6 ms·

It really should be recognised just how many people are watching Cloudflare interstitials on nearly every site these days (and I totally get why this happens) y

It really should be recognised just how many people are watching Cloudflare interstitials on nearly every site these days (and I totally get why this happens) yet making a huge amount of noise about Anubis on a very small amount of sites.

ronsor 1y ago
TO BE FAIR I dislike those even more.
mlyle 1y ago
I don't trip over CloudFlare except when in a weird VPN, and then it always gets out of my way after the challenge. Anubis screws with me a lot, and often doesn't work.
- thayne 1y ago
  I get one basically every time I go to gitlab.com on Firefox. It is easy to pass the challange, but it isn't any better than Anubis.
- necovek 1y ago
  It's the other way around for me sometimes — I've never had issue with Anubis, I frequently get it with CF-protected sites. (Not to mention all the sites which started putting country restrictions in on their generally useful instruction articles etc — argh)
- Pinus 1y ago
  I’m planning a trip to France right now, and it seems like half the websites in that country (for example, ratp.fr for Paris public transport info) require me to check a CloudFlare checkbox to promise that I am a human. And of those that don’t, quite a few just plain lock me out...
  - ta988 1y ago
    And a lot of US sites don't work in France either, or they ban you after just a couple requests with no appeal...
  - Symbiote 1y ago
    I find the same when using some foreign sites. I think the operator must have configured that France is OK, maybe neighboring countries too, the rest of the world must be checked.
  - alibarber 1y ago
    It's not hard to understand why though surely? You might have to show a passport when you enter France, and have your baggage and person (intrusively) scanned if you fly there, for much the same reason. People, some of them in positions of government in some nation states want to cause harm to the services of other states. Cloudflare was probably the easiest tradeoff for balancing security of the service with accessibility and cost to the French/Parisian taxpayer. Not that I'm happy about any of this, but I can understand it.
    - inferiorhuman 1y ago
      The antagonists in this case are not state sponsored terrorists, instead it's AI bros DDoSing the internet.
- binaryturtle 1y ago
  I'm on an older system here, and both Cloudflare and Anubis entirely block me out of sites. Once you start blocking actual users out of your sites, it simply has gone too far. At least provide an alternative method to enter your site (e.g. via login) that's not hampered by erroneous human checks. Same for the captchas where you help train AIs by choosing out of a set of tiny/ noisy pictures. I often struggle for 5 to 10 minutes to get past that nonsense. I heard bots have less trouble. Basically we're already past the point where the web is made for actual humans, now it's made for bots.
  - alperakgun 1y ago
    I gave up on a lot of websites because of the aggressive blocking.
  - inejge 1y ago
    > Once you start blocking actual users out of your sites, it simply has gone too far. It has, scrapers are out of control. Anubis and its ilk are a desperate measure, and some fallout is expected. And you don't get to dictate how a non-commercial site tries to avoid throttling and/or bandwidth overage bills.
    - account42 1y ago
      No, they are a lazy measure. Most websites that slap on these kinds of checks don't even bother with more human-friendly measures first.
      - mschuster91 1y ago
        Because I don't have the fucking time to deal with AI scraper bots. I went harder - anything even looking suspiciously close to a scraper that's not on Google's index [1] or has wget in its user agent gets their entire /24 hard banned for a month, with an email address to contact for unbanning. That seems to be a pretty effective way for now to keep scrapers, spammers and other abusive behavior away. Normal users don't do certain site actions at the speed that scraper bots do, there's no other practically relevant search engine than Google, I've never ever seen an abusive bot hide as wget (they all try to emulate looking like a human operated web browser), and no AI agent yet is smart enough to figure out how to interpret the message "Your ISP's network appears to have been used by bot activity. Please write an email to xxx@yyy.zzz with <ABC> as the subject line (or click on this pre-filled link) and you will automatically get unblocked". [1] https://developers.google.com/search/docs/crawling-indexing/verifying-googlebot https://developers.google.com/search/docs/crawling-indexing/...
- dijit 1y ago
  The annoying thing about cloudflare is that most of the time once you’re blocked: you’re blocked. There’s literally no way for you to bypass the block if you’re affected. Its incredibly scary, I once had a bad useragent (without knowing it) and half the internet went offline, I couldn’t even access documentation or my email providers site, and there was no contact information or debugging information to help me resolve it: just a big middle finger for half the internet. I haven’t had issues with any sites using Anubis (yet), but I suspect there are ways to verify that you’re a human if your browser fails the automatic check at least.
  - kedihacker 1y ago
    Anubis checks proof of work so as long as JavaScript runs you will pass it.
  - Dilettante_ 1y ago
    A "digital no-fly-list" is hella cyberpunk, though.
    - ehnto 1y ago
      The question might become, what side of the black wall are you going to be on? Seriously though I do think we are going to see increasing interest in alternative nets, especially as governments tighten their control over the internet or even break away into isolated nation nets.
      - pjc50 1y ago
        Paradoxically, the problem with an "alternative net" (which could be tunneled over the regular one) is keeping it alternative. It has to be kept small and un-influential in order to stay under the radar. If you end up with an "alternative" which is used by journalists and politicians, you've just reinvented the mainstream, and you're no longer safe from being hit by a policy response. Think private trackers. The opposite of 4chan, which is an "alternative" that got too influential in setting the tone of the rest of the internet.
- wongarsu 1y ago
  For me both are things that mostly show up for 1-3 seconds, then get replaced by the actual website. I suspect that's the user experience of 99% of people. If you fall in the other 1% (e.g. due to using unusual browsers or specific IP ranges), cloudflare tends to be much worse
- NoGravitas 1y ago
  Even when not on VPN, if a site uses the CloudFlare interstitials, I will get it every single time - at least the "prove you're not a bot" checkbox. I get the full CAPTCHA if I'm on a VPN or I change browsers. It is certainly enough to annoy me. More than Anubis, though I do think Anubis is also annoying, mainly because of being nearly worthless.
- immibis 1y ago
  You must be on a good network. You should run one of those "get paid to share your internet connection with AI companies" apps. Since you're on a good network you might make a lot of money. And then your network will get cloudflared, of course. We should repeat this until every network is cloudflared and everyone hates cloudflare and cloudflare loses all its customers and goes bankrupt. The internet would be better for it.
- chaoskitty 1y ago
  Examples?
jcelerier 1y ago
Both are equally terrible - one doesn't require explanations to my boss though
- Aachen 1y ago
  If your boss doesn't want you to browse the web, where some technical content is accompanied by an avatar that the author likes, they may not be suitable as boss, or at least not for positions where it's their job to look over your shoulder and make sure you're not watching series during work time. Seems like a weird employment place if they need to check that anyway
  - jcelerier 1y ago
    we have customers in our offices pretty much every day, I think "no anime girls on screens" is a fair request
    - sheepdestroyer 1y ago
      I fail to see how this particular "anime girl" and the potential for clients seeing it, could make you think that's a fair request. That seems extremely ridiculous to me.
    - troyvit 1y ago
      It's an MIT licensed, open project. Fork it and change the icon to your favorite white-bread corporate logo if you want. It would probably take less time than complaining about it on HN.
      - Aachen 1y ago
        I think the complaint is rather that you don't know when it will rear its face on third-party websites that you are visiting as part of work. Forking wouldn't help with not seeing it on other sites (Even if I agree that the boss or customers should just get over it. It's not like they're drawing genitalia on screen and it's also easily explainable if they don't already know it themselves.)
elric 1y ago
I hit Cloudflare's garbage about as much as I hit Anubis. With the difference that far more sites use Cloudflare than Anubis, thus Anubis is far worse at triggering false positives.
- analbliss 1y ago
  So yes, it is like having a stalker politely open the door for you as you walk into a shop, because they know very well who you are.
  - rob_c 1y ago
    [flagged]
    - deleted 1y ago
      [deleted]
    - selfhoster11 1y ago
      What's wrong with creating a throwaway?
      - petralithic 1y ago
        HN does not want people to do that, as stated in the guidelines
  - robertlagrant 1y ago
    In a world full of robots that look like humans, the stalker who knows you and lets you in might be the only solution.
    - petralithic 1y ago
      That stalker might itself be a bot though, so there's no solution.
    - Aachen 1y ago
account42 1y ago
Cloudflare's solution works without javascript enabled unless the website turns up the scare level to max or you are on an IP with already bad reputation. Anubis does not. But at the end of the day both are shit and we should not accept either. That includes not using one as an excuse for the other.
- superkuh 1y ago
  Laughable. They say this but anyone who actually surfs the web with a non-bleeding edge non-corporate browser gets constantly blocked by Cloudflare. The idea that their JS computational paywalls only pop up rarely is absurd. Anyone believing this line lacks lived experience. My Comcast IP shouldn't have a bad rep and using a browser from ~2015 shouldn't make me scary. But I can't even read bills on congress.gov anymore thanks to bad CF deployals. Also, Anubis does have a non-JS mode: the HTML header meta-refresh based challenge. It's just that the type of people who use Cloudflare or Anubis almost always just deploy the default (mostly broken) configs that block as many human people as bots. And they never realize it because they only measure such things with javascript.
petralithic 1y ago
We can make noise about both things, and how they're ruining the internet.
tgv 1y ago
That says something about the chosen picture, doesn't it? Probably that it's not well liked. It certainly isn't neutral, while the Cloudfare page is.
- thrance 1y ago
  Anubis was originally an open source project built for a personnal blog. It gained traction but the anime girl remained so that people are reminded of the nature of the project. Comparing it with Cloudflare is truly absurd. That said, a paid version is available with guard page customization.
- drakythe 1y ago
  You know, you say that, and while I understand where you're coming from I was browsing the git repo when github had a slight error and I was greeted with an angry pink unicorn. If Github can be fun like that, Anubis can too, I think.
  - deleted 1y ago
    [deleted]
  - tgv 1y ago
    I don't think you want to suggest that everyone must like it?
  - MintPaw 1y ago
    Yeah, but do people like that? It feels pretty patronizing to me in a similar way. Like "Weee! So cute that our website is broken, good luck doing your job! <3" Reminds me of the old uwu error message meme.
    - jijijijij 1y ago
      > patronizing I think it's reasonable and fair, and something you are expected to tolerate in a free world. In fact, I think it's rather unusual to take this benign and inconsequential thing as personal as you do.
lupusreal 1y ago
Over the past few years I've read far more comments complaining about Cloudflare doing it than Anubis. In fact, this discussion section is the first time I've seen people talking about Anubis.

ronsor 1y ago

TO BE FAIR I dislike those even more.

mlyle 1y ago

I don't trip over CloudFlare except when in a weird VPN, and then it always gets out of my way after the challenge. Anubis screws with me a lot, and often doesn't work.

thayne 1y ago
I get one basically every time I go to gitlab.com on Firefox. It is easy to pass the challange, but it isn't any better than Anubis.
necovek 1y ago
It's the other way around for me sometimes — I've never had issue with Anubis, I frequently get it with CF-protected sites. (Not to mention all the sites which started putting country restrictions in on their generally useful instruction articles etc — argh)
Pinus 1y ago
I’m planning a trip to France right now, and it seems like half the websites in that country (for example, ratp.fr for Paris public transport info) require me to check a CloudFlare checkbox to promise that I am a human. And of those that don’t, quite a few just plain lock me out...
- ta988 1y ago
  And a lot of US sites don't work in France either, or they ban you after just a couple requests with no appeal...
- Symbiote 1y ago
  I find the same when using some foreign sites. I think the operator must have configured that France is OK, maybe neighboring countries too, the rest of the world must be checked.
- alibarber 1y ago
  It's not hard to understand why though surely? You might have to show a passport when you enter France, and have your baggage and person (intrusively) scanned if you fly there, for much the same reason. People, some of them in positions of government in some nation states want to cause harm to the services of other states. Cloudflare was probably the easiest tradeoff for balancing security of the service with accessibility and cost to the French/Parisian taxpayer. Not that I'm happy about any of this, but I can understand it.
  - inferiorhuman 1y ago
    The antagonists in this case are not state sponsored terrorists, instead it's AI bros DDoSing the internet.
binaryturtle 1y ago
I'm on an older system here, and both Cloudflare and Anubis entirely block me out of sites. Once you start blocking actual users out of your sites, it simply has gone too far. At least provide an alternative method to enter your site (e.g. via login) that's not hampered by erroneous human checks. Same for the captchas where you help train AIs by choosing out of a set of tiny/ noisy pictures. I often struggle for 5 to 10 minutes to get past that nonsense. I heard bots have less trouble. Basically we're already past the point where the web is made for actual humans, now it's made for bots.
- alperakgun 1y ago
  I gave up on a lot of websites because of the aggressive blocking.
- inejge 1y ago
  > Once you start blocking actual users out of your sites, it simply has gone too far. It has, scrapers are out of control. Anubis and its ilk are a desperate measure, and some fallout is expected. And you don't get to dictate how a non-commercial site tries to avoid throttling and/or bandwidth overage bills.
  - account42 1y ago
    No, they are a lazy measure. Most websites that slap on these kinds of checks don't even bother with more human-friendly measures first.
    - mschuster91 1y ago
      Because I don't have the fucking time to deal with AI scraper bots. I went harder - anything even looking suspiciously close to a scraper that's not on Google's index [1] or has wget in its user agent gets their entire /24 hard banned for a month, with an email address to contact for unbanning. That seems to be a pretty effective way for now to keep scrapers, spammers and other abusive behavior away. Normal users don't do certain site actions at the speed that scraper bots do, there's no other practically relevant search engine than Google, I've never ever seen an abusive bot hide as wget (they all try to emulate looking like a human operated web browser), and no AI agent yet is smart enough to figure out how to interpret the message "Your ISP's network appears to have been used by bot activity. Please write an email to xxx@yyy.zzz with <ABC> as the subject line (or click on this pre-filled link) and you will automatically get unblocked". [1] https://developers.google.com/search/docs/crawling-indexing/verifying-googlebot https://developers.google.com/search/docs/crawling-indexing/...
dijit 1y ago
The annoying thing about cloudflare is that most of the time once you’re blocked: you’re blocked. There’s literally no way for you to bypass the block if you’re affected. Its incredibly scary, I once had a bad useragent (without knowing it) and half the internet went offline, I couldn’t even access documentation or my email providers site, and there was no contact information or debugging information to help me resolve it: just a big middle finger for half the internet. I haven’t had issues with any sites using Anubis (yet), but I suspect there are ways to verify that you’re a human if your browser fails the automatic check at least.
- kedihacker 1y ago
  Anubis checks proof of work so as long as JavaScript runs you will pass it.
- Dilettante_ 1y ago
  A "digital no-fly-list" is hella cyberpunk, though.
  - ehnto 1y ago
    The question might become, what side of the black wall are you going to be on? Seriously though I do think we are going to see increasing interest in alternative nets, especially as governments tighten their control over the internet or even break away into isolated nation nets.
    - pjc50 1y ago
      Paradoxically, the problem with an "alternative net" (which could be tunneled over the regular one) is keeping it alternative. It has to be kept small and un-influential in order to stay under the radar. If you end up with an "alternative" which is used by journalists and politicians, you've just reinvented the mainstream, and you're no longer safe from being hit by a policy response. Think private trackers. The opposite of 4chan, which is an "alternative" that got too influential in setting the tone of the rest of the internet.
wongarsu 1y ago
For me both are things that mostly show up for 1-3 seconds, then get replaced by the actual website. I suspect that's the user experience of 99% of people. If you fall in the other 1% (e.g. due to using unusual browsers or specific IP ranges), cloudflare tends to be much worse
NoGravitas 1y ago
Even when not on VPN, if a site uses the CloudFlare interstitials, I will get it every single time - at least the "prove you're not a bot" checkbox. I get the full CAPTCHA if I'm on a VPN or I change browsers. It is certainly enough to annoy me. More than Anubis, though I do think Anubis is also annoying, mainly because of being nearly worthless.
immibis 1y ago
You must be on a good network. You should run one of those "get paid to share your internet connection with AI companies" apps. Since you're on a good network you might make a lot of money. And then your network will get cloudflared, of course. We should repeat this until every network is cloudflared and everyone hates cloudflare and cloudflare loses all its customers and goes bankrupt. The internet would be better for it.
chaoskitty 1y ago
Examples?

jcelerier 1y ago

Both are equally terrible - one doesn't require explanations to my boss though

Aachen 1y ago
If your boss doesn't want you to browse the web, where some technical content is accompanied by an avatar that the author likes, they may not be suitable as boss, or at least not for positions where it's their job to look over your shoulder and make sure you're not watching series during work time. Seems like a weird employment place if they need to check that anyway
- jcelerier 1y ago
  we have customers in our offices pretty much every day, I think "no anime girls on screens" is a fair request
  - sheepdestroyer 1y ago
    I fail to see how this particular "anime girl" and the potential for clients seeing it, could make you think that's a fair request. That seems extremely ridiculous to me.
  - troyvit 1y ago
    It's an MIT licensed, open project. Fork it and change the icon to your favorite white-bread corporate logo if you want. It would probably take less time than complaining about it on HN.
    - Aachen 1y ago
      I think the complaint is rather that you don't know when it will rear its face on third-party websites that you are visiting as part of work. Forking wouldn't help with not seeing it on other sites (Even if I agree that the boss or customers should just get over it. It's not like they're drawing genitalia on screen and it's also easily explainable if they don't already know it themselves.)

elric 1y ago

I hit Cloudflare's garbage about as much as I hit Anubis. With the difference that far more sites use Cloudflare than Anubis, thus Anubis is far worse at triggering false positives.

analbliss 1y ago
So yes, it is like having a stalker politely open the door for you as you walk into a shop, because they know very well who you are.
- rob_c 1y ago
  [flagged]
  - deleted 1y ago
    [deleted]
  - selfhoster11 1y ago
    What's wrong with creating a throwaway?
    - petralithic 1y ago
      HN does not want people to do that, as stated in the guidelines
- robertlagrant 1y ago
  In a world full of robots that look like humans, the stalker who knows you and lets you in might be the only solution.
  - petralithic 1y ago
    That stalker might itself be a bot though, so there's no solution.
  - Aachen 1y ago

account42 1y ago

Cloudflare's solution works without javascript enabled unless the website turns up the scare level to max or you are on an IP with already bad reputation. Anubis does not. But at the end of the day both are shit and we should not accept either. That includes not using one as an excuse for the other.

superkuh 1y ago
Laughable. They say this but anyone who actually surfs the web with a non-bleeding edge non-corporate browser gets constantly blocked by Cloudflare. The idea that their JS computational paywalls only pop up rarely is absurd. Anyone believing this line lacks lived experience. My Comcast IP shouldn't have a bad rep and using a browser from ~2015 shouldn't make me scary. But I can't even read bills on congress.gov anymore thanks to bad CF deployals. Also, Anubis does have a non-JS mode: the HTML header meta-refresh based challenge. It's just that the type of people who use Cloudflare or Anubis almost always just deploy the default (mostly broken) configs that block as many human people as bots. And they never realize it because they only measure such things with javascript.

petralithic 1y ago

We can make noise about both things, and how they're ruining the internet.

tgv 1y ago

That says something about the chosen picture, doesn't it? Probably that it's not well liked. It certainly isn't neutral, while the Cloudfare page is.

thrance 1y ago
Anubis was originally an open source project built for a personnal blog. It gained traction but the anime girl remained so that people are reminded of the nature of the project. Comparing it with Cloudflare is truly absurd. That said, a paid version is available with guard page customization.
drakythe 1y ago
You know, you say that, and while I understand where you're coming from I was browsing the git repo when github had a slight error and I was greeted with an angry pink unicorn. If Github can be fun like that, Anubis can too, I think.
- deleted 1y ago
  [deleted]
- tgv 1y ago
  I don't think you want to suggest that everyone must like it?
- MintPaw 1y ago
  Yeah, but do people like that? It feels pretty patronizing to me in a similar way. Like "Weee! So cute that our website is broken, good luck doing your job! <3" Reminds me of the old uwu error message meme.
  - jijijijij 1y ago
    > patronizing I think it's reasonable and fair, and something you are expected to tolerate in a free world. In fact, I think it's rather unusual to take this benign and inconsequential thing as personal as you do.

lupusreal 1y ago

Over the past few years I've read far more comments complaining about Cloudflare doing it than Anubis. In fact, this discussion section is the first time I've seen people talking about Anubis.