@m0xEE@p@jae It gets all the hate because it solves nothing by not being broad and annoys everyone that is a genuine visitor. And that is deserved. It's also deployed proactively by people that can't read logs (read: incompetent) as a magic fixall thing that stops bots. If you can't deal with a flood of bots with simple scripts and firewall rules, you shouldn't be running anything publicly accessible anyway.
It's the same humiliation ritual as CF/Google boats, but instead of clicking boats, you have to wait 20 seconds for some JavaScript to finish "Making sure you aren't a bot, teehee." And just like boats, it can be easily bypassed.
PS: Stack Exchange deployed a CF captcha that always gets triggered like 3 weeks ago which annoys me greatly.
> It gets all the hate because it solves nothing by not being broad and annoys everyone that is a genuine visitor.
Luckily I haven't bumped into it yet.
> It's also deployed proactively by people that can't read logs
This type of shit always gets deployed by people that have some up-their-own-asshole static site that will never be DoS'd.
> It's the same humiliation ritual as CF/Google boats, but instead of clicking boats, you have to wait 20 seconds for some JavaScript to finish "Making sure you aren't a bot, teehee."
I goddamn hate the cutesy shit. It's like those goddamn "Our gnomes are fixing the error just for you right now!" 5xx pages.
@sendpaws@phnt@jae@m0xEE I mean, shit, reading text on a goddamn web page shouldn't be a battery-intensive process but some people are trying their damnedest.
@p@jae@m0xEE >I goddamn hate the cutesy shit Reddit has by far the most rage inducing one. It has a certain soyware feeling to it, which perfectly describers Reddit.
Anubis carries a certain smugness with the banner and mascot. It reads to me like "I will compute thousands of hashes on your CPU, and you can do nothing about it, teehee." At least CF and recaptcha are mostly sterile.
>I'm tryin' really hard to not say anything about $current_year PleromaFE, especially when it fails to load. If it the splash screen goes away faster than the server can give me actual content like timelines and notifications, I don't mind it that much. Still I wish it was gone, but if it solved the problem of maintaining ThemesV2, which apparently was a mess, at least it solved something.
@m0xEE@jae@p >Being pestered these people won't just remove it — they'd switch to something even more problematic and then it's something like… you can't visit GitHub if your browser doesn't support Brotli. Both solutions are equally as problematic. Captchas/PoW challenges simply should not exist unless you are going to some are on the site that should be restricted like registration. I could even get behind the 4chan captcha if it was implemented properly and the challenge validity would last a few days at least. If going to a public page on your website multiple times a second is such a problem, why not cache it?
I also find it funny that Anubis is largely deployed by the same people that cry all the time about "AI bad", "AI wastes too much energy/water" while they are actively doing the same thing on a much larger scale probably. Anubis is literally a waste of electricity.
@phnt@fluffytail.org@jae@darkdork.dev@p@fsebugoutzone.org PS: Stack Exchange deployed a CF captcha that always gets triggered like 3 weeks ago which annoys me greatly. Yeah, that's my point! Being pestered these people won't just remove it — they'd switch to something even more problematic and then it's something like… you can't visit GitHub if your browser doesn't support Brotli. They might be incompetent, some of them might not even need it — but it's not about them, we end up not being able to access websites which had some useful content on them. ALWAYS. BTW first time I encountered CloudFlare was on a relatively smol website, like an imageboard, which was DDoSed by some of its most braindead visitors (!) — I'm sure for them it was "Ha-ha, fun!". And we ended up having this shit! BTW at the time it was justified as containerisation wasn't yet a thing and switching to a more expensive hosting was problematic. Anyway, things like this — they never end up well, they end up with something even worse. Because admins just give up trying to be competent and take the easy way out 🤷
@p@fsebugoutzone.org@jae@darkdork.dev@phnt@fluffytail.org I can just hate the Captcha without also hating the personality of the person that produced it. You do? No, I'm not like that — every time I see something about motor cycles I'm lighting up a bottle of incendiary stuff… and then I realise that I don't even have a Google data centre nearby 😅
@m0xEE@jae@p@sendpaws >What are difficulty levels? I don't know. All Anubis instances I saw either use level 4 or 5 which has zero meaning to me. My best guess is that sets the number of zeroes at the beginning of the hash that is required to pass the check.
@phnt@fluffytail.org@jae@darkdork.dev@p@fsebugoutzone.org@sendpaws@mitra.pawslut.party What are difficulty levels? I've never seen it take this long despite using the worst exit nodes with IP-addresses that get ReCAPTCHA immediately on websites that have it, I'm also using computers which are at least 10 yeart old and I'm only seeing this brown gurl because I have JS disabled by default — when I allow it, usually takes a split second.
> I don't know. All Anubis instances I saw either use level 4 or 5 which has zero meaning to me. My best guess is that sets the number of zeroes at the beginning of the hash that is required to pass the check.
this is where would-be sysops show that they're would-be sysops. they crank it up high thinking it's "ultimate security!!!" then they wonder why people complain.
if this thing was set to a level 2-3, i'd ignore it. but now i'm just bypassing it 100%
> It's like the sysops that think running 2 endpoint security suites is a good thing.
like wearing two pairs of underwear in case you have some gi-issues. still an issue. but you get a false sense of security that the taco-bell gate will hold.
@jae@p@sendpaws@m0xEE >this is where would-be sysops show that they're would-be sysops. they crank it up high thinking it's "ultimate security!!!" then they wonder why people complain. It's like the sysops that think running 2 endpoint security suites is a good thing.
i'd consider this a problem more so than a solution. but there are ways to do it yes, in fact plenty of posts about it if you have a search. beware of anime sodoku puzzles
@phnt@jae@p@sendpaws@m0xEE Dude, it takes 5.7 (5 plus 0.7) seconds to load lore.kernel.org on my Pixel 8 (yes it takes 5.7 seconds to load on a Pixel 8 if you still can't believe it)
@gorplop@eric@jae@m0xEE@phnt@sendpaws Because shitty JavaScript JITs are all optimized for x86-64 (especially if you're using some Chrome thing because Chrome was developed to run on Google servers before it started being another spyware vector) and ARM has different cache coherency guarantees and pipeline behavior. There's also less redundancy: things better farmed out to the GPU or FPU haven't been added to the ISA and compilers tend to shit the bed on what actually is there. On top of that, phones tend to be aggressive about saving power and lowering the clock to avoid heat, in Apple's case especially because they make money from an "app" but not from the web. Lots of shit going on.
@p@jae@phnt@sendpaws@m0xEE@eric@gorplop >Because shitty JavaScript JITs are all optimized for x86-64 Phones are all ARM, most chromebooks too, their users have a more consumerist mindset. Would make sense for the modern web cabal to optimize for ARM first, would be surprised if that's not the case already.
Captchas: AI can now solve the ones that humans with an average IQ can't.
Proof-of-work: AI has more processing power than the average user, and can solve them faster.
Just do what I do: rate-limit every single incoming connection individually, to the number of clicks/views that a normal human will do when browsing a web site. Users may occasionally get a "you're doing that too fast" message, but they'll never have to deal with bullshit captchas, or waiting for their 2005 laptop running windows XP to finish calculating a PoW hash.
@foxdickfarms@jae@phnt@p@sendpaws@m0xEE@eric Not aware of any local LLMs that have image recognition abilities on par with SaaSS solutions. Sure someone could train a model dedicated solely to rotating cubes, but at this point we're getting to the "scriptkiddie with too much free time" situation per crunk's zen of janny. zen of janny.png
@mint@foxdickfarms@jae@phnt@p@sendpaws@m0xEE@eric I tried to get a bunch of local llms to say nigger a while ago and none of them could do it. Even the "uncensored" ones on hugging face. There was reportedly one that will but I didn't try it
@RustyCrab@foxdickfarms@jae@phnt@p@sendpaws@m0xEE@eric@mint i remember seeing an uncensored AI benchmark table on huggingface, supposedly there were some that were essentially labeled as "anything goes" but i never thought of trying to get my local LLMs to say "nigger"
@waff@foxdickfarms@jae@phnt@p@sendpaws@m0xEE@eric That's a literal fucking theme of a thread, whether captchas are effective. I threw one used right on my fucking instance for someone to test against LLMs, then adjusted it with a big no-no word (nigger) to see if that helps. Read the damn thread.
@slipgate@jae@p@sendpaws@m0xEE@eric I don't have power saving options set manually. Turning off battery optimizations for Chrome made it increase to 1.2K. The only thing that can be doing this is some stupid OS-level battery optimization that cannot be turned off. Since realme is an Oppo brand and that's a sub-brand of Xiaomi, it's certainly possible that there's some fuckery.
But that proves my whole point even more. Anubis is badly implemented and simply should not exist.
@phnt@jae@p@sendpaws@m0xEE@eric Looking back on it, are you sure your phone's OS isn't throttling program performance as part of some battery saving plan? Xiaomi and Samsung are notorious for this.
For comparison, you get <1 kH/s. My 7 year old phone with 4 GBs of RAM is doing 14 kH/s.
@m0xEE@jae@p@sendpaws@eric@slipgate I didn't have any problems with davx5 in the 3 years I've been using it on this phone with stock ROM (because I refuse to download ROMs from random telegram channels).
@slipgate@phnt@eric@jae@m0xEE@sendpaws Maybe "it's retarded to require that much energy to view a goddamn website" bears repeating if people are going to keep showing up to talk about hash speed.
@phnt@jae@p@sendpaws@m0xEE@eric You can compile a LineageOS ROM yourself, if you've got enough RAM and patience. I can't be assed, so build by Pajeet from XDA it is
> Jobs told Walter Isaacson that he was "on one of my fruitarian diets," when he conceived of the name and thought "it sounded fun, spirited and not intimidating ... plus, it would get us ahead of Atari in the phone book."
Incidentally, that's not why I came back and replied to myself LIKE AN ASSHOLE, it was because I saw something funny between "Understood" and "Universidad Politecnica de Madrid": lalwz.png
@eric@pl.starnix.network The asymmetry here is not "AI" scrapers vs. good faith users, it's server vs. scraper — the scraper uses much more resources computing the hashes than server does checking the result, and even if they have a lot of resources, they still aren't infinite and they can't overwhelm the server that easily. For human visitors it's of course always a bad thing with no advantages — I mean other than they can still access the hosted content.
@m0xEE@eric@jae@RedTechEngineer@p@sendpaws@slipgate >computing resources Again, if your whole stack falls apart when randos start knocking on your search API or whatever, you architected it badly. Implement caching and rate-limiting that isn't based solely on single IPs; you have whole CDNs in front of your servers, use them. That's how you build resilient networks.
And if you run a site and are a single admin, then first of all, congrats that you gained enough attention for scrapers to notice, and secondly if the simple methods that don't hurt anyone I wrote above failed, then we can talk about implementing PoW. But by that time, we are talking maybe about 5% of sites that currently have it, might actually need a WAF in front.
If my small FranVM that hosted Pleroma and another ~50GB of git mirrors on IDE-tier slabs and handled that Chinese scraper traffic mostly without issues before I implemented any measures, then most competent people should be able to do the same. All I'm trying to say that hiding everything behind PoW challenges is 95% of the time an actual skill issue and nothing. Sometimes a time issue.
@jae@RedTechEngineer@p@sendpaws@m0xEE@eric@slipgate Most of the Chinese scrapers closed connecting if they didn't receive any data in usually less than a second, so that is actually a valid strategy. Even though it sounds stupid at first.
> Most of the Chinese scrapers closed connecting if they didn't receive any data in usually less than a second, so that is actually a valid strategy. Even though it sounds stupid at first.
two players in the market i respect. 🇷🇺 🇨🇳
at least there's an elegance about their approaches