4 ms·

I'm not moralizing. The sites running Anubis are owned by people who like Anubis and are fully within their rights to run Anubis. I don't care how enthusiastic

by tptacek 2mo ago

I'm not moralizing. The sites running Anubis are owned by people who like Anubis and are fully within their rights to run Anubis. I don't care how enthusiastic they are about it. It's their call. I'm just saying, it's bad computer science.

harshreality 2mo ago
You're arguing worst-case, and people running anubis are saying it dramatically helps in their experience, because they're not getting too many of the sorts of bots that people like you and Tavis (correctly) argue are theoretically possible. So the argument that it's "bad CS" falls flat. A better, perhaps the best, argument is that a worse bot mix might appear tomorrow, so anubis should be used as a runway for a better solution, and not as a solution in itself. If only everyone with a website had the desire (or AI tokens) to implement their own better solution. In some cases even desire or a lot of tokens isn't enough. I mean, you think kernel.org folks haven't put some serious thought into it? And yet, as HN argues about it, there's kernel.org running anubis at difficulty 5.
- tptacek 2mo ago
  I don't know what you mean by "the best argument". My entire argument is that it's bad CS. I'm not trying to convince people not to run Anubis. If anything, I'm trying to convince Anubis to use better computer science. That would make more people run it! But even that's just a faint subsidiary goal; the real goal, as someone who works in this field and has designed proof-of-work antiabuse systems before, is just to add clarity about what can and can't work and why.
  - harshreality 2mo ago
    I too would love anubis to use better CS, if available. Perhaps you have some ideas for @xena, instead of just letting anubis continue on the trajectory of iterating its PoW approach?
    - rvz 2mo ago
      Same here. But of course and as expected; 5 hours later, the GP comment offers no proper solutions for this "better computer science" they speak of. It shows they really don't care and they are just rage-baiting readers in their weekly grumpiness without any suggestions. Unless they come up with said "solution", they can completely ignored in their complaints.
      - tptacek 2mo ago
        I had a fairly long conversation with Xe privately about this and didn't feel the need to repeat it here, especially since (as the search box will tell you) I've already talked about this before. But, do go on.
        MallocVoidstar 2mo ago
        I looked at your comments and there's a bunch saying that Anubis is bad CS but none I could find saying what, exactly, you want Anubis to do instead. You sure are posting a lot about how it's bad, though.
        myng111 2mo ago
        It is interesting, this particular user seems extremely active in this thread. I'm not sure if they have a bone to pick with Anubis in particular or some other reason for disliking the software so much, but to me it does seem overzealous. Regardless of if it's "bad computer science" or what, Anubis works quite well and is easy to customise to target it to specific botnets, as I've done. And this is coming from someone trying to develop her own non-PoW anti-scraper system.
        arc-in-space 2mo ago
        You might want to note that "this particular user" is "extremely active" on this website. (Nothing against it, I'm always happy to hear what Thomas has to say)
inigyou 2mo ago
Which part of computer science is about getting DDoSed by billionaires who are above the law?
- TeMPOraL 2mo ago
  Where on Earth do people get the belief that: - It's the SOTA companies doing it? - Scrapers are doing it for training data? Those are two assumptions I see in posts and threads around Anubis, that are taken at faith, and never once substantiated.
  - inigyou 2mo ago
    What's your alternative hypothesis?
  - mschuster91 2mo ago
    > It's the SOTA companies doing it? There are more than just the American top dogs (OAI, Anthropic, SpaceX, Facebook)... especially the Chinese government with all its infinite cash resources and next to zero ethical constraints. I don't trust the US top dogs at all, but I think the fear of discovery alone would lead them to not use "residential proxy" services. Non-US/EU entities however... who cares?
    - figglestar 2mo ago
      Why would they directly use a proxy service? I'd just launder the data scraping through some third party company that I could slough off if it ever turned into a news story. Not that anything would happen to them if they directly used these services anyway.
  - shakna 2mo ago
    Because Anthropic already admitted it? [0] [0] https://www.ft.com/content/07611b74-3d69-4579-9089-f2fc2af61baa?syn-25a6b1a6=1 https://www.ft.com/content/07611b74-3d69-4579-9089-f2fc2af61...
    - 2mo ago
rtpg 2mo ago
I get what you're saying, but I think that in the abstract "here's this thing you can do to cut the annoying traffic down to 1/3rd its previous level" (with the obvious issues to legitimate users of course) feels like a nice thing to have in this current moment! If you were dealing with a DoS like this and had an option that cut the annoying traffic in half in a fairly deterministic way, that sounds like a decent thing to do operationally in the moment right?
crote 2mo ago
The real world doesn't care about the soundness of your computer science. All that matters is whether it works. It's like saying we should just completely give up on all NP-hard problems because we'll never discover a way to find the optimal solution in all cases. Meanwhile in the real world, people are more than happy with, say, a route planner which virtually all of the time gives them a solution which is within a rounding error of optimal. Nobody is going to care that it is technically bad science. Same with Anubis: Sure, it's a dead end in an ongoing arms race. It won't last forever. But right now it works pretty well, so let's hope it lasts until someone can figure out a better approach.
- tptacek 2mo ago
  I'm fine with you running Anubis. My point was that Tavis flagged the outcome this blog post is discussing a year ago. It was hotly disputed on HN at the time. That's all I'm saying.
- deleted 2mo ago
  [deleted]

by tptacek 2mo ago

harshreality 2mo ago

You're arguing worst-case, and people running anubis are saying it dramatically helps in their experience, because they're not getting too many of the sorts of bots that people like you and Tavis (correctly) argue are theoretically possible. So the argument that it's "bad CS" falls flat. A better, perhaps the best, argument is that a worse bot mix might appear tomorrow, so anubis should be used as a runway for a better solution, and not as a solution in itself. If only everyone with a website had the desire (or AI tokens) to implement their own better solution. In some cases even desire or a lot of tokens isn't enough. I mean, you think kernel.org folks haven't put some serious thought into it? And yet, as HN argues about it, there's kernel.org running anubis at difficulty 5.

tptacek 2mo ago
I don't know what you mean by "the best argument". My entire argument is that it's bad CS. I'm not trying to convince people not to run Anubis. If anything, I'm trying to convince Anubis to use better computer science. That would make more people run it! But even that's just a faint subsidiary goal; the real goal, as someone who works in this field and has designed proof-of-work antiabuse systems before, is just to add clarity about what can and can't work and why.
- harshreality 2mo ago
  I too would love anubis to use better CS, if available. Perhaps you have some ideas for @xena, instead of just letting anubis continue on the trajectory of iterating its PoW approach?
  - rvz 2mo ago
    Same here. But of course and as expected; 5 hours later, the GP comment offers no proper solutions for this "better computer science" they speak of. It shows they really don't care and they are just rage-baiting readers in their weekly grumpiness without any suggestions. Unless they come up with said "solution", they can completely ignored in their complaints.
    - tptacek 2mo ago
      I had a fairly long conversation with Xe privately about this and didn't feel the need to repeat it here, especially since (as the search box will tell you) I've already talked about this before. But, do go on.
      - MallocVoidstar 2mo ago
        I looked at your comments and there's a bunch saying that Anubis is bad CS but none I could find saying what, exactly, you want Anubis to do instead. You sure are posting a lot about how it's bad, though.
        myng111 2mo ago
        It is interesting, this particular user seems extremely active in this thread. I'm not sure if they have a bone to pick with Anubis in particular or some other reason for disliking the software so much, but to me it does seem overzealous. Regardless of if it's "bad computer science" or what, Anubis works quite well and is easy to customise to target it to specific botnets, as I've done. And this is coming from someone trying to develop her own non-PoW anti-scraper system.
        arc-in-space 2mo ago
        You might want to note that "this particular user" is "extremely active" on this website. (Nothing against it, I'm always happy to hear what Thomas has to say)

inigyou 2mo ago

Which part of computer science is about getting DDoSed by billionaires who are above the law?

TeMPOraL 2mo ago
Where on Earth do people get the belief that: - It's the SOTA companies doing it? - Scrapers are doing it for training data? Those are two assumptions I see in posts and threads around Anubis, that are taken at faith, and never once substantiated.
- inigyou 2mo ago
  What's your alternative hypothesis?
- mschuster91 2mo ago
  > It's the SOTA companies doing it? There are more than just the American top dogs (OAI, Anthropic, SpaceX, Facebook)... especially the Chinese government with all its infinite cash resources and next to zero ethical constraints. I don't trust the US top dogs at all, but I think the fear of discovery alone would lead them to not use "residential proxy" services. Non-US/EU entities however... who cares?
  - figglestar 2mo ago
    Why would they directly use a proxy service? I'd just launder the data scraping through some third party company that I could slough off if it ever turned into a news story. Not that anything would happen to them if they directly used these services anyway.
- shakna 2mo ago
  Because Anthropic already admitted it? [0] [0] https://www.ft.com/content/07611b74-3d69-4579-9089-f2fc2af61baa?syn-25a6b1a6=1 https://www.ft.com/content/07611b74-3d69-4579-9089-f2fc2af61...
  - 2mo ago

rtpg 2mo ago

I get what you're saying, but I think that in the abstract "here's this thing you can do to cut the annoying traffic down to 1/3rd its previous level" (with the obvious issues to legitimate users of course) feels like a nice thing to have in this current moment! If you were dealing with a DoS like this and had an option that cut the annoying traffic in half in a fairly deterministic way, that sounds like a decent thing to do operationally in the moment right?

crote 2mo ago

The real world doesn't care about the soundness of your computer science. All that matters is whether it works. It's like saying we should just completely give up on all NP-hard problems because we'll never discover a way to find the optimal solution in all cases. Meanwhile in the real world, people are more than happy with, say, a route planner which virtually all of the time gives them a solution which is within a rounding error of optimal. Nobody is going to care that it is technically bad science. Same with Anubis: Sure, it's a dead end in an ongoing arms race. It won't last forever. But right now it works pretty well, so let's hope it lasts until someone can figure out a better approach.

tptacek 2mo ago
I'm fine with you running Anubis. My point was that Tavis flagged the outcome this blog post is discussing a year ago. It was hotly disputed on HN at the time. That's all I'm saying.
deleted 2mo ago
[deleted]