5 ms·

I am really enjoying seeing this use-case for PoW gain popularity. Hopefully it normalizes the technique and it can start to become more common for anti-spam sy

I am really enjoying seeing this use-case for PoW gain popularity. Hopefully it normalizes the technique and it can start to become more common for anti-spam systems.

charcircuit 2y ago
Spammers are willing to dedicate more processing power than regular users. It doesn't make sense to do. It's either meaningless or ruins the user experience for normal people.
- losvedir 2y ago
  Regular users aren't trying to load billions of pages.
  - charcircuit 2y ago
    What's your point?
    - mariusor 2y ago
      When the compute power to access a page has just doubled, when you view 10 pages it's not a problem, but when you view 1 billion of them, it is.
      - charcircuit 2y ago
        The compute power is not going to be a problem even at a billion pages. Lets say that a challenge targeted towards a cheap phone can be solved by a workstation CPU at 1000 challenges per second. And let's say each challenge lets you visit 100 pages. So for a billion pages you need only a few hours of 1 machine's compute. If you try and make the amount of compute to be a problem, then it will become a problem to regular users of the site and it will drive away regular people.
        mariusor 2y ago
        You seem to be very confident, but from what I've seen online most people that employed this type of countermeasures did really have a drop in requests. I can't find the graphs I've seen about this at the moment, but I'll update if I do.
        charcircuit 2y ago
        It only protects against people who aren't specifically targeting you. I am confident because I've had people target a site of mine.
        mariusor 2y ago
        Then I think you're talking about a different problem than the Konstantin and wikipedia, and sourcehut and codeberg and everyone else is complaining about lately, which is the subject under discussion.
        charcircuit 2y ago
        It will buy time until the next generation of crawlers is created.
Sesse__ 2y ago
Why do you assume that spammers and AI crawlers do not have access to large amounts of compute? You can make it more expensive, but these crawlers already have made it clear that they do not care particularly about cost (or they would not crawl so completely indiscriminately).
- arccy 2y ago
  um no? sending an http request is quite a bit different than some forced pow calculation
  - Sesse__ 2y ago
    Why? Don't you think these companies can use Puppeteer or similar and just take that second or so of compute to get a cookie for lore.kernel.org?
codetrotter 2y ago
https://blog.torproject.org/introducing-proof-of-work-defense-for-onion-services/ https://blog.torproject.org/introducing-proof-of-work-defens... Tor has similarly been using Proof of Work as part of the defense for onion services for around a year and a half now. I’ve also seen some clear net web sites that use PoW to slow down account creation. Some websites will even adjust the difficulty for individual visitors depending on the recent number of sign-ups coming from their IP block. More signups from an IP block -> higher PoW difficulty for anyone from that IP block -> fewer accounts created by anyone in that IP block over a span of time.

I am really enjoying seeing this use-case for PoW gain popularity. Hopefully it normalizes the technique and it can start to become more common for anti-spam systems.

charcircuit 2y ago

Spammers are willing to dedicate more processing power than regular users. It doesn't make sense to do. It's either meaningless or ruins the user experience for normal people.

losvedir 2y ago
Regular users aren't trying to load billions of pages.
- charcircuit 2y ago
  What's your point?
  - mariusor 2y ago
    When the compute power to access a page has just doubled, when you view 10 pages it's not a problem, but when you view 1 billion of them, it is.
    - charcircuit 2y ago
      The compute power is not going to be a problem even at a billion pages. Lets say that a challenge targeted towards a cheap phone can be solved by a workstation CPU at 1000 challenges per second. And let's say each challenge lets you visit 100 pages. So for a billion pages you need only a few hours of 1 machine's compute. If you try and make the amount of compute to be a problem, then it will become a problem to regular users of the site and it will drive away regular people.
      - mariusor 2y ago
        You seem to be very confident, but from what I've seen online most people that employed this type of countermeasures did really have a drop in requests. I can't find the graphs I've seen about this at the moment, but I'll update if I do.
        charcircuit 2y ago
        It only protects against people who aren't specifically targeting you. I am confident because I've had people target a site of mine.
        mariusor 2y ago
        Then I think you're talking about a different problem than the Konstantin and wikipedia, and sourcehut and codeberg and everyone else is complaining about lately, which is the subject under discussion.
        charcircuit 2y ago
        It will buy time until the next generation of crawlers is created.

Sesse__ 2y ago

Why do you assume that spammers and AI crawlers do not have access to large amounts of compute? You can make it more expensive, but these crawlers already have made it clear that they do not care particularly about cost (or they would not crawl so completely indiscriminately).

arccy 2y ago
um no? sending an http request is quite a bit different than some forced pow calculation
- Sesse__ 2y ago
  Why? Don't you think these companies can use Puppeteer or similar and just take that second or so of compute to get a cookie for lore.kernel.org?

codetrotter 2y ago

https://blog.torproject.org/introducing-proof-of-work-defense-for-onion-services/ https://blog.torproject.org/introducing-proof-of-work-defens... Tor has similarly been using Proof of Work as part of the defense for onion services for around a year and a half now. I’ve also seen some clear net web sites that use PoW to slow down account creation. Some websites will even adjust the difficulty for individual visitors depending on the recent number of sign-ups coming from their IP block. More signups from an IP block -> higher PoW difficulty for anyone from that IP block -> fewer accounts created by anyone in that IP block over a span of time.