4 ms·

Yep this terrifies me, 100%. We’re slowly losing the open internet and the frog is being boiled slowly enough that people are very happy to defend the rising te

Yep this terrifies me, 100%. We’re slowly losing the open internet and the frog is being boiled slowly enough that people are very happy to defend the rising temperature. If DDoS wasn’t a scary enough boogeyman to get people to install Cloudflare as a man-in-the-middle on all their website traffic, maybe the threat of AI scrapers will do the trick? The thing about this slow slide is it’s always defensible. Someone can always say “but I don’t want my site to be scraped, and this service is free, or even better yet, I can set up my own toll booth and collect money! They’re wonderful!” Trouble is, one day, at this rate, almost all internet traffic will be going through that same gate. And once they have literally everyone (and all their traffic)… well, internet access is an immense amount of power to wield and I can’t see a world in which it remains untainted by commercial and government interests forever. And “forever” is what’s at stake, because it’ll be near impossible to recover from once 99% of the population is happy to use one of the 3 approved browsers on the 2 approved devices (latest version only). Feels like we’re already accepting that future at an increasing rate.

RiverCrochet 1y ago
The Internet is not the first global network. Before the Internet, you had the global telephone network. It, too, strangulated end users, but eventually became stagnant, overpriced, and irrelevant. Super long-term, the current Internet is not immune from this. Internet standards are about getting as complicated and quirky as the old Bell stuff that was trying to make miles of buried copper the future, and if regulatory/commercial forces freeze this stuff in place, it's going to lead to stagnation eventually. Something coming down the pike I think, for example, is that IPv4 addresses are going to get realllly expensive soon. That's going to lead to all sorts of interesting things in the Internet landscape and their applications. I'm sure we'll probably have to spend some decades in the "approved devices and browers only" world before a next wave comes.
BugheadTorpeda6 1y ago
[dead]
mattl 1y ago
We need a reasonable alternative to some of what Cloudflare does that can be easily installed as a package on Linux distributions without any of the following to install it. * curl | bash * Docker * Anything that smacks of cryptocurrency or other scams Just a standard repo for Debian and RHEL derived distros. Fully open source so everyone can use it. (apt/dnf install no-bad-actors) Until that exists, using Cloudflare is inevitable. It needs to be able to at least: * provide some basic security (something to check for sql injection, etc) * rate limiting * User agent blocking * IP address and ASN blocking Make it easy to set up with sensible defaults and a way to subscribe to blocklists.
- saint_yossarian 1y ago
  I remember using mod_security with Apache long ago for some of this, looks like it's still around and now also supports Nginx and IIS: https://modsecurity.org/ https://modsecurity.org/
  - mattl 1y ago
    Thank you. This doesn't have everything I'm looking for, but apparently it has been packaged in Debian at least. I don't know why the website doesn't mention this.
- 1oooqooq 1y ago
  it's called not having a vibecoded app that falls to pieces on public endpoints even before ngix ratelimit can kick in
  - mattl 1y ago
    Nobody is talking about a vibe coded app. I want to block AI scrapers entirely.
    - 1oooqooq 1y ago
      point is, why do you care if your site can handle the traffic? there's no (malicious) bot detection that won't impact a portion of real users. accept that fact and just let it be. poisoning data in ways that's obvious to the false positive user is a much better option.

RiverCrochet 1y ago

The Internet is not the first global network. Before the Internet, you had the global telephone network. It, too, strangulated end users, but eventually became stagnant, overpriced, and irrelevant. Super long-term, the current Internet is not immune from this. Internet standards are about getting as complicated and quirky as the old Bell stuff that was trying to make miles of buried copper the future, and if regulatory/commercial forces freeze this stuff in place, it's going to lead to stagnation eventually. Something coming down the pike I think, for example, is that IPv4 addresses are going to get realllly expensive soon. That's going to lead to all sorts of interesting things in the Internet landscape and their applications. I'm sure we'll probably have to spend some decades in the "approved devices and browers only" world before a next wave comes.

BugheadTorpeda6 1y ago

[dead]

mattl 1y ago

We need a reasonable alternative to some of what Cloudflare does that can be easily installed as a package on Linux distributions without any of the following to install it. * curl | bash * Docker * Anything that smacks of cryptocurrency or other scams Just a standard repo for Debian and RHEL derived distros. Fully open source so everyone can use it. (apt/dnf install no-bad-actors) Until that exists, using Cloudflare is inevitable. It needs to be able to at least: * provide some basic security (something to check for sql injection, etc) * rate limiting * User agent blocking * IP address and ASN blocking Make it easy to set up with sensible defaults and a way to subscribe to blocklists.

saint_yossarian 1y ago
I remember using mod_security with Apache long ago for some of this, looks like it's still around and now also supports Nginx and IIS: https://modsecurity.org/ https://modsecurity.org/
- mattl 1y ago
  Thank you. This doesn't have everything I'm looking for, but apparently it has been packaged in Debian at least. I don't know why the website doesn't mention this.
1oooqooq 1y ago
it's called not having a vibecoded app that falls to pieces on public endpoints even before ngix ratelimit can kick in
- mattl 1y ago
  Nobody is talking about a vibe coded app. I want to block AI scrapers entirely.
  - 1oooqooq 1y ago
    point is, why do you care if your site can handle the traffic? there's no (malicious) bot detection that won't impact a portion of real users. accept that fact and just let it be. poisoning data in ways that's obvious to the false positive user is a much better option.