4 ms·

I hit Cloudflare's garbage about as much as I hit Anubis. With the difference that far more sites use Cloudflare than Anubis, thus Anubis is far worse at trigge

by elric 1y ago

I hit Cloudflare's garbage about as much as I hit Anubis. With the difference that far more sites use Cloudflare than Anubis, thus Anubis is far worse at triggering false positives.

analbliss 1y ago
So yes, it is like having a stalker politely open the door for you as you walk into a shop, because they know very well who you are.
- rob_c 1y ago
  [flagged]
  - deleted 1y ago
    [deleted]
  - selfhoster11 1y ago
    What's wrong with creating a throwaway?
    - petralithic 1y ago
      HN does not want people to do that, as stated in the guidelines
- robertlagrant 1y ago
  In a world full of robots that look like humans, the stalker who knows you and lets you in might be the only solution.
  - petralithic 1y ago
    That stalker might itself be a bot though, so there's no solution.
  - Aachen 1y ago
    That's called authentication. In the case of the stalker, by biometrics (facial recognition). This could be a solution But that's not what Cloudflare does. Cloudflare guesses whether you are a bot and then either blocks you or not. If it currently likes you, bless your luck
    - KETHERCORTEX 1y ago
      > This could be a solution Until the moment someone will figure out the generation of realistic enough 3d faces.
      - Aachen 1y ago
        Ah true! I meant authentication in general by whatever means, which seems dystopian enough already, but indeed my post can be read as being about facial recognition being required to visit random websites... that's even worse! Don't give them ideas xD
Aachen 1y ago
Huh? What false positives does Anubis produce? The article doesn't say and I constantly get the most difficult Google captchas, cloudflare block pages saying "having trouble?" (which is a link to submit a ticket that seems to land in /dev/null), IP blocks because user agent spoofing, errors "unsupported browser" when I don't do user agent spoofing... the only anti-bot thing that reliably works on all my clients is Anubis. I'm really wondering what kinds of false positives you think Anubis has, since (as far as I can tell) it's a completely open and deterministic algorithm that just lets you in if you solve the challenge, and as the author of the article demonstrated with some C code (if you don't want to run the included JavaScript that does it for you), that works even if you are a bot. And afaik that's the point: no heuristics and false positives but a straight game of costs; making bad scraping behavior simply cost more than implementing caching correctly or using commoncrawl
- jakogut 1y ago
  I've had Anubis repeatedly fail to authorize me to access numerous open source projects, including the mesa3d gitlab, with a message looking something like "you failed". As a legitimate open source developer and contributor to buildroot, I've had no recourse besides trying other browsers, networks, and machines, and it's triggered on several combinations.
  - Aachen 1y ago
    Interesting, I didn't even know it had such a failure mode. Thanks for the reply, I'll sadly have to update my opinion on this project since it's apparently not a pure "everyone is equal if they can Prove the Work" system as I thought :( I'm curious how, though, since the submitted article doesn't mention that and demonstrates curl working (which is about as low as you can go on the browser emulation front), but no time to look into it atm. Maybe it's because of an option or module that the author didn't have enabled
  - stock_toaster 1y ago
    It sounds[1] like this was an issue with assumptions regarding header stability. Hopefully as people update their installations things will improve for us end users. [1]: https://anubis.techaro.lol/blog/release/v1.20.0/#chrome-wont-show-invalid-response-after-success https://anubis.techaro.lol/blog/release/v1.20.0/#chrome-wont...

by elric 1y ago

I hit Cloudflare's garbage about as much as I hit Anubis. With the difference that far more sites use Cloudflare than Anubis, thus Anubis is far worse at triggering false positives.

analbliss 1y ago

So yes, it is like having a stalker politely open the door for you as you walk into a shop, because they know very well who you are.

rob_c 1y ago
[flagged]
- deleted 1y ago
  [deleted]
- selfhoster11 1y ago
  What's wrong with creating a throwaway?
  - petralithic 1y ago
    HN does not want people to do that, as stated in the guidelines
robertlagrant 1y ago
In a world full of robots that look like humans, the stalker who knows you and lets you in might be the only solution.
- petralithic 1y ago
  That stalker might itself be a bot though, so there's no solution.
- Aachen 1y ago
  That's called authentication. In the case of the stalker, by biometrics (facial recognition). This could be a solution But that's not what Cloudflare does. Cloudflare guesses whether you are a bot and then either blocks you or not. If it currently likes you, bless your luck
  - KETHERCORTEX 1y ago
    > This could be a solution Until the moment someone will figure out the generation of realistic enough 3d faces.
    - Aachen 1y ago
      Ah true! I meant authentication in general by whatever means, which seems dystopian enough already, but indeed my post can be read as being about facial recognition being required to visit random websites... that's even worse! Don't give them ideas xD

Aachen 1y ago

Huh? What false positives does Anubis produce? The article doesn't say and I constantly get the most difficult Google captchas, cloudflare block pages saying "having trouble?" (which is a link to submit a ticket that seems to land in /dev/null), IP blocks because user agent spoofing, errors "unsupported browser" when I don't do user agent spoofing... the only anti-bot thing that reliably works on all my clients is Anubis. I'm really wondering what kinds of false positives you think Anubis has, since (as far as I can tell) it's a completely open and deterministic algorithm that just lets you in if you solve the challenge, and as the author of the article demonstrated with some C code (if you don't want to run the included JavaScript that does it for you), that works even if you are a bot. And afaik that's the point: no heuristics and false positives but a straight game of costs; making bad scraping behavior simply cost more than implementing caching correctly or using commoncrawl

jakogut 1y ago
I've had Anubis repeatedly fail to authorize me to access numerous open source projects, including the mesa3d gitlab, with a message looking something like "you failed". As a legitimate open source developer and contributor to buildroot, I've had no recourse besides trying other browsers, networks, and machines, and it's triggered on several combinations.
- Aachen 1y ago
  Interesting, I didn't even know it had such a failure mode. Thanks for the reply, I'll sadly have to update my opinion on this project since it's apparently not a pure "everyone is equal if they can Prove the Work" system as I thought :( I'm curious how, though, since the submitted article doesn't mention that and demonstrates curl working (which is about as low as you can go on the browser emulation front), but no time to look into it atm. Maybe it's because of an option or module that the author didn't have enabled
- stock_toaster 1y ago
  It sounds[1] like this was an issue with assumptions regarding header stability. Hopefully as people update their installations things will improve for us end users. [1]: https://anubis.techaro.lol/blog/release/v1.20.0/#chrome-wont-show-invalid-response-after-success https://anubis.techaro.lol/blog/release/v1.20.0/#chrome-wont...