4 ms·

Like burning down you house so squatters can't use it. A poisoning attack that makes communication itself untrusted. Wondering if we will get to extreme recipro

Like burning down you house so squatters can't use it. A poisoning attack that makes communication itself untrusted. Wondering if we will get to extreme reciprocal mistrust eventually. This also reminds me of art images doctored to break models if they get into the training set, by applying invisible features with different semantics.

hinkley 2y ago
Making requests in bad faith is also an attack on communication itself.
- immibis 2y ago
  No? Not when the requests are served by a machine with the capacity to answer a hundred times more requests than are actually made. The only bad faith request for information is the one that wasted the answerer's time, which isn't usually happening here. It happens sometimes, but we're also trying to block the times that doesn't happen. Why?
  - rk06 2y ago
    requests are not served by just machine, there is also a huge network of wires spread across the globe for transmission. and getting bandwidth on that is pricey when AI crawler spams you
    - immibis 2y ago
      When any crawler spams you, but most bots do not spam you. They retrieve something at some reasonable rate. Btw cloudflare considers any browser other than the last few versions of Firefox, Safari and Chrome to be a bot. Such as Pale Moon. It blew up on Hacker News when CF demanded the PM devs to sign an insane NDA to get unblocked.
nonchalantsui 2y ago
More like having a series of fake doors and rooms built out in front of your home, with most of them leading back outside and not into the home.
- deleted 2y ago
  [deleted]
- DangitBobby 2y ago
  Something of a labyrinth for AI crawlers, if you will.
- TeMPOraL 2y ago
  More like it being a store, not a house, inside being a complex maze of obnoxious ads, inhabited by performance artists who distract you so pickpockets can rob you - and because locals figured out blind people are immune to this, they started paying them to buy stuff for them, and now you retrofit the maze to have confusing tactile markings, as to direct blind people back out of the store. The AI paranoia is getting out of hand. Worrying about bots spamming you is one thing, but discriminating on crawlers specifically because they're from AI companies - and conveniently omitting the difference between a bot that's crawling (and should obey robots.txt) vs. a bot that's acting as user agent (and should not care about robots.txt) - isn't just poisoning communication; it's setting the commons on fire. See also: The Dog in the Manger.
  - egypturnash 2y ago
    There’s been multiple articles on the front page of HN about how there’s a ton of AI crawlers that are really bad citizens - ignoring robots.txt, ignoring cache, re-scanning pages multiple times a day. The commons is already on fire and it’s not because of the actions of any of the “locals”.
    - TeMPOraL 2y ago
      How is that different than non-AI crawlers doing the same for the past decade or so? Tons of businesses engage in site crawling and scrapping, and many of them are bad citizens. My issue isn't with blocking bad-behaving bots - it's with singling out LLMs (both training and use), or worse, assuming the problem is being associated with AI and not bad bot behavior.
theamk 2y ago
When you say "reciprocal mistrust", what parties do you have in mind? Websites not trusting visitors and visitors ot trusting websites? because the latter was already the case, and AI made it much worse. Any unfamiliar websife could be AI generated and therefore void of original cobtent and full of unverified facts.
urbandw311er 2y ago
Not quite - all the information on the fake pages is accurate and real, so it’s not an attempt to poison training data, just to waste resource. Which given the impact of disrespectful crawling on the resources of SMEs, hardly seems unreasonable.
cyanydeez 2y ago
Like googles captcha, this will just prune the weak bots and make the other bots stronger.
- akoboldfrying 2y ago
  Weak bots are easy to make, so pruning "just" them is highly effective in reducing the total number of bot requests. How do CAPTCHAs make other bots stronger?
  - aftbit 2y ago
    The same way antibiotics make bacteria "stronger" - evading them is survival itself for some of the products and teams, so they will evade them. The arms race always continues. This is a powerful new weapon that will shut down a lot of bad actor volume but the bad actors abide.
    - akoboldfrying 2y ago
      Sure, the individual bots that adapt to solve the CAPTCHAs are stronger than before in the sense that there are pages they can crawl that their earlier versions could not. But the subset of pages that they can crawl hasn't increased in an absolute sense: For any page that they can crawl now, the old (CAPTCHA-free) version of that page could already be crawled by the old (non-CAPTCHA-solving) version of the bot. So in that sense, nothing is lost by adding CAPTCHAs to pages.
s900mhz 2y ago
It’s like in roller coaster tycoon, when you trap the guests on a ride by making the exit lead directly back into the queue.
bulatb 2y ago
We've got to stop with this. Bad actors acting in bad faith, causing damage? Well... you know, it's just how they are... They have a right... to... Who's to say they're really bad? You know? I mean just look at that guy over there. What about him? Good actors, fed up, responding in a way that doesn't cut the willful hostiles every bit of slack you can imagine, which potentially could maybe cause a little bit of damage, which would stop as soon the attack was over? Punish them, they'll ruin everything.
- aloha2436 2y ago
  > Bad actors acting in bad faith, causing damage? Totally fine. Who in this thread is saying this is totally fine?
  - ccgreg 2y ago
    Cloudflare, apparently.
  - bulatb 2y ago
    The comment I responded to. I take it to be musing from the bailey. Maybe I'm wrong, I don't know. I'm just a person who keeps hearing, from every direction, "Won't someone please think of the assholes?" --- Edit: My comment above used to say what was quoted. I changed it to be more precise about my issue with the comment I replied to.
- immibis 2y ago
  I agree, but to be clear, the bad actor you're referring to is cloudflare and the good actor you're referring to is any actor seeking information on the internet.

hinkley 2y ago

Making requests in bad faith is also an attack on communication itself.

immibis 2y ago
No? Not when the requests are served by a machine with the capacity to answer a hundred times more requests than are actually made. The only bad faith request for information is the one that wasted the answerer's time, which isn't usually happening here. It happens sometimes, but we're also trying to block the times that doesn't happen. Why?
- rk06 2y ago
  requests are not served by just machine, there is also a huge network of wires spread across the globe for transmission. and getting bandwidth on that is pricey when AI crawler spams you
  - immibis 2y ago
    When any crawler spams you, but most bots do not spam you. They retrieve something at some reasonable rate. Btw cloudflare considers any browser other than the last few versions of Firefox, Safari and Chrome to be a bot. Such as Pale Moon. It blew up on Hacker News when CF demanded the PM devs to sign an insane NDA to get unblocked.

nonchalantsui 2y ago

More like having a series of fake doors and rooms built out in front of your home, with most of them leading back outside and not into the home.

deleted 2y ago
[deleted]
DangitBobby 2y ago
Something of a labyrinth for AI crawlers, if you will.
TeMPOraL 2y ago
More like it being a store, not a house, inside being a complex maze of obnoxious ads, inhabited by performance artists who distract you so pickpockets can rob you - and because locals figured out blind people are immune to this, they started paying them to buy stuff for them, and now you retrofit the maze to have confusing tactile markings, as to direct blind people back out of the store. The AI paranoia is getting out of hand. Worrying about bots spamming you is one thing, but discriminating on crawlers specifically because they're from AI companies - and conveniently omitting the difference between a bot that's crawling (and should obey robots.txt) vs. a bot that's acting as user agent (and should not care about robots.txt) - isn't just poisoning communication; it's setting the commons on fire. See also: The Dog in the Manger.
- egypturnash 2y ago
  There’s been multiple articles on the front page of HN about how there’s a ton of AI crawlers that are really bad citizens - ignoring robots.txt, ignoring cache, re-scanning pages multiple times a day. The commons is already on fire and it’s not because of the actions of any of the “locals”.
  - TeMPOraL 2y ago
    How is that different than non-AI crawlers doing the same for the past decade or so? Tons of businesses engage in site crawling and scrapping, and many of them are bad citizens. My issue isn't with blocking bad-behaving bots - it's with singling out LLMs (both training and use), or worse, assuming the problem is being associated with AI and not bad bot behavior.

theamk 2y ago

When you say "reciprocal mistrust", what parties do you have in mind? Websites not trusting visitors and visitors ot trusting websites? because the latter was already the case, and AI made it much worse. Any unfamiliar websife could be AI generated and therefore void of original cobtent and full of unverified facts.

urbandw311er 2y ago

Not quite - all the information on the fake pages is accurate and real, so it’s not an attempt to poison training data, just to waste resource. Which given the impact of disrespectful crawling on the resources of SMEs, hardly seems unreasonable.

cyanydeez 2y ago

Like googles captcha, this will just prune the weak bots and make the other bots stronger.

akoboldfrying 2y ago
Weak bots are easy to make, so pruning "just" them is highly effective in reducing the total number of bot requests. How do CAPTCHAs make other bots stronger?
- aftbit 2y ago
  The same way antibiotics make bacteria "stronger" - evading them is survival itself for some of the products and teams, so they will evade them. The arms race always continues. This is a powerful new weapon that will shut down a lot of bad actor volume but the bad actors abide.
  - akoboldfrying 2y ago
    Sure, the individual bots that adapt to solve the CAPTCHAs are stronger than before in the sense that there are pages they can crawl that their earlier versions could not. But the subset of pages that they can crawl hasn't increased in an absolute sense: For any page that they can crawl now, the old (CAPTCHA-free) version of that page could already be crawled by the old (non-CAPTCHA-solving) version of the bot. So in that sense, nothing is lost by adding CAPTCHAs to pages.

s900mhz 2y ago

It’s like in roller coaster tycoon, when you trap the guests on a ride by making the exit lead directly back into the queue.

bulatb 2y ago

We've got to stop with this. Bad actors acting in bad faith, causing damage? Well... you know, it's just how they are... They have a right... to... Who's to say they're really bad? You know? I mean just look at that guy over there. What about him? Good actors, fed up, responding in a way that doesn't cut the willful hostiles every bit of slack you can imagine, which potentially could maybe cause a little bit of damage, which would stop as soon the attack was over? Punish them, they'll ruin everything.

aloha2436 2y ago
> Bad actors acting in bad faith, causing damage? Totally fine. Who in this thread is saying this is totally fine?
- ccgreg 2y ago
  Cloudflare, apparently.
- bulatb 2y ago
  The comment I responded to. I take it to be musing from the bailey. Maybe I'm wrong, I don't know. I'm just a person who keeps hearing, from every direction, "Won't someone please think of the assholes?" --- Edit: My comment above used to say what was quoted. I changed it to be more precise about my issue with the comment I replied to.
immibis 2y ago
I agree, but to be clear, the bad actor you're referring to is cloudflare and the good actor you're referring to is any actor seeking information on the internet.