4 ms·
This clever bunny did something very similar.. (but self hosted) https://xeiaso.net/blog/2025/anubis/ https://xeiaso.net/blog/2025/anubis/ I love the approach
by senectus1 1y ago
This clever bunny did something very similar.. (but self hosted)
https://xeiaso.net/blog/2025/anubis/ https://xeiaso.net/blog/2025/anubis/
I love the approach.. If I could be arsed blogging I'd probably set it up myself.
- mshockwave 1y agoI might be wrong, but it seems like Anubis asks the _client_ to solve the cryptography challenges while the approach Cloudflare described here asks the server to verify the (cryptography) signature?
- senectus1 1y agothe client thats scraping... yes. it shifts the load to the offending service. its not a big issue if you're human but if you're a AI scraping bot its a load of heavy resources.
- ralferoo 1y agoAltcha is a similar thing: https://github.com/altcha-org/altcha https://github.com/altcha-org/altcha I recently implemented a very similar thing to its obfuscation via proof-of-work (https://altcha.org/docs/obfuscation/ https://altcha.org/docs/obfuscation/) in my C++ REST backend and flutter front-end, and use it for rate-limiting on APIs that allow creation of a new account or sending sign-up e-mails. I have an authentication token that's then wrapped with AES-GCM using a random IV and the client is given the key, IV stem and a maximum count for the IV.