Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why are anime catgirls blocking my access to the Linux kernel?

lock.cmpxchg8b.com

Post reply on HN
Print view View original

701–710 of 968 posts

Re: Why are anime catgirls blocking my access to the Linux kernel?

#701

Post by Aachen »

elric wrote: post #488
technion wrote: post #362

Earlier quoted context omitted.

It really should be recognised just how many people are watching Cloudflare interstitials on nearly every site these days (and I totally get why this happens) yet making a huge amount of noise about Anubis on a very small amount of sites.

I hit Cloudflare's garbage about as much as I hit Anubis. With the difference that far more sites use Cloudflare than Anubis, thus Anubis is far worse at triggering false positives.

Huh? What false positives does Anubis produce?

The article doesn't say and I constantly get the most difficult Google captchas, cloudflare block pages saying "having trouble?" (which is a link to submit a ticket that seems to land in /dev/null), IP blocks because user agent spoofing, errors "unsupported browser" when I don't do user agent spoofing... the only anti-bot thing that reliably works on all my clients is Anubis. I'm really wondering what kinds of false positives you think Anubis has, since (as far as I can tell) it's a completely open and deterministic algorithm that just lets you in if you solve the challenge, and as the author of the article demonstrated with some C code (if you don't want to run the included JavaScript that does it for you), that works even if you are a bot. And afaik that's the point: no heuristics and false positives but a straight game of costs; making bad scraping behavior simply cost more than implementing caching correctly or using commoncrawl

Re: Why are anime catgirls blocking my access to the Linux kernel?

#702

Post by wat10000 »

mattnewton wrote: post #459
wat10000 wrote: post #349

Earlier quoted context omitted.

If they become aware of it and actually think it’s worthwhile. Malicious bots work by scaling, and implementing special cases for every random web site doesn’t scale. And it’s likely they never even notice.

If this kind of security by not being noticed is the plan, why not just have a trivial (but unique) captcha that asks the user to click a button with no battery wasting computation?

That works too, but not quite as well so it decreases the unwanted activity somewhat less.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#703

Post by A1kmm »

account42 wrote: post #626
terribleperson wrote: post #569

Earlier quoted context omitted.

One option I can think of is that the attesting authority might block you if you're behaving badly.

That doesn't work without the attesting authority knowing what you are doing, which would make this scheme no longer anonymous.

It does work as long as the attesting authority doesn't allow issuing a new identity (before it expires) if the old one is lost.

You (Y) generate a keypair and send your public key to the the attesting authority A, and keep your private key. You get a certificate.

You visit site b.com, and it asks for your identity, so you hash b.com|yourprivatekey. You submit the hash to b.com, along with a ZKP that you possess a private key that makes the hash work out, and that the private key corresponds to the public key in the certificate, and that the certificate has a valid signature from A.

If you break the rules of b.com, b.com bans your hash. Also, they set a hard rate limit on how many requests per hash are allowed. You could technically sell your hash and proof, but a scraper would need to buy up lots of them to do scraping.

Now the downside is that if you go to A and say your private key was compromised, or you lost control of it - the answer has to be tough luck. In reality, the certificates would expire after a while, so you could get a new hash every 6 months or something (and circumvent the bans), and if you lost the key, you'd need to wait out the expiry. The alternative is a scheme where you and A share a secret key - but then they can calculate your hash and conspire with b.com to unmask you.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#704

Post by pferde »

sneak wrote: post #622
johnklos wrote: post #244

This is a usually technical crowd, so I can't help but wonder if many people genuinely don't get it, or if they are just feigning a lack of understanding to be dismissive of Anubis. Sure, the people who make the AI scraper bots are going to figure out how to actually do the work. The point is that they hadn't, and this worked for quite a while. As the botmakers circumvent, new methods of proof-of-notbot will be made…

The fundamental failure of this is that you can’t publish data to the web and not publish data to the web. If you make things public, the public will use it. It’s ineffective. (And furry sex-subculture propaganda pushed by its author, which is out of place in such software.)

The misguided parenthetical aside, this is not about resources being public, this is about bad actors accessing those resources in a highly inefficient and resource-intensive manner, effectively DDOS-ing the source.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#705

Post by Aachen »

robertlagrant wrote: post #627
analbliss wrote: post #561

Earlier quoted context omitted.

So yes, it is like having a stalker politely open the door for you as you walk into a shop, because they know very well who you are.

In a world full of robots that look like humans, the stalker who knows you and lets you in might be the only solution.

That's called authentication. In the case of the stalker, by biometrics (facial recognition). This could be a solution

But that's not what Cloudflare does. Cloudflare guesses whether you are a bot and then either blocks you or not. If it currently likes you, bless your luck

Re: Why are anime catgirls blocking my access to the Linux kernel?

#706

Post by latexr »

windward wrote: post #666
sidewndr46 wrote: post #245

> The CAPTCHA forces vistors to solve a problem designed to be very difficult for computers but trivial for humans I'm an unsure if this deadpan humor or if the author has never tried to solve a CAPTCHA that is something like "select the squares with an orthodox rabbi present"

I wonder if it's an intentional quirk that you can only pass some CAPTCHAs if you're a human who knows what an American fire hydrant or school bus looks like?

I doubt it’s intentional. Google (owner of reCAPTCHA) is a US company, so it’s more likely they either haven’t considered what they see every day is far from universal; don’t care about other countries; or specifically just care about training for the US.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#707

Post by 986aignan »

palata wrote: post #512
chmod775 wrote: post #355

Earlier quoted context omitted.

It doesn't need to. Thanks to asymmetric cryptography governments can in theory provide you with a way to prove you are a human (or of a certain age) without: 1. the government knowing who you are authenticating yourself to 2. or the recipient learning anything but the fact that you are a human 3. or the recipient being able to link you to a previous session if you authenticate yourself again later The EU is trying t…

But I don't get how is goes for spam or scrapping: if I can pass the test "anonymously", then what prevents me from doing it for illegal purposes? I get it for age verification: it is difficult for a child to get a token that says they are allowed to access porn because adults around them don't want them to access porn (and even though one could sell tokens online, it effectively makes it harder to access porn as a c…

IIRC, you could use asymmetric cryptography to derive a site-specific pseudonymous token from the service and your government ID without the service knowing what your government ID is or the government provider knowing what service you are using.

The service then links the token to your account and uses ordinary detection measures to see if you're spamming, flooding, phishing, whatever. If you do, the token gets blacklisted and you can no longer sign on to that service.

This isn't foolproof - you could still bribe random people on the street to be men/mules in the middle and do your flooding through them - but it's much harder than just spinning up ten thousand bots on a residential proxy.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#708

Post by Aachen »

jcelerier wrote: post #444
technion wrote: post #362

Earlier quoted context omitted.

It really should be recognised just how many people are watching Cloudflare interstitials on nearly every site these days (and I totally get why this happens) yet making a huge amount of noise about Anubis on a very small amount of sites.

Both are equally terrible - one doesn't require explanations to my boss though

If your boss doesn't want you to browse the web, where some technical content is accompanied by an avatar that the author likes, they may not be suitable as boss, or at least not for positions where it's their job to look over your shoulder and make sure you're not watching series during work time. Seems like a weird employment place if they need to check that anyway

Re: Why are anime catgirls blocking my access to the Linux kernel?

#709

Post by tortillasauce »

Anubis works because AI crawlers do very little requests from an ip address to bypass rate-limiting. Last year they could still be blocked by ip range, but now the requests are from so many different networks that doesn't work anymore.

Doing the proof-of-work for every request is apparently too much work for them.

Crawlers using a single ip, or multiple ips from a single range are easily identifiable and rate-limited.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#710

Post by Aachen »

JimDabell wrote: post #497
amarant wrote: post #339

Earlier quoted context omitted.

I feel like the future will have this, plus ads displayed while the work is done, so websites can profit while they profit.

adCAPTCHA already does this: https://adcaptcha.com

Holy shit. Opening the demo from the menu, it's like captchas and youtube ads had a baby
Post reply on HN