6 ms·
> Solving the challenge–which is valid for one week once passed– One thing that I've noticed recently with the Arch Wiki adding Anubis, is that this one week p
by chrisnight 1y ago
> Solving the challenge–which is valid for one week once passed–
One thing that I've noticed recently with the Arch Wiki adding Anubis, is that this one week period doesn't magically fix user annoyances with Anubis. I use Temporary Containers for every tab, which means that I constantly get Anubis regenerating tokens, since the cookie gets deleted as soon as the tab is closed.
Perhaps this is my own problem, but given the state of tracking on the internet, I do not feel it is an extremely out-of-the-ordinary circumstance to avoid saving cookies.
- jsheard 1y agoIt could be worse, the main alternative is something like Cloudflares death-by-a-thousand-CAPTCHAs when your browser settings or IP address put you on the wrong side of their bot detection heuristics. Anubis at least doesn't require any interaction to pass. Unfortunately nobody has a good answer for how to deal with abusive users without catching well behaved but deliberately anonymous users in the crossfire, so it's just about finding the least bad solution for them.
- lousken 1y agoI hated everyone who enabled the cloudflare validation thing on their website, because it was blocked for months (I got stuck on that captcha that was refusing my Firefox). Eventually they fixed it but it was really annoying.
- goku12 1y agoThe CF verification page still appears far too often in some geographic regions. It's such an irritant that I just close the tab and leave when I see it. It's so bad that seeing the Anubis page instead is actually a big relief! I consider the CF verification and its enablers as a shameless attack the open web - a solution nearly as bad as the problem it tries to solve.
- _bin_ 1y agoForget esoteric areas, I'm an average American guy who gets them running from a residential IP or cell IP. It even happens semi-frequently on my iPhone which is insane. I guess I must have "bot-like" behavior in my browsing, even from a cell.
- WesolyKubeczek 1y agoI noticed that Google happily puts you on its shitlist as soon as you use any advanced parameters on your searches, such as “filetype:” or “inurl:” or “site:”.
- _bin_ 1y agoThis probably has something to do with it. I probably tend to move faster than average and am "bot-like" in that I sort of "scrape": search for something and quickly open all relevant tabs to review, page through them, search again. If while I'm going through I have something else I'd like to find, I'll fire up yet another tab and pop open all relevant tabs from that. Etc.
- throwaway562if1 1y agoI am still unable to pass CF validation on my desktop (sent to infinite captcha loop hell). Nowadays I just don't bother with any website that uses it.
- imcritic 1y agoToo many sites that used to be good installed that shit. And weird part is that on desktop only Chromium fails to pass the captcha, no issues on Firefox. But Chromium is my main browser and sometimes I'm too lazy/uncomfortable opening 2nd browser for those sites.
- trod1234 1y ago> Unfortunately nobody has a good answer for how to deal with abusive users without catching well behaved but deliberately anonymous users in the crossfire... Uhh, that's not right. There is a good answer, but no turnkey solution yet. The answer is making each request cost a certain amount of something from the person, and increased load by that person comes with increased cost on that person.
- halosghost 1y agoNote that this is actually one of the things Anubis does. That's what the proof-of-work system is, it just operates across the full load rather than targeted to a specific user's load. But, to the GP's point, that's the best option while allowing anonymous users. All the best, -HG
- deleted 1y ago[deleted]
- Spivak 1y agoI know that you mean a system that transfers money but you are also describing Anubis because PoW is literally to make accessing the site cost more and scale that cost proportional to the load.
- trod1234 1y ago> I know that you mean a system that transfer money .... No, cost is used in the fullest abstract meaning of the word here. Time cost, effort cost, monetary cost, work cost, so long as there is a functional limitation that prevents resource exhaustion that is the point.
- lelandbatey 1y agoIf cost can be anything, does Anubis implement such a system then, by using proof-of-work as the cost function?
- gruez 1y ago>It could be worse, the main alternative is something like Cloudflares death-by-a-thousand-CAPTCHAs when your browser settings or IP address put you on the wrong side of their bot detection heuristics. Cloudflare's checkbox challenge is probably the better challenge systems. Other security systems are far worse, requiring either something to be solved, or a more annoying action (eg. holding a button for 5 seconds).
- Dylan16807 1y agoChecking a box is fine when it lets you through. The problem is when cloudflare doesn't let you through.
- imcritic 1y agoSame problem with Google's captchas: solving them doesn't always mean you will be let in. That's outrageous, like isn't that the whole point?
- fmbb 1y agoNo, the whole point is you are helping machine learning training. Doing work for free.
- gruez 1y agoIt really isn't. If they were purely focused on getting training data, they would give more captchas to everyone, not just the users with no google cookies, connecting from VPN, and with weird browser configurations. The fact of the matter is that all those attributes are more "suspicious" than average, and therefore they want to up the cost for getting past the captcha.
- gruez 1y ago>The problem is when cloudflare doesn't let you through. Don't use an unusual browser configuration then, like spoofing user-agents or whatever? If you're doing it for "privacy" reasons, it's likely counterproductive. The fact that cloudflare can detect it means that the spoofing isn't doing a very good job, and therefore you're making yourself more fingerprintable.
- qiu3344 1y agoI'd even argue that Anubis is universally superior in this domain. A sufficiently advanced web scraper can build a statistical model of fingerprint payloads that are categorized by CF as legit and change their proxy on demand. The only person who will end up blocked is the regular user. There is also a huge market of proprietary anti-bot solvers, not to mention services that charge you per captcha-solution. Usually it's just someone who managed to crack the captcha and is generating the solutions automatically, since the response time is usually a few hundred milliseconds. This is a problem with every commercial Anti-bot/captcha solution and not just CF, but also AWS WAF, Akamai, etc.
- xena 1y agoThe pro gamer move is to use risk calculation as a means of determining when to throw a challenge, not when to deny access :)
- jillyboel 1y ago> One thing that I've noticed recently with the Arch Wiki adding Anubis Is that why it now shows that annoying slow to load prompt before giving me the content I searched for?
- esseph 1y agoWould you like to propose an alternative solution that meets their needs and on their budget?
- jillyboel 1y agoa static cache for anyone not logged in, and only doing this check when you are authenticated which gives access to editing pages? edit: Because HN is throwing "you're posting too fast" errors again: > That falls short of the "meets their needs" test. Authenticated users already have a check (i.e., the auth process). Anubis is to stop/limit bots from reading content. Arch Wiki is a high value target for scraping so they'll just solve the anubis challenge once a week. It's not going to stop them.
- glenngillen 1y agoThat falls short of the "meets their needs" test. Authenticated users already have a check (i.e., the auth process). Anubis is to stop/limit bots from reading content.
- esseph 1y ago... Are you saying a bot couldn't authenticate? Still need a layer there, could also have been a manual login to pull a session token.
- pynappo 1y ago> Arch Wiki is a high value target for scraping so they'll just solve the anubis challenge once a week. It's not going to stop them. The goal of Anubis isn't to stop them from scraping entirely, but rather to slow down aggressive scraping (e.g. sites with lots of pages being scraped every 6 hours[1]) so that the scraping doesn't impact the backend nearly as much [1] https://pod.geraspora.de/posts/17342163 https://pod.geraspora.de/posts/17342163, which was linked as an example in the original blog post describing the motivation for anubis[2] [2]: https://xeiaso.net/blog/2025/anubis/ https://xeiaso.net/blog/2025/anubis/
- bscphil 1y agoIt's even worse if you block cookies outright. Every time I hit a new Anubis site I scream in my head because it just spins endlessly and stupidly until you enable cookies, without even a warning. Absolutely terrible user experience; I wouldn't put any version of this in front of a corporate / professional site.
- Spivak 1y agoBrowsers that have cookies and/or JS disabled have been getting broken experiences for well over a decade, it's hard to take this criticism seriously when professional sites are the most likely to break in this situation.
- jezek2 1y agoIf you want to browse the web without cookies (and without JS in an usable manner) you may try FixProxy[1]. It has a direct support for Anubis in the development version. [1]: https://www.fixbrowser.org/blog/fixproxy https://www.fixbrowser.org/blog/fixproxy
- Dylan16807 1y agoBlocking cookies completely is just asking for a worse method of tracking sessions. It's fine for a site to be aware of visits. As someone who argues that sites should work without javascript, blocking all cookies strikes me as doing things wrong.
- bscphil 1y agoA huge proportion of sites (a) use cookies, (b) don't need cookies. You can easily use extensions to enable cookies for the sites that need them, while leaving others disabled. Obviously some sites are going to do shitty things to track you, but they'd probably be doing that anyway. The issue I'm talking about is specifically how frustrating it is to hit yet another site that has switched to Anubis recently and having to enable cookies for it.
- GoblinSlayer 1y ago
- TiredOfLife 1y agoIt's not a problem. You have configured your system to show up as a new visitor every time you visit a website. And you are getting expected behaviour.
- philipwhiuk 1y agoI think it's absolutely your problem. You're ignoring all the cache lifetimes on assets.
- selfhoster11 1y agoOK, so what? Keeping persistent state on your machine shouldn't be mandatory for a comfortable everyday internet browsing experience.
- orthecreedence 1y agoWhat then do you suggest as a good middle ground between website publishers and website enjoyers? Doing a one-time challenge and storing the result seems like a really good compromise between all parties. But that's not good enough! So what is?
- aseipp 1y ago"In a fantasy land that doesn't exist, or maybe last existed decades ago, this wouldn't be needed." OK, that's nice. What does that have to do with reality as it stands today, though?
- imcritic 1y agoFor me the biggest issue with archwiki adding Anubis is that it doesn't let me in when I open it on mobile. I am using Cromite: it doesn't support extensions, but has some ABP integrated in.
- selfhoster11 1y agoI am low-key shocked that this has become a thing on Arch Wiki, of all places. And that's just to access the main page, not even for any searches. Arch Wiki is the place where you often go when your system is completely broken, sometimes to the extent that some clever proof of work system that relies on JS and whatever will fail. I'm sure they didn't decide this lightly, but come on.
- ashkulz 1y agoI too use Temporary Containers, and my solution is to use a named container and associate that site with the container.