4 ms·

A patch for this was submitted in April: https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/message/F4FVBV4GOAWHEPVJ4JAJLHQ23UPKDJ6I/ https://lists.

by aeyes 1mo ago

A patch for this was submitted in April: https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/message/F4FVBV4GOAWHEPVJ4JAJLHQ23UPKDJ6I/ https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.o... Edit: And there was discussion about this back in 2024 as well

semiquaver 1mo ago
Oddly enough I can’t access that site, it just heats up my phone solving hashes. Gave up after about a minute and anubis had only made it less than halfway through. I doubt the real bots have any trouble bypassing it.
- demibabs 1mo ago
  Yeah, is it trying to mine bitcoin or something? Anubis usually takes a second but here I waited a minute and got 20% through on a modern phone.
  - bulder 1mo ago
    Presumably they've configured it to use a higher difficulty challenge due to high rates of scraping on their bugtracker
    - myng111 1mo ago
      Difficulty 6 which some parts of FFmpeg use, is about the highest difficulty you can assign with the default Anubis config. For me personally I only serve that difficulty if I'm near certain the user is a bot. Serving it to everyone sure is a choice.
- bartread 1mo ago
  [flagged]
  - Georgelemental 1mo ago
    > And don't come crying to me about how the problem you're trying to solve is "hard". I don't care: you chose it, you chose to considerably worsen the web browsing experience of millions of people globally, nobody made you. Unfortunately, if you let all the bots in, they overwhelm your servers, and then nobody can access the website.
    - aystatic 1mo ago
      Not if you use a decentralized peer-to-peer Git forge like https://radicle.network https://radicle.network. If one node goes down, users can still access the same issues/PRs from another endpoint.
      - breznev 1mo ago
        Genuinely surprised to see these guys still committed to the grift. Berlin ain't so cheap these days, I guess
  - a2ff6eeb0 1mo ago
    I assume you're offering to pay for the increased server costs? I had some git hosting up for a while, and was serving hundreds of qps and several terabytes per month. I can only imagine want significant sites are serving.
    - bartread 1mo ago
      > I assume you're offering to pay for the increased server costs? Such a non-argument. I'm expecting people to create better, more effective, and less intrusive anti-bot measures. Measures that accurately detect bots but don't exclude real people from the web simply because of the browser they're using, or the country they either appear to be in or are in fact in, for example.
      - j16sdiz 1mo ago
        I am expecting a unicorn.
- post-it 1mo ago
  It also took insanely long on my iPhone 16. "Made with heart in Canada" but configured poorly.
- hiccuphippo 1mo ago
  Took less than a minute in my 5 year old xiaomi phone. It did take way longer than other Anubis sites I've seen.
- gguingff 1mo ago
  happy to report my bots have no trouble with anubis or any other pow mechanism, little bit of deno and i'm right through.
  - LoganDark 1mo ago
    The point is to deter bots that are scraping thousands to millions of websites in parallel, not user agents.
- inventor7777 1mo ago
  It's puzzling how mild the reactions are to Anubis compared to the people reacting to seeing one singular Cloudflare captcha checkbox. I'd much rather a checkbox than a brief CPU-intensive hashing session.
  - da_chicken 1mo ago
    I think when people are complaining about Captcha they're complaining about yet another "pick 6-20 pictures of traffic lights/school busses/stairs/stop signs/bicycles."
    - mapontosevenths 1mo ago
      If they want to train an AI they should pay for it like everyone else. Modern bots have zero problems solving these, it's just free training for them.
      - da_chicken 1mo ago
        > If they want to train an AI they should pay for it like everyone else. They're paying for electricity and taking data without paying for it. It seems to me that they're paying for it exactly the same way everyone else in AI did.
      - Scoundreller 1mo ago
        Does the bot include the rider when identifying bicycles? When is an ebike a motorcycle/no longer a bicycle? The support structure for a traffic light or just the coloured light bits?
    - inventor7777 1mo ago
      Not in this case. I wish I could find the actual post, but I recall reading a post on HN recently where a majority of the commenters were claiming that when they even see a Cloudflare verification checkbox that they leave the website. This makes no sense to me as in my experience, you click the checkbox and then it verifies you without extra steps.
- kurtoid 1mo ago
  their anubis difficulty is wayyy to high; 6 is overkill
- arjie 1mo ago
  It's a pity about the web, because it's becoming less accessible over time. Regardless, I (and some others) archive many of the things we browse to, so here you go: https://amber.agentic.church/web/lists.ffmpeg.org/20260828070946/https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/message/F4FVBV4GOAWHEPVJ4JAJLHQ23UPKDJ6I/ https://amber.agentic.church/web/lists.ffmpeg.org/2026082807... Apparently, not the fonts they use for icons.
- xxs 1mo ago
  It took around 15kJ to access the site... that's a proper waste and somewhat sad, even though I understand.
  - pfdietz 1mo ago
    So, about $0.001 of electricity. The nerve!
  - iso1631 1mo ago
    A typical GPT5 or DeepSeek-R1 AI request uses about 100kJ
- hexagonwin 1mo ago
  it's putting full load on my 6core 11th gen i5 machine for more than a minute. i just closed it..
yorwba 1mo ago
A patch was submitted, but apparently not merged. That was also my experience trying to submit a patch for https://trac.ffmpeg.org/ticket/8738 https://trac.ffmpeg.org/ticket/8738 . Somebody on the bug tracker took note, but was apparently unable to effect a merge in the intervening years. Maybe now that ffmpeg is using Forgejo, the ball won't be dropped like this as often. Or there'll just be a five-digit number of open pull requests instead.
its-summertime 1mo ago
For those with difficulty accessing: - - - From: Anthony Hurtado <[redacted since hn has no scrape protection]> vpk_read_packet() divides vpk->last_block_size and (par->block_align - vpk->last_block_size) by par->ch_layout.nb_channels without checking for zero. While vpk_read_header() validates nb_channels > 0, the codec parameters may become zero through format probing misidentification (VPK probe score is 2/3 of AVPROBE_SCORE_MAX) or codec parameter reset, causing SIGFPE. Fix by: - Checking nb_channels != 0 before division in vpk_read_packet - Returning EOF for empty last blocks (last_block_size == 0) - Validating block_count > 0 in vpk_read_header - Validating last_block_size <= block_align in vpk_read_header Found by fuzzing with libFuzzer + AddressSanitizer. Reproduces with 10 distinct inputs. [patch redacted for brevity]
- timpera 1mo ago
  Thank you! I gave up after more than 2 whole minutes of waiting on a high-end smartphone. I'm not sure this keeps bots out, but it definitely keeps users out…
  - deleted 1mo ago
    [deleted]
  - vachina 1mo ago
    It keeps casual users (which most bots masquerade as) out. For frequent users of that site it is a solve once access forever.
    - iso1631 1mo ago
      I don't get it, it briefly flashed up on my iphone , about quarter second maybe, then passed on. Does the same in private mode. Maybe it uses other heuristics like detecting if someone lives in the AI agent world
      - duskdozer 1mo ago
        Took like 2.5-3 minutes on my regular desktop browser. Nothing AI related
theowaway 1mo ago
[flagged]
- deepsun 1mo ago
  It's Anubis and it's actually cool and loved project here. It's an open-source Captcha that filters out bots, and it doesn't track you around the web, unlike Google or cloudflare captcha.
  - stevekemp 1mo ago
    Cool, and loved by some. Annoying and disliked by others. I understand why people choose it, but if I see the catgirl I close the tab - same is I get the test from cloudflare.
    - deepsun 1mo ago
      Yep, but it's their freedom -- website authors have freedom to designe websites however they choose, and we as consumers have freedom to not go there. I was startled by the girl the first time as well, but once I learned what it is, I accepted it. Like a garden gnome on someone's front yard.
    - purerandomness 1mo ago
      > Annoying and disliked by others > if I see the catgirl I close the tab Isn't it easier to just .. start loving it instead?
  - klez 1mo ago
    > and loved project here You may want to check upthread how loved it is :) I, for one, don't hate it, but I hate what it represents and see its existence (rather, the reason for its existence) as a defeat for the web.
  - sunaookami 1mo ago
    Speak for yourself.
- 1mo ago

by aeyes 1mo ago

semiquaver 1mo ago

Oddly enough I can’t access that site, it just heats up my phone solving hashes. Gave up after about a minute and anubis had only made it less than halfway through. I doubt the real bots have any trouble bypassing it.

demibabs 1mo ago
Yeah, is it trying to mine bitcoin or something? Anubis usually takes a second but here I waited a minute and got 20% through on a modern phone.
- bulder 1mo ago
  Presumably they've configured it to use a higher difficulty challenge due to high rates of scraping on their bugtracker
  - myng111 1mo ago
    Difficulty 6 which some parts of FFmpeg use, is about the highest difficulty you can assign with the default Anubis config. For me personally I only serve that difficulty if I'm near certain the user is a bot. Serving it to everyone sure is a choice.
bartread 1mo ago
[flagged]
- Georgelemental 1mo ago
  > And don't come crying to me about how the problem you're trying to solve is "hard". I don't care: you chose it, you chose to considerably worsen the web browsing experience of millions of people globally, nobody made you. Unfortunately, if you let all the bots in, they overwhelm your servers, and then nobody can access the website.
  - aystatic 1mo ago
    Not if you use a decentralized peer-to-peer Git forge like https://radicle.network https://radicle.network. If one node goes down, users can still access the same issues/PRs from another endpoint.
    - breznev 1mo ago
      Genuinely surprised to see these guys still committed to the grift. Berlin ain't so cheap these days, I guess
- a2ff6eeb0 1mo ago
  I assume you're offering to pay for the increased server costs? I had some git hosting up for a while, and was serving hundreds of qps and several terabytes per month. I can only imagine want significant sites are serving.
  - bartread 1mo ago
    > I assume you're offering to pay for the increased server costs? Such a non-argument. I'm expecting people to create better, more effective, and less intrusive anti-bot measures. Measures that accurately detect bots but don't exclude real people from the web simply because of the browser they're using, or the country they either appear to be in or are in fact in, for example.
    - j16sdiz 1mo ago
      I am expecting a unicorn.
post-it 1mo ago
It also took insanely long on my iPhone 16. "Made with heart in Canada" but configured poorly.
hiccuphippo 1mo ago
Took less than a minute in my 5 year old xiaomi phone. It did take way longer than other Anubis sites I've seen.
gguingff 1mo ago
happy to report my bots have no trouble with anubis or any other pow mechanism, little bit of deno and i'm right through.
- LoganDark 1mo ago
  The point is to deter bots that are scraping thousands to millions of websites in parallel, not user agents.
inventor7777 1mo ago
It's puzzling how mild the reactions are to Anubis compared to the people reacting to seeing one singular Cloudflare captcha checkbox. I'd much rather a checkbox than a brief CPU-intensive hashing session.
- da_chicken 1mo ago
  I think when people are complaining about Captcha they're complaining about yet another "pick 6-20 pictures of traffic lights/school busses/stairs/stop signs/bicycles."
  - mapontosevenths 1mo ago
    If they want to train an AI they should pay for it like everyone else. Modern bots have zero problems solving these, it's just free training for them.
    - da_chicken 1mo ago
      > If they want to train an AI they should pay for it like everyone else. They're paying for electricity and taking data without paying for it. It seems to me that they're paying for it exactly the same way everyone else in AI did.
    - Scoundreller 1mo ago
      Does the bot include the rider when identifying bicycles? When is an ebike a motorcycle/no longer a bicycle? The support structure for a traffic light or just the coloured light bits?
  - inventor7777 1mo ago
    Not in this case. I wish I could find the actual post, but I recall reading a post on HN recently where a majority of the commenters were claiming that when they even see a Cloudflare verification checkbox that they leave the website. This makes no sense to me as in my experience, you click the checkbox and then it verifies you without extra steps.
kurtoid 1mo ago
their anubis difficulty is wayyy to high; 6 is overkill
arjie 1mo ago
It's a pity about the web, because it's becoming less accessible over time. Regardless, I (and some others) archive many of the things we browse to, so here you go: https://amber.agentic.church/web/lists.ffmpeg.org/20260828070946/https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/message/F4FVBV4GOAWHEPVJ4JAJLHQ23UPKDJ6I/ https://amber.agentic.church/web/lists.ffmpeg.org/2026082807... Apparently, not the fonts they use for icons.
xxs 1mo ago
It took around 15kJ to access the site... that's a proper waste and somewhat sad, even though I understand.
- pfdietz 1mo ago
  So, about $0.001 of electricity. The nerve!
- iso1631 1mo ago
  A typical GPT5 or DeepSeek-R1 AI request uses about 100kJ
hexagonwin 1mo ago
it's putting full load on my 6core 11th gen i5 machine for more than a minute. i just closed it..

yorwba 1mo ago

A patch was submitted, but apparently not merged. That was also my experience trying to submit a patch for https://trac.ffmpeg.org/ticket/8738 https://trac.ffmpeg.org/ticket/8738 . Somebody on the bug tracker took note, but was apparently unable to effect a merge in the intervening years. Maybe now that ffmpeg is using Forgejo, the ball won't be dropped like this as often. Or there'll just be a five-digit number of open pull requests instead.

its-summertime 1mo ago

For those with difficulty accessing: - - - From: Anthony Hurtado <[redacted since hn has no scrape protection]> vpk_read_packet() divides vpk->last_block_size and (par->block_align - vpk->last_block_size) by par->ch_layout.nb_channels without checking for zero. While vpk_read_header() validates nb_channels > 0, the codec parameters may become zero through format probing misidentification (VPK probe score is 2/3 of AVPROBE_SCORE_MAX) or codec parameter reset, causing SIGFPE. Fix by: - Checking nb_channels != 0 before division in vpk_read_packet - Returning EOF for empty last blocks (last_block_size == 0) - Validating block_count > 0 in vpk_read_header - Validating last_block_size <= block_align in vpk_read_header Found by fuzzing with libFuzzer + AddressSanitizer. Reproduces with 10 distinct inputs. [patch redacted for brevity]

timpera 1mo ago
Thank you! I gave up after more than 2 whole minutes of waiting on a high-end smartphone. I'm not sure this keeps bots out, but it definitely keeps users out…
- deleted 1mo ago
  [deleted]
- vachina 1mo ago
  It keeps casual users (which most bots masquerade as) out. For frequent users of that site it is a solve once access forever.
  - iso1631 1mo ago
    I don't get it, it briefly flashed up on my iphone , about quarter second maybe, then passed on. Does the same in private mode. Maybe it uses other heuristics like detecting if someone lives in the AI agent world
    - duskdozer 1mo ago
      Took like 2.5-3 minutes on my regular desktop browser. Nothing AI related

theowaway 1mo ago

[flagged]

deepsun 1mo ago
It's Anubis and it's actually cool and loved project here. It's an open-source Captcha that filters out bots, and it doesn't track you around the web, unlike Google or cloudflare captcha.
- stevekemp 1mo ago
  Cool, and loved by some. Annoying and disliked by others. I understand why people choose it, but if I see the catgirl I close the tab - same is I get the test from cloudflare.
  - deepsun 1mo ago
    Yep, but it's their freedom -- website authors have freedom to designe websites however they choose, and we as consumers have freedom to not go there. I was startled by the girl the first time as well, but once I learned what it is, I accepted it. Like a garden gnome on someone's front yard.
  - purerandomness 1mo ago
    > Annoying and disliked by others > if I see the catgirl I close the tab Isn't it easier to just .. start loving it instead?
- klez 1mo ago
  > and loved project here You may want to check upthread how loved it is :) I, for one, don't hate it, but I hate what it represents and see its existence (rather, the reason for its existence) as a defeat for the web.
- sunaookami 1mo ago
  Speak for yourself.
1mo ago