4 ms·
But the scraper is making way more requests and is paying for all that compute.
by smallerize 17d ago
But the scraper is making way more requests and is paying for all that compute.
- semiquaver 17d agono, a single solve returns a token which entitles the scraper to access the site as much as it wants for one week.
- NobodyNada 17d agoThe token should only be valid for one IP, so the scraper has to keep solving challenges if it rotates IPs.
- semiquaver 17d agoOK, but that doesn't change anything. You have a large pool of IPs, each of which only needs to expend a handful of extra milliseconds of work to get unlimited access to the protected resource. Even if you had to solve a L6 challenge for every request it's faster than the total RTT time of most servers. In other words not a meaningful barrier. And L6 is already a level which severely interferes with human usage of a site. a $5000 ASIC-based device can hash SHA256 at 200TH/s or more.
- LatticeAnimal 17d agoSome of the asymmetry might be regained if anubis had thousands of variations of PoW algorithms, each different enough that they must be solved independently. I wonder if AI might be able to come up with new PoW algorithms in a nightly CI job so every day is a different puzzle...
- inigyou 17d agoYou can do this on yours. Just have the client and server add an extra "2" after the challenge key or something. A different client which extracts the challenge key and does its own processing will only generate invalid responses.
- LatticeAnimal 17d agoCool, so then that invalidates the ASIC problem, right? My earlier idea was to imagine that each day Anubis picks an entirely different problem-class. Ex: one day it is Sha256, the next it is prime factorization, the next it is twin-prime-finding, the next it is cracking elliptic curves, the next it is some kind of sorting / information theory problem... All with the goal of adapting constantly so that scrapers have a harder time optimizing for the PoW problem (i.e. with Sha256 ASICs)
- inigyou 17d agoThat doesn't work because there is a finite list to choose from. Nobody is using ASICs on Anubis.
- CursedSilicon 17d ago...That sounds like entropy? As in, the thing computers are bad at (truly random numbers) and /dev/urandom in your kernel already spits out an approximation of?
- xena 17d ago> I wonder if AI might be able to come up with new PoW algorithms in a nightly CI job so every day is a different puzzle... This is something I'm working on in a prototype. Stay tuned!
- GoblinSlayer 16d agohashx kind of already does it.
- inigyou 17d agoThe way they're internally implemented doesn't allow pinning an IP. They buy a rotating proxy service from a vendor, and don't get to choose their source IP.
- semiquaver 17d agoWhy are you and other defenders of the Anubis approach so fixated on this one specific limitation of a certain type of scraping architecture? It’s hardly an immutable characteristic. You say “they” as if all scrapers are a monolithic group with the same constraints and goals. Part of the problem is the massive diversity.
- inigyou 17d agoWhy do you think anyone thinks it's immutable? Do you understand the basic concept of an arms race, or cat and mouse game?
- rstuart4133 17d agoIt's not hard to test. Go to a page that demands PoW, change your IP and see what happens. I just did it. Spoiler: kernel.org asks for a new PoW. If the source IP was an issue, you could do it other ways: for example, make the cookie rotate on every access, and insist there is a single stream of accesses.
- dspillett 17d ago> In other words not a meaningful barrier. And yet many report it works, at least for now, and the excess load due to scraping activity falls precipitously when Anubis or similar solutions are used. Maybe once this sort of challenge is used almost everywhere we'll see concerted attempts to get around it, but for now it is easier for them to just move on to another target. > a $5000 ASIC-based device can hash SHA256 at 200TH/s or more Peanuts for the big players, but many (almost all?) running smaller scale scraping operations are going to find $5000 rather prohibitive, and they are unlikely to be able to integrate it as they are probably running a “stock” scraper that they didn't write themselves.
- semiquaver 17d agoYou don’t need to spend $5000 to obtain the hash rate of a $5000 device on a rental basis. You may have heard of this thing called “the cloud”. Obtaining very high hash rates is effectively free, largely as a side effect of the crypto bust. Not sure why anyone would characterize these scrapers im general as all being fly-by-night operations that don’t have two cents to scrape together.
- dspillett 17d agoAnd yet you have not addressed the point that many report that tricks like Anubis work. If they are so stupid an idea that they could never work, why do they seem to having the desired effect?
- Dylan16807 17d agoA significant amount of the effect is everything outside the proof of work. Not the cost of hashing but the need to run the javascript that submits it. If you've seen anyone post a comparison of crawl rate versus difficulty, I'd love to see it. There's probably some difference but I want to know how much of the overall effect it is.
- semiquaver 17d agoI never said the approach was so stupid it could never work. I just shared how it’s annoying and how I worked around my annoyance. An even stupider approach would work exactly as well or better, like a form saying “type the letter y in this box to continue”. The only benefit is as a road bump that makes the site in any way custom. The moment anyone you are defending against so much as looks at the mechanics of solving the challenge it completely falls apart.
- tptacek 17d agoThis is the basic misconception behind the Anubis design. In an anti-spam system, there's a user/abuser reward asymmetry. Users make single requests and get some constant reward V. Abusers make millions of requests and also get some constant reward V. Proof-of-work exploits the asymmetry: costs are, by a factor of ~millions, disproportionately imposed on abusers. That's exactly not what happens with scrapers. Scrapers make millions of requests, yes. But each one of those requests produces an average (token-denominated) reward V'. There's no asymmetry at all: you're just adding a fixed cost to each reward, for both users and abusers. That's before you even get to questions like "does the system actually work, or does a single solve get practically unbounded rewards".
- graemep 17d agoI wonder whether what Anubis is doing might be blocking agents that do not run JS or that have a timeout (or humans who give up as I just did)
- tptacek 17d agoI suspect that's most of the value, and that the deterrent is about software construction and not about the proof-of-work, which I've been saying for the last year is a productive direction for Anubis to head towards. Instead, it's just sort of tormenting normal people, as a kind of performance of anger about AI. Which: I get! If it's your site, perform all the anger you want.
- progval 17d ago> There's no asymmetry at all: you're just adding a fixed cost to each reward, for both users and abusers. There is: users solve the PoW once, scrappers solve it every time they rotate IP addresses. Some of them change their IP address on every request, so they keep solving the PoW over and over.
- sunoforbrazilia 17d ago[flagged]
- DarmokTanagra 17d agonot if its running on someone else's device