Thread 106373296

How is this thing useful?

> Out of the box, Anubis is pretty heavy-handed. It will aggressively challenge everything that might be a browser (usually indicated by having Mozilla in its user agent). However, some bots are smart enough to get past the challenge.

Isn't this just blocking Browsers?

This doesn't make any sense.

Someone even built an extension to bypass this cuck shit by just changing your useragent to just the word "Browser".

https://gitlab.com/zipdox/anubis-bypass/-/blob/master/background.js?ref_type=heads

Anubis BTFO

you cant be fucking serious

>>106373296 (OP)
>fork
>.*Mozilla.* -> .*
Nothing personnel kid

I'm more annoyed by it because they're trying to keep shit like the GNOME wiki out of AI, when AI is the first thing I would ask about random problems with GNOME
>No you HAVE to scroll our wiki and read everything
whyyyyyy

>>106373432
its more prone to errors. ai is awesome at this but sometimes its just wrong. i also want to just use ai : (

faggot trannyware
i despise this piece of dog shit

You. Cannot. Trust. The. User. Agent.

>>106373493
the strategy they're employing is blocking script kiddies, changing the user agent is already CSI level for most programmers. Yes I am being serious. People who know what they're doing will trivially bypass this but this can stop basic dumbasses from hammering your site with some garbage script they vibecoded to scrape

>>106373755
no. the target they're trying to block off are the massive commercial mass wide web scrapers that don't target your website in particular. they set the ua to the same as a browser's to avoid tripping the most baseline checks that most sites do even for legitimate purposes such as feature detection. the "honest" bots use a unique, non-browser user agent and gracefully retract upon getting a 403; anubis permits these as the assumption is that scraping and automated website interaction by the actual users is still a completely legitimate use case. if someone put that much effort to target your website specifically then they'll gladly just solve the pow while still remaining headless as it's a very tiny computational burden compared to the volume of their scraping. thus if your goal is to deter script kiddies and vibe coders then you use an anti bot such as turnstile or akamai's shit. these rely on abusing browser apis and variable behavior in them to fingerprint you which gives the completely opposite result than pow because the big scrapers have unlimited legitimate fp data to spoof as (and bypasses to the actual solutions) whereas your typical joe wanting to do legitimate harmless scraping on your site is stuck on the challenge window

As is the case with most trannyware, they spent more time on the anime character than the actual code. Please, weebs and trannies, leave software along with the jeets. Go play roblox or something.

>>106373296 (OP)
>Anubis BTFO
and yet it worked for eight months, only recently huawei started getting through

>>106374474
>typical joe is stuck on the challenge window
all I gotta do is connect ai to selenium and tell it to click a button.

Why don't they just apply the Anibis check to all HTTP requests? If you're using wget you deserve to get BTFO anyway.

RAPE HER, RAPE THAT ANIME GIRL!

>>106374496
The art is the only thing of value here.
The anime girl you want to fuck and rape and dominate.
That's what is of value.

>>106374620
>Anibis
ROOT AROUND IN Anibis' ANIS and PUSSY!
(the anime girl)

>>106373296 (OP)
>Anubis is gay
Faggot used to be applied to "useless old women".
It was a woman thing.

Anubis is a female anime character.
Yes she is a faggot.
So is the feminist bitch teachers you had.
So is the white "girl" with bolts through their face at 13.

They meet the english definition of faggot. Before homosexuals took it over.

>>106374749
I want the anime girl to fuck and rape and dominate me, though.

>>106374778
based maso

>>106373296 (OP)
Superior

>>106373296 (OP)
>Isn't this just blocking Browsers?
Most of this shit is so retarded... It's like some websites think that I'm a bot, because I have Linux in user agent and do many "requests" (open tabs).
Yeah, man. The creator of bots wouldn't even consider to think of setting the user agent to something much more common when scraping the website!

I'm more annoyed at something like Cloudflare, but fingerprinting challenges like these are still a problem though individually hosted is an improvement I guess. The hostility to "AI scraper bots" thing feels a bit more like a culture war bit than anything technical, when this concern wasn't as prevalent against all the other data miner bullshit in years past , but oh no here comes AI and people are screeching often because an "artist" feels threatened. I mean maybe this utility has nothing to do with all of that but one wonders.

Its crazy the unbranded version requires what appears to be a $50 patreon etc signup? Yeah yeah I know you can fork and fuck with it yourself, but you shouldn't have to do that and maintain a fork just to get around a name and aesthetic. Furthermore, the $50 appears to be something of a subscription option for commercial support and that's fine, but why the fuck bind that to the whiteboxed version? Why don't you separate the two. Leave the $50 for commercial support and whatnot bits, including customization/whitebox help etc.. but just let the basic user version opt between the Anubis with the anime character and the BotStopper with the generic graphic version, as they wish? The last thing you want for security focused software is to have a fuckload of forks laying around over minutia that makes it really easy for someone to make a hostile fork which the legit developers usually end up dealing with the blowback because "their" software did something horrible etc.

Also I don't give a shit about your gender in and of itself, but when you put
>embyware
on the goddamn page with a flag and all that shit, don't be surprised when people react negatively that you felt the need to put it out there.

>>106373296 (OP)
I don't understand how this is supposed to stop bots from big tech.

>>106375970
It's not supposed to.
Most of the mainstream bots identify themselves in the User-Agent header.

previous thread
>>106344979
>>106344979

>>106373296 (OP)
I already pointed at this in the first days of this faggotry. You can literally `curl -O` it bypassing this trannyware. It blocks Browsers' user-agents and allows anything else.

What funny is the sheer delusion you find in reddit clones when anyone dares to point at its stupidity, makes you realize that the reason of its use has nothing to do with the software, but the satanic retarded tranny (literally) behind it.

Someone should seriously ddos all the websites using it to teach them a lesson.

>Someone even built an extension to bypass this cuck shit by just changing your useragent to just the word "Browser".
lmao.
>https://addons.mozilla.org/en-US/firefox/addon/anubis-bypass/

>>106374749
>The anime girl
>girl
anon...

Long-time lobste.rs user (11 years) just got b& for refusing to submit to the Anubis regime.

https://lobste.rs/s/qw5iyf/why_are_anime_catgirls_blocking_my_access#c_zwtgcn

inb4

>INDIVIDUAL "friendlysock", YOU ARE CHARGED WITH CAPITAL MALCOMPLIANCE. ANTI-CITIZEN STATUS APPROVED. ACCESS TO ANUBIS-PROTECTED WEBSITES REVOKED.

>>106376015
Then what's the point in it?

>>106376536
To stop bots that disguise themselves as regular users from bypassing your rate limiter.

>>106376578
Okay, so this just brings me back to my original question: how does it accomplish that?

>pow in crypocurencies
>pow in every web request
<…

>>106374566
it never worked, though

>>106376623
I would do it like this:
- non-browser UAs get 5 requests per day per IP, and only allowed on https://static.mydoma.in/;
- browser UAs get the proof-of-work portal.
This allows people to still download some files with `wget` (whether due to preference or need), but if they have to download more then they can just use the browser.
Non-static content would always get the POW portal, no matter the user agent.

Remember, this is not intended to block access, but to cause the requestor to spend more resources fetching the page than the server spends generating it, thus giving the server a fighting chance when faced with 10k requests per minute from 10 AI scrapers who take turns taping the website.

>>106376887
>taping the website.
*raping

>>106373296 (OP)
Trannies help each other while white straight men find a ways to fuck each other.

>>106376130
>What funny is the sheer delusion you find in reddit clones when anyone dares to point at its stupidity, makes you realize that the reason of its use has nothing to do with the software, but the satanic retarded tranny (literally) behind it.
The concept of a JS Challenge that you can deploy with a simple container is alright. Most web administrators are just lazy, and if it is either this or Cloudflare, go with this.
But Anubis has obvious flaws and pointing out any issue gets you an:
>BUT IT WORKS, CHUD, ALL YOUR CRITICISM IS WORTHLESS BECAUSE IT WORKS!!!!
I don't have enough energy to argue with bad-faith retards. Go ahead and do your reactionary goose chase then.
At least admit that it is not the proof-of-work, but rather the JavaScript requirement, that ever looked like it stopped scrapers.

>>106376887
This seems trivial to spoof.

>>106376527
The normgroids must kneel to the tranime GODS

Strap him down and feed him estrogen and spironolactone

>>106376887
Or you could just rate limit endpoints according to what they are, independent of the User-Agent, and make your application smart enough to notice nonsensical traffic and block that one.

>>106373296 (OP)
>Anubis is gay
Oh yeah well then where is her girlfriend, huh?

OP BTFO by facts and logic

>>106376972
Or you could hide a honeypot-link in the html that only a bot would follow and temporary block whoever goes there.
Then restrict that link in the robots.txt, so that bots that adhere to it don't hit it.

>>106376100
That thread still isn't over.

Someone who doesn’t hate The Farms ought to compare and contrast this with their DDoS retarder
>>106373432
From what I understand AI scraper bots are poorly behaved and will rape your site’s bandwidth in ways indistinguishable from a DDoS designed to rack up your hosting bills for both frontend and backend
>>106376536
AI scraper bots pretend to be normal browsers
>>106376972
Slapping this on front seems easier than rate limiting

>>106377031
>seems easier
And that is the issue. Being lazy.
And this laziness will lead to more work, because you are constantly running after simple bypasses of your container portal.

Unless your website is completely utterly irrelevant and unimportant and you wouldn't need that portal in the first place, but still deploy it, because you can.

>>106377031
>AI scraper bots are poorly behaved and will rape your site’s bandwidth in ways indistinguishable from a DDoS designed...
And that is why a proper DDoS protection will also protect you from those bots.
Notice how the websites who went for Anubis are all platforms that were previously living in blissful ignorance and never had to defend against malicious actors whatsoever?
So they copied solutions that chuds developed who constantly had to fight those (kiwifarm proof-of-work), without even knowing why they work that way, so they punched holes into theirs by thinking that the User-Agent matters.

>>106376985
Don't you mean, polyam girlfriends?

I prefer https://basedflare.com desu

>>106373755
You know what else would block script kiddies? So why have they reinvented and then over-engineered the wheel?

>>106376527
Fucking hilarious that they're basically threatening to call the police if someone outs these freaks as the pedos that they are

>>106373296 (OP)
New update

>>106376527
He should kill them for threatening to call the police on him.

Could you tell them that "Mikeeusa will eventually kill you for opposing freedom of speech, and opposing loli brides"
Please.

I will eventually kill these people dead.
YHWH willing.

They oppose men marrying young girls, just as the person they are responding to.

>>106378910
YHWH explicitly allows child brides.
These people oppose loli brides.
They hate pedos and ban them: just as you seething white faggots hate pedos and ban them

Child brides is the correct marraige according to God (YHWH).
You oppose this.

You deserve to die: just as these people do: for the same reason.
Along with your Macrioin and his Jesus.

>>106378910
Trans and Gay hate pedos.
Just as they love Jesus.

For the same reason Jesus hated YHWH.

not forcing everyone, including lynx and w3 tards, to solve the PoW challenge was a retarded mistake.

>>106376130
>check code
>looks safu
>install it
>go to https://gitlab.freedesktop.org
>it actually works

holy kek, did retards set this up? why is this the default behavior?

>>106374749
>art

>>106376949
anon.. only low level scrapers spoof UA but don't do javascript. seriously, how many sites are there where UA spoofing without cookie grafting is even useful?
>>106377031
it's basically the same as far as I can tell. I think they use a different hash that's a bit more cpu hard
>>106379247
we need a web pow api that all text browsers are patched with.

>>106379322
>we need a web pow api that all text browsers are patched with.
probably. good luck with that though.
they couldn't even get hashcash in email, so instead we cope with shitty IP reputation niggerlists and greylisting. (none of these work).

not saying PoW is better, but if the challenge makes something that can take milliseconds, take a solid 10 sec, that drastically kills spam volume and will definitely eat into spamming cost.
It's obvious when anubis came out it was working well, but now retarded defaults + shitty window.crypto use was a bad idea.

>>106379322
>we need a web pow api that all text browsers are patched with.
the only chance I can see it happening is if you can maybe do a 401 with WWW-Authenticate and put the hashcash challenge there. it could work. someone would have to write and champion the spec though and no one will accept it from an outsider sadly.

seems like the absolute perfect use of it though. just copying the NTLM flow alone is probably what we'd need.

>>106379389
Making it a standard would bring wide adoption. Wide adoption would cause scrapers to adapt to it. If scrapers adapt to it it's fucking worthless. Do the math. The main cost of compute at scale is energy. A typical phone can hold a fraction of a penny in electricity. You can only feasibly use another fraction of that per pow challenge. So the pow could cost at most maybe $1e-6. A scraper has no problem paying that for each page. But even at that minute cost it would make the web painfully slow to browse and kill battery life.

It could maybe work if you designed it around high performance desktops, or assuming the user would pay a subscription fee to a pow completing service. But good luck making a standard that assumes that.

>>106379350
the thing with email is they'd like everyone subservient to the spamhaus mafia, itself empowered by gmail.
>>106379389
I think if anubis got enough traction the project could use its weight to have all the typical nojs UAs adopt something. and if they don't it'd just be as if they were cloudflared, anyway. hopefully that day comes sooner than all the AI scrapers just dropping the UA spoof when they see anubis.
I like the idea of piggybacking existing standards. from what I can see of ntlm you could just extend it such that the username is the "password" that creates a response hash with n amounts of leading zeroes, and define n and the hash used in the domain or whatever.
>>106379545
if the pow is in an api it would be trivial to make it cpu-hard. you could straight up rip out randomx and use it as-is.
as for paying for views, cloudflare has already cornered that market by letting scrapers through if they pay a fee that cloudflare shares with you.

>>106379650
>if the pow is in an api it would be trivial to make it cpu-hard
you seem to be answering a theoretical "what if the scrapers used asics?" question which I didn't pose. I'm saying if the scrapers had farms of mobile phones that weren't plugged into the wall so they had to go and recharge them every few hours, then the pow system still wouldn't work. Obviously the fact that scrapers have access to much more efficient hardware (meaning server cpus in the case of randomx), cheaper electricity (they can stick their server in the desert hooked up to solar panels that only run when the sun shines), etc makes the plan even less workable.

>>106373296 (OP)
It should block script kiddie shit. Anything more sophisticated can trivially get around it. I'm not sure if just blocking the laziest bots ever is good enough or not.

>>106376955
>spoof
For what gain? And how are you going to spoof an IP?

>>106376972
>just rate limit endpoints
We're talking websites here, there aren't any "endpoints".
Also, rate to what limit? Your regular visitors have 1-2 IPs, whereas bots have thousands of IPs at their disposal.

>>106373432
>nooo you NEED to let aislop bots ddos your website so it can hallucinate false nonsense

>>106373296 (OP)
I think I am getting old, any time I would across a character like in the OP, I would furiously look up porn of them to fap to.
But now a days I do not even get a partial chubby.
Is this what living past 30 is like?

>>106376130
what the fuck is this argument?, Anubis not challenging all of user agent by default is a retard-proof deployment considering it's open sores nature. it reduces retarded stupid "ticket" in github.
nothing is stopping you to modify that behavior using patchfile during compile time, or using Dockerfile if it's integrated with traefik.

>>106379781
okay? the numbers still don't add up. scrapers work on orders of magnitude more page visits than you do. if the scraper isn't saturating gigabit lines with just text it's not doing its job.
this would be extremely obvious if you actually knew anythig about scraping.

>>106382662
At $1e-6 per page (that's 1 pow per page, where each pow takes 1/100 of your phones battery) 1 million pages is $1, 1 billion pages is $1000, and 1 trillion pages is $1 million. The AI companies doing the scraping piss away that kind of money in a weekend. Your phone does not have the battery power needed to solve meaningful pows.

>>106373296 (OP)
>Anubis is gay
Well, your homophobic transphobic ass got that right, but only in the same way that a broken clock is right twice a day.

>>106373296 (OP)
so where's the Rule 34?

>>106373296 (OP)
you can literally just headless=false in playwright and it will pass
also ai crawlers consume probably less than an average user
whoever tranny made this is just making the internet worse

>>106382886
say native randomx mining on btc difficulty on a 12x weaker than a typical mid to high range desktop cpu costs 1e-5 per second (12 / 365.25 * 12 / 3600 / 12). allow for 5s per page with background pow for future oages. 20k pages for average 100k per page (without js, images etc) on a 1 gigabit connection is $1 every 16 seconds, $225 per hour.
remember the crawling is not a first-time data collection pass, but continuous, google-esque polling websites for new content to serve as their moat for their models. and the vast vast majority of scraping is for AI search engine use cases where cost savings is paramount because the cost scales to the users of your model.
your math is insanely retarded, and indicative of someone completely ignorant to the subject.
>>106385294
how smart did posting that made you feel?

>>106385883
12x weaker than btc for weak cpus*.

>>106384021
better a broken clock than a missing cock