Anybis is used and complete the challenge.

But then you rate limit that challenge.

You could setup a system for parellelizing the creation of these Anubis PoW cookies independent of the crawling logic. That would probably work, but it's a pretty heavy lift compared to 'just run a browser with JavaScript'.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#507

Post by JimDabell »

necovek wrote: post #438
Aurornis wrote: post #295

Earlier quoted context omitted.

> This is a usually technical crowd, so I can't help but wonder if many people genuinely don't get it, or if they are just feigning a lack of understanding to be dismissive of Anubis. This is a confusing comment because it appears you don’t understand the well-written critique in the linked blog post. > This is like those simple things on submission forms that ask you what 7 + 2 is. Of course everyone knows that a cr…

But for actual live users who don't see anything but a transient screen, Anubis is a better experience than all those pesky CAPTCHAs (I am bored of trying to recognize bikes, pedestrian crossings, buses, hydrants). The question is if this is the sweet spot, and I can't find anyone doing the comparative study (how many annoyed human visitors, how many humans stopped and, obviously, how many bots stopped).

> Anubis is a better experience than all those pesky CAPTCHAs (I am bored of trying to recognize bikes, pedestrian crossings, buses, hydrants).

Most CAPTCHAs are invisible these days, and Anubis is worse than them. Also, CAPTCHAs are not normally deployed just for visiting a site, they are mostly used when you want to submit something.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#508

Post by rocqua »

eqvinox wrote: post #412

TFA — and most comments here — seem to completely miss what I thought was the main point of Anubis: it counters the crawler's "identity scattering"/sybil'ing/parallel crawling. Any access will fall into either of the following categories: - client with JS and cookies. In this case the server now has an identity to apply rate limiting to, from the cookie. Humans should never hit it, but crawlers will be slowed down im…

This is a good point, presuming the rate limiting is actually applied.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#509

Post by dcow »

johnklos wrote: post #244

This is a usually technical crowd, so I can't help but wonder if many people genuinely don't get it, or if they are just feigning a lack of understanding to be dismissive of Anubis. Sure, the people who make the AI scraper bots are going to figure out how to actually do the work. The point is that they hadn't, and this worked for quite a while. As the botmakers circumvent, new methods of proof-of-notbot will be made…

I deployed a proof of work based auth system once where every single request required hashing a new nonce. Compare with Anubis where only one request a week requires it. The math said doing it that frequently, and with variable argon params the server could tune if it suspected bots, would be impactful enough to deter bots.

Would I do that again? Probably not. These days I’d require a weekly mDL or equivalent credential presentation.

I have to disagree that an anti-bot measure that only works globally for a few weeks until bots trivially bypass it is effective. In an arms race against bots the bots win. You have to outsmart them by challenging them to do something that only a human can do or is actually prohibitively expensive for bots to do at scale. Anubis doesn't pass that test. And now it’s littered everywhere defunct and useless.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#510

Post by palata »

john01dav wrote: post #460
overfeed wrote: post #298

Earlier quoted context omitted.

> The bots will eventually be indistinguishable from humans Not until they get issued government IDs they won't! Extrapolating from current trends, some form of online ID attestation (likely based on government-issued ID[1]) will become normal in the next decade, and naturally, this will be included in the anti-bot arsenal. It will be up to the site operator to trust identities signed by the Russian government. 1. De…

This has quite nasty consequences for privacy. For this reason, alternatives are desirable. I have less confidence on what such an alternative should be, however.

Can you elaborate on that? Are you implying that it is strictly impossible to do this in a privacy-preserving way?
Post reply on HN