Comment by m00dy
2 days ago
Not sure why Anubis is getting so much hype on HN, but honestly, it is not the solution. A real solution would use behavioral modeling. Most browser fingerprinting issues are already largely solved anyway.
2 days ago
Not sure why Anubis is getting so much hype on HN, but honestly, it is not the solution. A real solution would use behavioral modeling. Most browser fingerprinting issues are already largely solved anyway.
As someone who is regularly blocked by CF and G - no, they are not. Even worse, they should not be, because that would mean the complete end of privacy online (not that we are far from that). Anubis works because at scale it wastes bots' resources (time mainly).
I think you’re confusing bots that crawl a website with bots used to launch DDoS attacks.
it works because the global ddos adversary doesn't run javascript
I'm genuinely baffled that this is your lived experience. I wonder if you only look at a very restricted set of websites?
PoW is a reasonable solution as a fallback when other metrics flag a client.
How? First, they can solve the Anubis challenge with native code, so they can solve them faster than genuine users. Second, the cost is nothing compared to training LLMs, plus they will just move the work to the residential proxies that they have access to (so, someone is paying through their TV's electricity bill).
Anubis only work(s|ed) great for a while when crawlers were not prepared for these challenges. Security through obscurity.
> they will just move the work to the residential proxies that they have access to
The proxies I am familiar with do not offer arbitrary code execution. I think you're thinking of a botnet.
Regarding native code, the current crop of solutions seem to work well enough for now. Ultimately a challenge response protocol should be standardized and browsers should ship a native implementation. In the meantime WASM likely gets you close enough to native.
1 reply →