5 ms·

By developing Free Software combating these hostile softwares. Corporations develop hostile AI agents, Capable hackers develop anti-AI-agents. This defeatist

by Gud 1y ago

By developing Free Software combating these hostile softwares. Corporations develop hostile AI agents, Capable hackers develop anti-AI-agents. This defeatist atittude "we have no power".

banku_brougham 1y ago
This is the attitude I like to see. As they say, actually I hate this because of past connotations but "freedom isn't free"
TIPSIO 1y ago
Yes, I obviously agree with you. My comment's point is missed a little I think by you. CF is making these tools and giving access to it to millions of people.
- supriyo-biswas 1y ago
  Well there's open source stuff like https://github.com/TecharoHQ/anubis https://github.com/TecharoHQ/anubis; one doesn't need a top-down mandated solution coming from a corporation. In general Cloudflare has been pushing DRMization of the web for quite some time, and while I understand why they want to do it, I wish they didn't always show off as taking the moral high ground.
  - Klonoar 1y ago
    Anubis doesn’t necessarily stop the most well funded actors. If anything we’ve seen the rise in complaints about it just annoying average users.
    - supriyo-biswas 1y ago
      The actual response to which Anubis was created is seemingly a strange kind of DDOS attack that has been misattributed to LLMs, but is some kind of attacker that makes partial GET requests that are aborted soon after sending the request headers, mostly coming from residential proxies. (Yes, it doesn’t help that the author of Anubis also isn’t fully aware of the mechanics of the attack. In fact, there is no proper write up of the mechanism of the attack which I hope to write about someday). Having said that, the solution is effective enough, having a lightweight proxy component that issues proof of work tokens to such bogus requests works well enough, as various users on HN seem to point out.
      - theamk 1y ago
        > a strange kind of DDOS attack that has been misattributed to LLMs, , but is some kind of attacker that makes partial GET requests that are aborted soon after sending the request headers, mostly coming from residential proxies. um, no? Where did you get this strange bit of info. The original reports say nothing of that sort: https://news.ycombinator.com/item?id=42790252 https://news.ycombinator.com/item?id=42790252 ; and even original motivation for Anubis was Amazon AI crawler https://news.ycombinator.com/item?id=42750420 https://news.ycombinator.com/item?id=42750420 (I've seen more posts with the analysis, including one which showed an AI crawler which would identify properly, but once it hits the ratelimit, would switch to fake user agent from proxies.. but I cannot find it now)
        deleted 1y ago
        [deleted]
deleted 1y ago
[deleted]
Analemma_ 1y ago
How does an agent help my website not get crushed by traffic load, and how is this proposal any different from the gatekeeping problem to the open web, except even less transparent and accountable because now access is gated by logic inside an impenetrable web of NN weights? This seems like slogan-based planning with no actual thought put into it.
- Gud 1y ago
  Whatever is working against the AI doesn’t have to be an AI agent.
  - hoppp 1y ago
    So proof of work checks everywhere?
    - 1gn15 1y ago
      Sure, as long as it doesn't discriminate against user agents.
esseph 1y ago
Sometimes it's a hardware problem, not a software problem.
- nimih 1y ago
  For that matter, sometimes it's a social/political problem and not a technological problem.
xg15 1y ago
That's a mantra, not a solution.
victorbjorklund 1y ago
So basically cloudflare but self-hosted (with all the pain that comes from that)?
- Gud 1y ago
  What’s so painful about self hosting? I’ve been self hosting since before I hit puberty. If 12 year old me can run a httpd, anyone can. And if you don’t want to self host, at least try to use services from organisations that aren’t hostile to the open web
  - victorbjorklund 1y ago
    I self-host lots of stuff. But yes it is more pain to host a WAF that can handle billions of request per minute. Even harder to do it for free like Cloudflare. And in the end the end result for the user is exactly the same if you use a self-hosted WAF or let someone else host it for you.
    - lucb1e 1y ago
      If you're handling billions of requests per second, you're not a self hoster. That's a commercial service with a dedicated team to handle traffic around the clock. Most ISPs probably don't even operate lines that big To put that in perspective, even if they're sending empty TCP packets, "several billion" pps is 200 to 1800 gigabits of traffic, depending on what you mean by that. Add a cookieless HTTP payload and you're at many terabits per second. The average self hoster is more likely to get struck by lightning than encounter and need protection from this (even without considering the, probably modest, consequences of being offline a few hours if it does happen) Edit: off by a factor of 60, whoops. Thanks to u/Gud for pointing that out. I stand by the conclusion though: less likely to occur than getting struck by lightning (or maybe it's around equally likely now? But somewhere in that ballpark) and the consequences of being down for a few hours are generally not catastrophic anyway. You can always still put big brother in front if this event does happen to you and your ISP can't quickly drop the abusive traffic
      - 1y ago

by Gud 1y ago

By developing Free Software combating these hostile softwares. Corporations develop hostile AI agents, Capable hackers develop anti-AI-agents. This defeatist atittude "we have no power".

banku_brougham 1y ago

This is the attitude I like to see. As they say, actually I hate this because of past connotations but "freedom isn't free"

TIPSIO 1y ago

Yes, I obviously agree with you. My comment's point is missed a little I think by you. CF is making these tools and giving access to it to millions of people.

supriyo-biswas 1y ago
Well there's open source stuff like https://github.com/TecharoHQ/anubis https://github.com/TecharoHQ/anubis; one doesn't need a top-down mandated solution coming from a corporation. In general Cloudflare has been pushing DRMization of the web for quite some time, and while I understand why they want to do it, I wish they didn't always show off as taking the moral high ground.
- Klonoar 1y ago
  Anubis doesn’t necessarily stop the most well funded actors. If anything we’ve seen the rise in complaints about it just annoying average users.
  - supriyo-biswas 1y ago
    The actual response to which Anubis was created is seemingly a strange kind of DDOS attack that has been misattributed to LLMs, but is some kind of attacker that makes partial GET requests that are aborted soon after sending the request headers, mostly coming from residential proxies. (Yes, it doesn’t help that the author of Anubis also isn’t fully aware of the mechanics of the attack. In fact, there is no proper write up of the mechanism of the attack which I hope to write about someday). Having said that, the solution is effective enough, having a lightweight proxy component that issues proof of work tokens to such bogus requests works well enough, as various users on HN seem to point out.
    - theamk 1y ago
      > a strange kind of DDOS attack that has been misattributed to LLMs, , but is some kind of attacker that makes partial GET requests that are aborted soon after sending the request headers, mostly coming from residential proxies. um, no? Where did you get this strange bit of info. The original reports say nothing of that sort: https://news.ycombinator.com/item?id=42790252 https://news.ycombinator.com/item?id=42790252 ; and even original motivation for Anubis was Amazon AI crawler https://news.ycombinator.com/item?id=42750420 https://news.ycombinator.com/item?id=42750420 (I've seen more posts with the analysis, including one which showed an AI crawler which would identify properly, but once it hits the ratelimit, would switch to fake user agent from proxies.. but I cannot find it now)
      - deleted 1y ago
        [deleted]

deleted 1y ago

[deleted]

Analemma_ 1y ago

How does an agent help my website not get crushed by traffic load, and how is this proposal any different from the gatekeeping problem to the open web, except even less transparent and accountable because now access is gated by logic inside an impenetrable web of NN weights? This seems like slogan-based planning with no actual thought put into it.

Gud 1y ago
Whatever is working against the AI doesn’t have to be an AI agent.
- hoppp 1y ago
  So proof of work checks everywhere?
  - 1gn15 1y ago
    Sure, as long as it doesn't discriminate against user agents.

esseph 1y ago

Sometimes it's a hardware problem, not a software problem.

nimih 1y ago
For that matter, sometimes it's a social/political problem and not a technological problem.

xg15 1y ago

That's a mantra, not a solution.

victorbjorklund 1y ago

So basically cloudflare but self-hosted (with all the pain that comes from that)?

Gud 1y ago
What’s so painful about self hosting? I’ve been self hosting since before I hit puberty. If 12 year old me can run a httpd, anyone can. And if you don’t want to self host, at least try to use services from organisations that aren’t hostile to the open web
- victorbjorklund 1y ago
  I self-host lots of stuff. But yes it is more pain to host a WAF that can handle billions of request per minute. Even harder to do it for free like Cloudflare. And in the end the end result for the user is exactly the same if you use a self-hosted WAF or let someone else host it for you.
  - lucb1e 1y ago
    If you're handling billions of requests per second, you're not a self hoster. That's a commercial service with a dedicated team to handle traffic around the clock. Most ISPs probably don't even operate lines that big To put that in perspective, even if they're sending empty TCP packets, "several billion" pps is 200 to 1800 gigabits of traffic, depending on what you mean by that. Add a cookieless HTTP payload and you're at many terabits per second. The average self hoster is more likely to get struck by lightning than encounter and need protection from this (even without considering the, probably modest, consequences of being offline a few hours if it does happen) Edit: off by a factor of 60, whoops. Thanks to u/Gud for pointing that out. I stand by the conclusion though: less likely to occur than getting struck by lightning (or maybe it's around equally likely now? But somewhere in that ballpark) and the consequences of being down for a few hours are generally not catastrophic anyway. You can always still put big brother in front if this event does happen to you and your ISP can't quickly drop the abusive traffic
    - 1y ago