Live data from Hacker News

Why are anime catgirls blocking my access to the Linux kernel?

lock.cmpxchg8b.com

891–900 of 968 posts

Re: Why are anime catgirls blocking my access to the Linux kernel?

#891
post #309

Earlier quoted context omitted.

Not sure what you mean, as exactly this is happening currently on 99% of the web. Brought to you by: ads

I think what they meant is: there’s already so many other ways to fingerprint (say, canvas) that a common user agent doesn’t significantly help you

'There's so many cliffs around that not jumping off that one barely helps you'.

I meeeeeannn... sure? I know that browser fingerprinting works quite well without, but custom headers are actually a game over in terms of not getting tracked.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#892
post #880

With the asymmetry of doing the PoW in javascript versus compiled c code, I wonder if this type of rate limiting is ever going to be directly implemented into regular web browsers. (I assume there's already plugins for curl/wget) Other than Safari, mainstream browsers seem to have given up on considering browsing without javascript enabled a valid usecase. So it would purely be a performance improvement thing.

Apple supports people that want to not use their software as the gods at Apple intended it? What parallel universe Version of Apple is this! Seriously though, does anything of Apple's work without JS, like Icloud or Find my phone? Or does Safari somehow support it in a way that other browsers don't?

Last I checked, safari still had a toggle to disable javascript long after both chrome and firefox removed theirs. That's what I was referring to.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#893

Earlier quoted context omitted.

If your headers are new every time then it is very difficult to figure out who is who.

It's very easy to train a model to identify anomalies like that.

While it's definitely possible to train a model for that, 'very easy' is nonsense.

Unless you've got some superintelligence hidden somewhere, you'd choose a neural net. To train, you need a large supply of LABELED data. Seems like a challenge to build that dataset; after all, we have no scalable method for classifying as of yet.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#894
post #705

Earlier quoted context omitted.

In a world full of robots that look like humans, the stalker who knows you and lets you in might be the only solution.

That's called authentication. In the case of the stalker, by biometrics (facial recognition). This could be a solution But that's not what Cloudflare does. Cloudflare guesses whether you are a bot and then either blocks you or not. If it currently likes you, bless your luck

> This could be a solution

Until the moment someone will figure out the generation of realistic enough 3d faces.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#895
post #130

Earlier quoted context omitted.

The explanation of how the estimate is made is more detailed, but here is the referenced conclusion: >> So (11508 websites * 2^16 sha256 operations) / 2^21, that’s about 6 minutes to mine enough tokens for every single Anubis deployment in the world. That means the cost of unrestricted crawler access to the internet for a week is approximately $0. >> In fact, I don’t think we reach a single cent per month in compute…

If you use one solution to browse the entire site, you're linking every pageload to the same session, and can then be easily singled out and blocked. The idea that you can scan a site for a week by solving the riddle once is incorrect. That works for non-abusers.

Well, since they can get a unique token for every site every 6 minutes only using a free GCP VPS that doesn't really matter, scraping can easily be spread out across tokens or they can cheaply and quickly get a new one whenever the old one gets blocked.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#896
post #118

Earlier quoted context omitted.

> Stop whining about free projects/labour man. The same people comment oh well these AI scrapers are scraping so many websites and taking livelihood of website makers and now you have someone who just gave it to ya for free and you are nitpicking the wrong things. That isn't the issue. The issue is that this tool is not fit for purpose and is inappropriate to be used by the projects that have adopted it. The proof of…

Hm yea this is a fair critisicm actually as I also said in some other comment just now that we need to discuss more about if anubis is actually being useful or not at what its saying. You raise a good point man, what do you suggest should be done instead of what anubis is doing right now for the same outcome(getting not effectively ddosed by AI scrapers) ?

The undelying point is mentioned early in the article:

> The traditional solution to blocking nuisance crawlers is to use a combination of rate limiting and CAPTCHAs. The CAPTCHA forces vistors to solve a problem designed to be very difficult for computers but trivial for humans. This isn’t perfect of course, we can debate the accessibility tradeoffs and weaknesses, but conceptually the idea makes some sense.

> Anubis – confusingly – inverts this idea. It insists visitors solve a problem trivial for computers, but impossible for humans.

Fundementally, the idea that PoW is a good way to tell humans from bots just doesn't work.

Captchas, rate limiting, authentication, etc are all part of the solution.

The more bespoke a captcha solution is, the less likely that bots, especially the kind of low effort bots that ignore rate limits and hammer sites, will have the ability to break it.

Arguably, anubis has a much better harm-vs-protection ratio at much lower difficulty setting where it functions less as a PoE system and more as an obscure way to block lowe effort bots. Of course, the more it gets adopted, the less well this will work.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#897

Earlier quoted context omitted.

lmfao so that kinda defeats the entire point of this project if they have to resort to a manual IP blocklist anyways

I would actually say that it's been successful in determining at least one, so far, large scale abuser, which can the be blocked via more traditional methods. I have my own project that finds malicious traffic IP addresses, and through searching through the results, it's allowed me to identify IP address ranges to be blocked completely. Yielding useful information may not have been what it was designed to do, but it'…

I think that was already common knowledge as hansjorg above suggests

Re: Why are anime catgirls blocking my access to the Linux kernel?

#898
post #332

Earlier quoted context omitted.

How does this work, though? We can't just have "send me a picture of your ID" because that is pointlessly easy to spoof - just copy someone else's ID. So there must be some verification that you, the person at the keyboard, is the same person as that ID identifies. The UK is rapidly finding out that that is extremely difficult to do reliably. Video doesn't really work reliably on all cases, and still images are too e…

If you're really curious about this, there's a place where people discuss these problems annually: https://internetidentityworkshop.com/ Various things you're not thinking of: - "The person at the keyboard, is the same person as that ID identifies" is a high expectation, and can probably be avoided—you just need verifiable credentials and you gotta trust they're not spoofed - Many official government IDs are digital…

that is interesting, thanks.

Why isn't it necessary to prove that the person at the keyboard is the person in the ID? That seems like the minimum bar for entry to this problem. Otherwise we can automate the ID checks and the bots can identify as humans no problem.

And how come the UK is failing so badly at this?

Re: Why are anime catgirls blocking my access to the Linux kernel?

#899

Earlier quoted context omitted.

UK is stupidly far behind on this though. On one hand the digitization of government services is really well done(thanks to the fantastic team behind .gov websites), but on the other it's like being in the dark ages of tech. My native country has physical ID cards that contain my personal certificate that I can use to sign things or to - gasp! - prove that I am who I say I am. There is a government app that you can u…

> UK is in this weird place where there isn't one kind of ID that everyone has - for most people it's the driving licence, but obviously that's not good enough. As a Brit I personally went through a phase of not really existing — no credit card, no driving licence, expired passport - so I know how annoying this can be. But it’s worth noting that we have this situation not because of mismanagement or technical illiter…

Same in Australia - there was a referendum about whether we should have government-issued ID cards, and the answer was an emphatic "NO". And Australia is hitting or going to hit the same problem with the age verification thing for social media.

Re: Why are anime catgirls blocking my access to the Linux kernel?

#900
Whenever I see an otherwise civil and mature project utilize something outwardly childish like this I audibly groan and close the page.

I'm sure the software behind it is fine but the imagery and style of it (and the confidence to feature it) makes me doubt the mental credibility/social maturity of anybody willing to make it the first thing you see when accessing a webpage.

Edit: From a quick check of the "CEO" of the company, I was unsurprised to have my concerns confirmed. I may be behind the times but I think there are far too many people in who act obnoxiously (as part of what can only be described as a new subculture) in open source software today and I wish there were better terms to describe it.

Post reply on HN