Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> To me, Anubis is not only a blocker for AI scrapers. Anubis is a DDoS protection.

Anubis is DDoS protection, just with updated marketing. These tools have existed forever, such as CloudFlare Challenges, or https://github.com/RuiSiang/PoW-Shield. Or HashCash.

I keep saying that Anubis really has nothing much to do with AI (e.g. some people might mistakenly think that it magically "blocks AI scrapers"; it only slows down abusive-rate visitors). It really only deals with DoS and DDoS.

I don't understand why people are using Anubis instead of all the other tools that already exist. Is it just marketing? Saying the right thing at the right time?



I agree with you that it is infact a DDOS protection but still, the fact that it is open source and created by a really cool dev (she is awesome), I think I don't really mind it gaining popularity. And also they had created it out of their own necessity which is also really nice.

Anubis is getting real love out there and I think I am all for it. I personally host a lot of my stuff on cloudflare due to it being free with cloudflare workers but if I ever have a vps, I am probably going to use anubis as well


I'm not sure why there's so many negative comments here. This looks nice, appears to work, is open source and MIT licensed. Why _wouldn't_ I use this?


It also doesn’t cede more market power to CloudFlare, which tends to block non-mainstream browsers, users with adblockers, Tor, or cookies and JavaScript disabled.


I don't know what have I done but I'd say I get blocked by cloudflare a few visits per week. It's not a huge deal but it's very annoying


It's usually explained as site owner sets stringent security settings.


This tool does block JavaScript-disabled browsers though. There's a comment here that complained about the pain Anubis causes with cookie-less browsers, but they got downvoted.


There's also "checkpoint" [1] which works without Javascript. As far as I can tell they cover the same use case with a very similar user experience.

[1]: https://github.com/vaxerski/checkpoint


That's great, but noscript tag is used for a long time to abuse noscript users in various ways, so it makes sense to hide it.


how can it work without javascript. I have skimmed through the readme and it says cryptographic challenge.

How can anyone provide a cryptographic challenge without javascript feels like black magic.

Can you please explain to me how it works without javascript?


It just gives a perl script to run HashCash. https://github.com/vaxerski/checkpoint/blob/main/html/explai...

Javascript might be better to run in scratchpad.


I have plans involving IP reputation and a few other behaviors I've noticed. The main problem is that all my ideas involve cookies.


IP reputation will be subject to very high false negative rates because some unscrupulous bots have taken to laundering their traffic through residential proxy companies. There are alternatives to cookies like Etags, but they have their own issues.


All the other tools don't actually work. What I mean is that they block far, far, more than they intend to. Anubis actually works on every weird and niche browser I've tried. Which is to say, it lets actual human people through even if they aren't using Chrome.

CloudFlare doesn't do that. Cloudflare's false positive rate is extremely high, as are the others. Mostly because they all depend on bleeding edge JS and browser functions (CORS, etc) for fingerprinting functionality.

Cloudflare is for for-profit and other situations where you don't care if you block poor people because they can't give you money anyway. Anubis is for if you want everyone to be able to access your website.


I doubt it works with dillo or lynx.


if it doens't work yet, you can suggest a patch


The issue is lack of javacript support from these browsers.


I went to the Anubis authors blog last night and apparently the new versions of Anubis now use bleeding edge JS just like Cloudflare does. So now they both suck. Oh well. Good run for a couple months.


> I don't understand why people are using Anubis instead of all the other tools that already exist. Is it just marketing? Saying the right thing at the right time?

Care to share existing solutions that can be self-hosted ? (genuine question, I like how Anubis works, I just want something with a more neutral look and feel).


If you're using nginx there's this module: https://github.com/simon987/ngx_http_js_challenge_module


Unfortunately I'm stuck with Apache at work, but thanks for the suggestion.


For Apache there is mod_evasive and fail2ban


> I just want something with a more neutral look and feel.

If it is perfect for your needs other than the look, you could update the superficial parts to match your liking?

If it is designed in such a way as to make this difficult, such as if the visible content & styling is tangled within the code rather than all in static assets (I've not looked at the code myself yet), then perhaps raise an issue suggesting that this is changed (or if you are a coder yourself, perhaps do so and raise a pull request for your changes).

Given how popular the tool seems to be coming, I expect theming this sort of theming will be an official feature eventually anyway, of you are patient.

Of course the technique it uses is well know and documented, so there may already be other good implementations that match your visual needs without any of the above effort.


> If it is perfect for your needs other than the look, you could update the superficial parts to match your liking?

I would, but the author is not ok with this:

> Anubis is provided to the public for free in order to help advance the common good. In return, we ask (but not demand, these are words on the internet, not word of law) that you not remove the Anubis character from your deployment. If you want to run an unbranded or white-label version of Anubis, please contact Xe to arrange a contract.


Ah, I'd not looked into it far enough to see that so yes, just pulling the theme out and using your own could be dickish.

Though method used is not novel, and reimplementing shouldn't be too difficult if you wish to use it without their aesthetics without going against their politely expressed wishes.


I linked https://github.com/RuiSiang/PoW-Shield in my post. Does it work?


Thanks, looks better indeed. I will test.


Knowing something exists is half the challenge. Never used it but ,maybe ease of use/setup or license?


The readme explains that it's for the case when you don't use cloudflare, also it's open source, analogous to PoW Shield, but has less heavy dependencies.


Though PoW Shield uses simple symmetric signature, while anubis uses ed25519/jwt.


pow shield does not offer a furry loading screen so it can't be as good


hacker news is not immune to viral marketing


Fun fact: that PoW-Shield repo is authored by a guy jailed for running a massive darknet market (Incognito.)


that's how you know it's good


marketing plus a product that Just Does The Thing, it seems like. No bullshit.

btw it only works on AI scrapers because they're DDoSes.


Not all DDoSes are AI-related, and not all AI scrapers are DDoSes.


But almost all DoS's we're talking about are from corporations. The real non-human danger.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: