5 ms·

If you’re confused about what this is - it’s to prevent AI scraping. > Anubis uses a proof-of-work challenge to ensure that clients are using a modern browser

by gyomu 2y ago

If you’re confused about what this is - it’s to prevent AI scraping. > Anubis uses a proof-of-work challenge to ensure that clients are using a modern browser and are able to calculate SHA-256 checksums https://anubis.techaro.lol/docs/design/how-anubis-works https://anubis.techaro.lol/docs/design/how-anubis-works This is pretty cool, I have a project or two that might benefit from it.

x3haloed 2y ago
I’ve been wondering to myself for many years now whether the web is for humans or machines. I personally can’t think of a good reason to specifically try to gate bots when it comes to serving content. Trying to post content or trigger actions could obviously be problematic under many circumstances. But I find that when it comes to simple serving of content, human vs. bot is not usually what you’re trying to filter or block on. As long as a given client is not abusing your systems, then why do you care if the client is a human?
- t-writescode 2y ago
  > I personally can’t think of a good reason to specifically try to gate bots There's been numerous posts on HN about people getting slammed, to the tune of many, many dollars and terabytes of data from bots, especially LLM scrapers, burning bandwidth and increasing server-running costs.
  - ronsor 2y ago
    I'm genuinely skeptical that those are all real LLM scrapers. For one, a lot of content is in CommonCrawl and AI companies don't want to redo all that work when they can get some WARC files from AWS. I'm largely suspecting that these are mostly other bots pretending to be LLM scrapers. Does anyone even check if the bots' IP ranges belong to the AI companies?
    - t-writescode 2y ago
      No matter the source, the result is the same, and these proof of work systems may be something that can help "the little guy" with their hosting bill
      - ronsor 2y ago
        If a bot claims to be from an AI company, but isn't from the AI company's IP range, then it's lying and its activity is plain abuse. In that case, you shouldn't serve them a proof of work system; you should block them entirely.
        thunderfork 2y ago
        Blocking abusive actors can be very non-trivial. The proof-of-work system mitigates the amount of effort that needs to be spent identifying and blocking bad actors.
    - anonym29 2y ago
      >Does anyone even check if the bots' IP ranges belong to the AI companies? Sounds like a fun project for an AbuseIPDB contributor. Could look for fake Googlebots / Bingbots, etc, too.
    - userbinator 2y ago
      Also suspect those working on "anti-bot" solutions may have a hand in this. What better way to show the effectiveness of your solution, than to help create the problem in the first place.
      - zaphar 2y ago
        Why? When there are 100s of hopeful AI/LLM scrapers more than willing to do that work for you what possible reason would you have to do that work? The more typical and common human behavior is perfectly capable of explaining this. No reason to reach for some kind of underhanded conspiracy theory when simple incompetence and greed is more than adequate to explain it.
- gbear605 2y ago
  The issue is not whether it’s a human or a bot. The issue is whether you’re sending thousands of requests per second for hours, effectively DDOSing the site, or if you’re behaving like a normal user.
- xboxnolifes 2y ago
  > As long as a given client is not abusing your systems, then why do you care if the client is a human? Well, that's the rub. The bots are abusing the systems. The bots are accessing the contents at rates thousands of times faster and more often than humans. The bots also have access patterns unlike your expected human audience (downloading gigabytes or terabytes of data multiples times, over and over). And these bots aren't some being with rights. They're tools unleashed by humans. It's humans abusing the systems. These are anti-abuse measures.
  - bbor 2y ago
    Well, that's the meta-rub: if they're abusing, block abuse. Rate limits are far simpler, anyway! In the interest of bringing the AI bickering to HN: I think one could accurately characterize "block bots just in case they choose to request too much data" as discrimination! Robots of course don't have any rights so it's not wrong, but it certainly might be unwise.
    - inejge 2y ago
      > Rate limits are far simpler, anyway! Not when the bots are actively programmed to thwart them by using far-flung IP address carousels, request pacing, spoofed user agents and similar techniques. It's open war these days.
      - parineum 2y ago
        Request pacing sounds intentionally unabusive.
        rollcat 2y ago
        It's called DDoS. DDoS is abusive.
        j16sdiz 2y ago
        It is not bringing down your server, but they are taking 80%+ of your bandwidth budget. Does this count as abuse?
- laserbeam 2y ago
  The reason is: bots DO spam you repeatedly and increase your network costs. Humans don’t abuse the same way.
- praptak 2y ago
  The good thing about proof of work is that it doesn't specifically gate bots. It may have some other downsides - for example I don't think that Google is possible in a world where everyone requires proof of work (some may argue it's a good thing) but it doesn't specifically gate bots. It gates mass scraping.
  - fc417fc802 2y ago
    Things like google are still possible. Operators would need to whitelist services. Alternatively shared resources similar in spirit to common crawl but scaled up could be used. That would have the benefit of democratizing the ability to create and operate large scale search indexes.
- starkrights 2y ago
  Example problem that I’ve seen posted about a few times on HN: LLM scrapers (or at least, an explosion of new scrapers) exploding and mindlessly crawling every singly HTTP endpoint of a hosted git-service, instead of just cloning the repo. (entirely ignoring robots.txt) The point of this is that there has recently been a massive explosion in the amount of bots that blatantly, aggressively, and maliciously ignore and attempt to bypass (mass ip/VPN switching, user agent swapping, etc) anti-abuse gates.
  - deleted 2y ago
    [deleted]
- mieses 2y ago
  There is hope for misguided humans.
- brikym 2y ago
  As both a website host and website scraper I can see both sides of it. The website owners have very little interest in opening their data up; if they did they'd have made an API for it. In my case it's scraping supermarket prices so obviously big-grocery doesn't want a spot light on their arbitrary pricing patterns. It's frustrating for us scrapers but from their perspective opening up to bots is just a liability. Besides bots just spamming the servers getting around rate limits with botnets and noise any new features added by bots probably won't benefit them. If I made a bot service that would split your orders over multiple supermarkets, or buy items temporally as prices drop that wouldn't benefit the companies. All the work they've put into their site is to bring them to the status quo and they want to keep it that way. The companies don't want an open internet, only we do. I'd like to see some transparency laws so that large companies need to publish their pricing.
deleted 2y ago
[deleted]

by gyomu 2y ago

x3haloed 2y ago

I’ve been wondering to myself for many years now whether the web is for humans or machines. I personally can’t think of a good reason to specifically try to gate bots when it comes to serving content. Trying to post content or trigger actions could obviously be problematic under many circumstances. But I find that when it comes to simple serving of content, human vs. bot is not usually what you’re trying to filter or block on. As long as a given client is not abusing your systems, then why do you care if the client is a human?

t-writescode 2y ago
> I personally can’t think of a good reason to specifically try to gate bots There's been numerous posts on HN about people getting slammed, to the tune of many, many dollars and terabytes of data from bots, especially LLM scrapers, burning bandwidth and increasing server-running costs.
- ronsor 2y ago
  I'm genuinely skeptical that those are all real LLM scrapers. For one, a lot of content is in CommonCrawl and AI companies don't want to redo all that work when they can get some WARC files from AWS. I'm largely suspecting that these are mostly other bots pretending to be LLM scrapers. Does anyone even check if the bots' IP ranges belong to the AI companies?
  - t-writescode 2y ago
    No matter the source, the result is the same, and these proof of work systems may be something that can help "the little guy" with their hosting bill
    - ronsor 2y ago
      If a bot claims to be from an AI company, but isn't from the AI company's IP range, then it's lying and its activity is plain abuse. In that case, you shouldn't serve them a proof of work system; you should block them entirely.
      - thunderfork 2y ago
        Blocking abusive actors can be very non-trivial. The proof-of-work system mitigates the amount of effort that needs to be spent identifying and blocking bad actors.
  - anonym29 2y ago
    >Does anyone even check if the bots' IP ranges belong to the AI companies? Sounds like a fun project for an AbuseIPDB contributor. Could look for fake Googlebots / Bingbots, etc, too.
  - userbinator 2y ago
    Also suspect those working on "anti-bot" solutions may have a hand in this. What better way to show the effectiveness of your solution, than to help create the problem in the first place.
    - zaphar 2y ago
      Why? When there are 100s of hopeful AI/LLM scrapers more than willing to do that work for you what possible reason would you have to do that work? The more typical and common human behavior is perfectly capable of explaining this. No reason to reach for some kind of underhanded conspiracy theory when simple incompetence and greed is more than adequate to explain it.
gbear605 2y ago
The issue is not whether it’s a human or a bot. The issue is whether you’re sending thousands of requests per second for hours, effectively DDOSing the site, or if you’re behaving like a normal user.
xboxnolifes 2y ago
> As long as a given client is not abusing your systems, then why do you care if the client is a human? Well, that's the rub. The bots are abusing the systems. The bots are accessing the contents at rates thousands of times faster and more often than humans. The bots also have access patterns unlike your expected human audience (downloading gigabytes or terabytes of data multiples times, over and over). And these bots aren't some being with rights. They're tools unleashed by humans. It's humans abusing the systems. These are anti-abuse measures.
- bbor 2y ago
  Well, that's the meta-rub: if they're abusing, block abuse. Rate limits are far simpler, anyway! In the interest of bringing the AI bickering to HN: I think one could accurately characterize "block bots just in case they choose to request too much data" as discrimination! Robots of course don't have any rights so it's not wrong, but it certainly might be unwise.
  - inejge 2y ago
    > Rate limits are far simpler, anyway! Not when the bots are actively programmed to thwart them by using far-flung IP address carousels, request pacing, spoofed user agents and similar techniques. It's open war these days.
    - parineum 2y ago
      Request pacing sounds intentionally unabusive.
      - rollcat 2y ago
        It's called DDoS. DDoS is abusive.
      - j16sdiz 2y ago
        It is not bringing down your server, but they are taking 80%+ of your bandwidth budget. Does this count as abuse?
laserbeam 2y ago
The reason is: bots DO spam you repeatedly and increase your network costs. Humans don’t abuse the same way.
praptak 2y ago
The good thing about proof of work is that it doesn't specifically gate bots. It may have some other downsides - for example I don't think that Google is possible in a world where everyone requires proof of work (some may argue it's a good thing) but it doesn't specifically gate bots. It gates mass scraping.
- fc417fc802 2y ago
  Things like google are still possible. Operators would need to whitelist services. Alternatively shared resources similar in spirit to common crawl but scaled up could be used. That would have the benefit of democratizing the ability to create and operate large scale search indexes.
starkrights 2y ago
Example problem that I’ve seen posted about a few times on HN: LLM scrapers (or at least, an explosion of new scrapers) exploding and mindlessly crawling every singly HTTP endpoint of a hosted git-service, instead of just cloning the repo. (entirely ignoring robots.txt) The point of this is that there has recently been a massive explosion in the amount of bots that blatantly, aggressively, and maliciously ignore and attempt to bypass (mass ip/VPN switching, user agent swapping, etc) anti-abuse gates.
- deleted 2y ago
  [deleted]
mieses 2y ago
There is hope for misguided humans.
brikym 2y ago
As both a website host and website scraper I can see both sides of it. The website owners have very little interest in opening their data up; if they did they'd have made an API for it. In my case it's scraping supermarket prices so obviously big-grocery doesn't want a spot light on their arbitrary pricing patterns. It's frustrating for us scrapers but from their perspective opening up to bots is just a liability. Besides bots just spamming the servers getting around rate limits with botnets and noise any new features added by bots probably won't benefit them. If I made a bot service that would split your orders over multiple supermarkets, or buy items temporally as prices drop that wouldn't benefit the companies. All the work they've put into their site is to bring them to the status quo and they want to keep it that way. The companies don't want an open internet, only we do. I'd like to see some transparency laws so that large companies need to publish their pricing.

deleted 2y ago

[deleted]