So just to be clear, you don’t think they solved it? So is the proof flawed, or do you think they stole it (from an incomplete solution to a weaker problem)?
Looking forward to what your cope will be when they solve the next one.
Republican appointed official behaves like a petulant child - how shocking. If you want this embarrassing behavior to end, vote for the adults in the room in the midterms and demand accountability.
How do you know that not connecting it is sufficient to stop the spying?
There are a few large IoT-focused networks like Amazon Sidewalk where conceivably the smart TV could connect to them if you don't connect it to your home wifi. I believe many ISPs like Xfinity also runs shared public wifi from their routers - a tv could connect via your neighbor's ISP-provided router and you wouldn't have any idea.
The assumption is that requiring 1 second of compute before allowing a page load will have more impact on the people requesting 1000 pages/sec than it will on consumers requesting 1 page every minute.
Personally I don’t understand where this confusion comes from - it’s a simple economic tactic. Yes the large scale scrapers won’t run out of compute but putting anubis in front of a website demonstrably reduces the amount of crawling and that is the entire goal.
> requiring 1 second of compute before allowing a page load
After 1 solve, you get a cookie and can load tons of pages with it. Scrapers and user agents alike will need to spend the compute only once to get a valid session for themselves
Seems to be working so far though. Fwiw, lots of silly things stop bots until someone puts their mind (or tokens) to bypassing it, and then the blocking mechanism has to adapt. We'll see how it plays out, for now it's a lot better than begging big brother (cloudflare, google, or amazon captcha) for access, so I'm quite appreciative of what Techaro is doing
The issue is that scrapers are rotating their IP and essentially performing a DDoS attack. Anubis is part of a defense-in-depth solution. If scrapers reuse a cookie, traditional anti-abuse mechanisms will work.
I don't know what you mean by traditional anti-abuse (typing over two words from an image?), but switching IP addresses rapidly, while staying recognisable as one entity because of the unique cookie, is not normal user behavior so this would be trivial to filter out for something like Anubis and require another solve. Maybe that's what you meant though?
>If scrapers reuse a cookie, traditional anti-abuse mechanisms will work.
Scrapers can't change their strategy? It's not hard to think of mitigations: keep on using a session until you're banned, and failing that rotate your IP. Nowadays you don't even need to think. You can probably tell a LLM "write me a scraper that has adaptive anti-anti-bot mechanism".
Yes, but you normally don't try to fight all strategies up front, you add stuff on a need-to basis. Currently, lots of people are in the stage of "need to get this thing using bunch of IPs to stop hammering my servers", apparently Anubis helps them with that. If that stops working, other tactics are tried, and so it goes on for the life of your service. Hasn't stopped yet, doesn't seem to be stopped soon either.
That argument also works against anubis. Why bother forcing clients to solve a PoW challenge, when you're fighting a bunch of unsophisticated attackers that will be deterred by a javascript challenge that requires them to solve `result = x + y`?
You're not fighting unsophisticated attackers. 50% of them are, maybe. The rest? They're actively hostile, detecting blocking attempts, moving on to botnets, DDoSing you and trying everything they can to bypass you.
People have been sent to jail for participating in LOIC attacks which were less destructive that what these bots do on the daily.
Point is, you get problems because of something like this, you try either approach. And when that stops working (because eventually it will), you add something else. Some work better against some actors, but also feels like it never ends, so slowly you add more things. I don't think Anubis is uniquely able to stop that particular type of annoyance, it's just one of the tools you can see if it helps. If you want to try something else before, makes a lot of sense to do so.
Plenty of these abusive scrapers are utilizing retail residential proxies, which will be applying forced rotations to avoid "burning" their compromised and or otherwise surreptitiously utilized IP address.
I would disagree with the Anubis effectiveness falling off, but the llm bros are throwing life itself into training to defeat any “perceived” challenge.
Yep, on my aging phone it takes quite w noticable amount of time to go through. But on my more recent laptop wnd workstations, it's a quick flash of a manga lolita.
You could just spend 30 seconds googling instead of confidently asserting nonsense. There are plenty of people demonstrating that Anubis reduces bot traffic.
That’s because its weird and mostly irrelevant, it’s nothing to do with the proof of work being any sort of economic impediment. It takes Claude a few minutes to write a near instant solver, that’s the maximum proof of work cost this adds.
This strain of nihilism about anti-bot efforts baffles me. Cloudflare built a gigantic business on stopping DDoS attacks. There will never be good faith self-restraint by AI bros, there is too much money at stake and no regulation, doing nothing means your only alternative is disconnect from the Internet. Anubis introduces enough friction that some percentage of the lunacy is throttled and possibly give your server a fighting chance.
>There are plenty of people demonstrating that Anubis reduces bot traffic.
"Anubis reduces bot traffic" and "[the proof of work] is not stopping anyone" isn't contradictory, especially if anubis isn't being benchmarked against non-POW alternatives like IP/ASN bans, or tls fingerprinting.
IP blocks don't work, because they're using proxy networks so that you see an ip address 1 or 2 times within 10 minutes. They have effectively infinite ip addresses. (actually, looking at my data from today, I think this relationship holds over ~3 hours, where we're seeing ip address cardinality at about 1/2 of the hits.)
* Sometimes there's a pattern to the country. Oftentimes, not.
* User-agent, rotated between common, valid, current web browsers.
* Other headers, sec-*, accept, etc, generally valid and rotating.
* Bots will load the site to saturation in a denial of wallet attack.
The only thing that's specific is:
* urls have a pattern.
* it's obviously invalid traffic.
(non-bot traffic on my sites does not go from 0 to 200r/sec on the search interface in seconds. It does not go away that fast either)
>The assumption is that requiring 1 second of compute before allowing a page load will have more impact on the people requesting 1000 pages/sec than it will on consumers requesting 1 page every minute.
Which doesn't hold. A 1s delay, despite being inperceptible is still a cost to human users. After all, 3600 x 1s delay adds up to an hour. Worse yet, the typical human visitor will always have to solve a challenge, because chances are it's the first time they're visiting your blog or whatever. Someone scraping reuse a valid session for at least a few more pages.
There's also the problem of time. It might be tempting to think the cost of a challenge is 1M cpu cycles or whatever, but the cost is better modeled as two parts, a time cost (for the human) and a cpu cost (for the computer). A scraper might have to pay the cpu cost, but not the time cost, because they can have their scraper solve challenges in their sleep. Unless the user is utterly destitute, their time is worth far more than whatever the compute cost is.
Well the big thing that stands out in the reliability front is that AWS and Google cloud are typically stable, certainly more than 3 nines. Meanwhile openai seems to roll dice on every request to see if they’re going to return a 500 or not.
Using cloud hosted models that are created as a psy-op by domestic billionaires and crypto-fascists will end badly.
At least with self-hosted models the people running them get full control and don’t need to worry about the model or guardrails changing under their feet.
Be specific, use your big-person words like an adult. What specifically is the broader issue?
> You don't get what @amiga386 was implying
I think most of us get exactly what they're implying - they don't agree with the politics of the people running nexus (seems like they're scared of pronouns to me) - and don't really have anything concrete beyond that, so they're waving their hands and complaining about nexus abiding by the law.
The broader issue is people who publish on Nexus Mods appear to face more political restrictions than game developers publishing on Steam. I wonder if Nexus Mods will abuse their acquired control of SteamDB to censor it to their tastes, meaning it stops accurately reflecting Steam.
You can't just ignore network effects when you dismiss issues like this. The market share of Nexus is such that if a mod isn't on there then, for many games, it is effectively invisible to most gamers. We should hold platforms with that kind of reach to higher standards.
Your victim complex is ridiculous, and unwarranted. You are demanding that a private company host content that they don’t agree with just because YOU feel aggrieved.
> Bun rewrite took 6 days of coding and was a similar number of LoC, so I think a couple of weeks is definitely reasonable, although you probably need more than 5 Claude subs.
Bun had numerous standardized and extensive javascript test suites to validate the slop code against. I doubt paint.net has test coverage anywhere near that complete, and without it using LLMs to rewrite something is a much larger risk.
Besides which, Bun claims the rewrite took 6 days but they took months after that to finish hammering out the bugs and actually ship, so I don't really buy the original price tag or timeline on their rewrite.
reply