4 ms·

I've seen websites put up some draconian measures to try and get a grip on the scraping. So much for the sub-second loading experience when you have Cloudflare,

I've seen websites put up some draconian measures to try and get a grip on the scraping. So much for the sub-second loading experience when you have Cloudflare, Google, Anubis, and all these other captcha services trying to see if you're a human. It's made the web browsing experience so much worse. Some of the proposals to address this include charging bots for access to web resources, but they will also have repercussions for regular users. I don't see how you solve this cleanly.

JKCalhoun 2mo ago
Me, I'm just scraping the parts of the internet I like, toying with local LLMs… ready really to just shove off.
Grimburger 2mo ago
Cloudflare specifically has a block for LLM and AI training bots now. Not sure of the effectiveness but it's there.
- matherial 2mo ago
  Minimal. I'm behind Cloudflare and 90% of the traffic is still scrapers. I don't think they're serious about the long tail. I think the main thing Cloudflare is trying to do is block direct traffic from frontier labs and then start charging them for access. They might end up shooting themselves in the foot, as this simply empowers sketchy residential-proxy outfits to undercut Cloudflare and sell the data to labs for less.
  - inigyou 2mo ago
    I think the other thing they're trying to do is get most of the internet to send them all of their cleartext traffic. Expect in 2040 the PRISM2 docs will get leaked by some Eduardo Rainedon and we'll find out Cloudflare was the NSA all along.
- bakugo 2mo ago
  It still only blocks "well-behaved" bots that have proper User-Agents and respect robots.txt, so it's largely pointless. The problematic bots are all disguising themselves as Chrome and sending requests from millions of residential proxy IPs, and the only real solution to those is some sort of captcha or PoW page on first visit.
- satvikpendem 2mo ago
  While they themselves announced an AI bot, the irony is palpable. In reality they just want to control who gets access to what, themselves excepted.
robinsonb5 2mo ago
Sure - it sucks, unfortunately the alternative is the sites going away entirely. When the load from scraper bots is constantly knocking the site offline the choices are literally to allow it to remain inaccessible for much of the time, put up a layer of defenses with all the user-annoyance compromises that entails, or just give up and unpublish the site.
- Borg3 2mo ago
  The alternative is simple.. Go dark. VPN tech is known from like 30 years. Pretty much everyone can use it (VPN providers). But instead using it to browse net, build VPN overlay networks of interest for people. Gaming networks, R&D networks, Retro Networks. People will peer to PoP and use resources. Bad actor? BAN it from network. You have control. This could be done in Internet, but big corpos and big money won the battle. Just wake F*ing up...
  - kukkeliskuu 2mo ago
    Continuing on your suggestion. There could be open source tooling to create custom private "closednets", with - trust ring mechanism to allow invitations, flagging, banning, and banning those that invite people who were banned - the rules of the closednet - search engine with opt-in scraping - portal (remember the 80s?) with all the registered nodes, perhaps by service category such as public git repo hosts, web sites etc. etc. The first closednet could be Hacker News.
  - inigyou 2mo ago
    It doesn't have to be an IP-layer network. A website that you need to log in to view works just as well.
    - Borg3 2mo ago
      Nah, it needs to be IP. IP is well estabilished protocol, everything speak it. Once you set it up, you can use it whatever you like. Web pages, gaming service, IRC, Mail, P2P confereces, everything. Everyone will bring it own slice to the pie. You love networking, became PoP and peer and provide access. You just want content? Connect to closest PoP, get IP + DNSproxy and vioala.
kees99 2mo ago
> Cloudflare, Google, Anubis, and all these other captcha services trying to see if you're a human. Yep. IMO, this is so far the biggest AI-inflicted damage to the web. A bit of anecdata - wikipedia (and all other wikimedia sites) are blocking my Firefox since about a week, with a "please respect our bot policy" message. Outright block, not even a captcha. It took me a while to figure out they don't like me disabling some SSL ciphers, so now "JA4 browser fingerprint" is not matching user-agent. Funnily enough curl (what I would imagine a bot would use) pulls exact same URLs from exact same client IP, just fine.
- ImaCake 2mo ago
  Maybe the curl thing is because they are happy to let you do some light scraping. What they want to avoid is bots directly crawling the page interactively. No one seems to be blocking chatGPT when I promot it to use it's web search skill anyway.

JKCalhoun 2mo ago

Me, I'm just scraping the parts of the internet I like, toying with local LLMs… ready really to just shove off.

Grimburger 2mo ago

Cloudflare specifically has a block for LLM and AI training bots now. Not sure of the effectiveness but it's there.

matherial 2mo ago
Minimal. I'm behind Cloudflare and 90% of the traffic is still scrapers. I don't think they're serious about the long tail. I think the main thing Cloudflare is trying to do is block direct traffic from frontier labs and then start charging them for access. They might end up shooting themselves in the foot, as this simply empowers sketchy residential-proxy outfits to undercut Cloudflare and sell the data to labs for less.
- inigyou 2mo ago
  I think the other thing they're trying to do is get most of the internet to send them all of their cleartext traffic. Expect in 2040 the PRISM2 docs will get leaked by some Eduardo Rainedon and we'll find out Cloudflare was the NSA all along.
bakugo 2mo ago
It still only blocks "well-behaved" bots that have proper User-Agents and respect robots.txt, so it's largely pointless. The problematic bots are all disguising themselves as Chrome and sending requests from millions of residential proxy IPs, and the only real solution to those is some sort of captcha or PoW page on first visit.
satvikpendem 2mo ago
While they themselves announced an AI bot, the irony is palpable. In reality they just want to control who gets access to what, themselves excepted.

robinsonb5 2mo ago

Sure - it sucks, unfortunately the alternative is the sites going away entirely. When the load from scraper bots is constantly knocking the site offline the choices are literally to allow it to remain inaccessible for much of the time, put up a layer of defenses with all the user-annoyance compromises that entails, or just give up and unpublish the site.

Borg3 2mo ago
The alternative is simple.. Go dark. VPN tech is known from like 30 years. Pretty much everyone can use it (VPN providers). But instead using it to browse net, build VPN overlay networks of interest for people. Gaming networks, R&D networks, Retro Networks. People will peer to PoP and use resources. Bad actor? BAN it from network. You have control. This could be done in Internet, but big corpos and big money won the battle. Just wake F*ing up...
- kukkeliskuu 2mo ago
  Continuing on your suggestion. There could be open source tooling to create custom private "closednets", with - trust ring mechanism to allow invitations, flagging, banning, and banning those that invite people who were banned - the rules of the closednet - search engine with opt-in scraping - portal (remember the 80s?) with all the registered nodes, perhaps by service category such as public git repo hosts, web sites etc. etc. The first closednet could be Hacker News.
- inigyou 2mo ago
  It doesn't have to be an IP-layer network. A website that you need to log in to view works just as well.
  - Borg3 2mo ago
    Nah, it needs to be IP. IP is well estabilished protocol, everything speak it. Once you set it up, you can use it whatever you like. Web pages, gaming service, IRC, Mail, P2P confereces, everything. Everyone will bring it own slice to the pie. You love networking, became PoP and peer and provide access. You just want content? Connect to closest PoP, get IP + DNSproxy and vioala.

kees99 2mo ago

> Cloudflare, Google, Anubis, and all these other captcha services trying to see if you're a human. Yep. IMO, this is so far the biggest AI-inflicted damage to the web. A bit of anecdata - wikipedia (and all other wikimedia sites) are blocking my Firefox since about a week, with a "please respect our bot policy" message. Outright block, not even a captcha. It took me a while to figure out they don't like me disabling some SSL ciphers, so now "JA4 browser fingerprint" is not matching user-agent. Funnily enough curl (what I would imagine a bot would use) pulls exact same URLs from exact same client IP, just fine.

ImaCake 2mo ago
Maybe the curl thing is because they are happy to let you do some light scraping. What they want to avoid is bots directly crawling the page interactively. No one seems to be blocking chatGPT when I promot it to use it's web search skill anyway.