6 ms·

It would be cool if the POW could be done ahead of time. That way I don't get stuck waiting while I'm working. Some type of credit/tokens that my browser could

It would be cool if the POW could be done ahead of time. That way I don't get stuck waiting while I'm working. Some type of credit/tokens that my browser could then spend.

xena 11d ago
I'm working on this with a private prototype. I'm probably going to lean towards using a Service Worker (https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API/Using_Service_Workers https://developer.mozilla.org/en-US/docs/Web/API/Service_Wor...) to renew challenges at a reduced difficulty. Stay tuned!
- gruez 11d ago
  That just creates another problem: if you're taking any measures to reduce tracking (ie. clearing cookies on shutdown or using temporary containers), this won't work. If anubis was being deployed on a site that a user visits often (eg. HN), the user might be convinced to whitelist it, but most anubis deployments are on random blogs or fediverse instances that I might not visit again in months. I'm certainly am not going to whitelist those sites, nor am I going to enable cookies wholesale just to avoid solving challenges.
  - xena 11d ago
    Look, if you're going out of your way to break expected behaviour on websites you shouldn't be surprised when people code to the most common denominator and then you have weird subtle breakage as a result.
    - anuthis 11d ago
      [flagged]
    - kstrauser 11d ago
      Gotta agree. Turning tracking cookies off? Sure! Turning session cookies off and then complaining that the server doesn’t remember you? Uhhh… And while I’m sympathetic to the idea of not wanting to run JS, to a first approximation modern browsers are JS engines that have graphical displays. How things should be vs how they are is a classic is/ought problem. The world took a vote on what a browser’s meant for and we lost. Fighting it today is rough; tomorrow, futile.
      - gruez 11d ago
        >Gotta agree. Turning tracking cookies off? Sure! Turning session cookies off and then complaining that the server doesn’t remember you? Uhhh… No, because there are technologies that don't have this issue, eg. privacy pass.
      - perching_aix 11d ago
        There's no mechanistic difference between the two types of cookies, let's not pretend this is an actual config choice that people are making. Whenever I hit Anubis, I simply go "keep your secrets then" and take my leave. The vast majority of the sites posted to HN (that catch my fancy) work fine or fine enough, and are better for it. If I really, really desperately want to check something out, I can always just turn stuff back on. Turns out, I rarely do. Shoutout to the particularly dogshit few that don't just require cookies and JS, but even third party JS. For reading a blogpost or a message thread!
        bmacho 11d ago
        > There's no mechanistic difference between the two types of cookies, let's not pretend this is an actual config choice that people are making. They probably meant 3rd party cookies. It's common to block those. 1st party cookies not so much.
        nosioptar 10d ago
        The Anubis anime girl is an instant tab close for me, especially while in public. I dont like having to explain to people that I'm not one of those creepy anime guys.
    - gkbrk 11d ago
      Clearing cookies when all you want to do is read static content is not "breaking expected behaviour on websites".
packetlost 11d ago
I wonder if you could convince the Anubis author to implement x402 payments to bypass the PoW
- JsonCameron 11d ago
  This could be done at the web server level, not requiring changes to Anubis
  - packetlost 10d ago
    It could be, but if it's a few lines of config in Anubis it would be easier and more likely to actually be done.
- apoorvkhanna88 11d ago
  [flagged]
dist-epoch 11d ago
Then we could implement an exchange, so that if you generate too much Anubis POW, you could exchange it with others. We could link it to a site, you generate for HN, I for Reddit, but it so happens that you visited Reddit more and I HN, so we depleted our Anubis POW, so we could exchange some Reddit Anubis with some HN Anubis.
- ssl-3 11d ago
  And then, we can inextricably link it to a new cryptocurrency -- let's call it BotCoin -- and make Sam Altman pay for it!
- kelvinjps10 11d ago
  Basically reinventing crypto one step at the time.
lxgr 11d ago
Or something that shadier websites could calculate ahead of time in your browser, then spend on your behalf. I feel like Anubis is ironically speedrunning a lot of discoveries the crypto folks have already made several years ago...
- Terr_ 11d ago
  What if the work output was bound to a particular source IP? That'd stop most "theft" at the expense of discards when your device switches networks.
  - xena 11d ago
    Anubis does this. Happy Eyeballs (https://en.wikipedia.org/wiki/Happy_Eyeballs https://en.wikipedia.org/wiki/Happy_Eyeballs), IPv6 privacy extensions (https://oneuptime.com/blog/post/2026-01-15-ipv6-privacy-extensions-security/view https://oneuptime.com/blog/post/2026-01-15-ipv6-privacy-exte...), and devices migrating between home and mobile IP addresses as the person moves have all caused issues with this. Fixing this is hard, but I have been trying.
    - wolrah 10d ago
      Happy Eyeballs and switching to/from mobile are definitely hard problems to deal with in a privacy-friendly way, but I don't think IPv6 privacy extensions should really matter here. Just treat a /64 the same way you'd treat a /32 in IPv6-land. It may represent multiple users, but they're all sharing the same internet connection which is as much as the global internet really wants to tell you. Whatever's on the user-controlled side of the address is of course untrustworthy anyways.
tomodachi94 11d ago
Privacy Pass does something similar to what you describe: https://developers.cloudflare.com/waf/tools/privacy-pass/ https://developers.cloudflare.com/waf/tools/privacy-pass/

It would be cool if the POW could be done ahead of time. That way I don't get stuck waiting while I'm working. Some type of credit/tokens that my browser could then spend.

xena 11d ago

I'm working on this with a private prototype. I'm probably going to lean towards using a Service Worker (https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API/Using_Service_Workers https://developer.mozilla.org/en-US/docs/Web/API/Service_Wor...) to renew challenges at a reduced difficulty. Stay tuned!

gruez 11d ago
That just creates another problem: if you're taking any measures to reduce tracking (ie. clearing cookies on shutdown or using temporary containers), this won't work. If anubis was being deployed on a site that a user visits often (eg. HN), the user might be convinced to whitelist it, but most anubis deployments are on random blogs or fediverse instances that I might not visit again in months. I'm certainly am not going to whitelist those sites, nor am I going to enable cookies wholesale just to avoid solving challenges.
- xena 11d ago
  Look, if you're going out of your way to break expected behaviour on websites you shouldn't be surprised when people code to the most common denominator and then you have weird subtle breakage as a result.
  - anuthis 11d ago
    [flagged]
  - kstrauser 11d ago
    Gotta agree. Turning tracking cookies off? Sure! Turning session cookies off and then complaining that the server doesn’t remember you? Uhhh… And while I’m sympathetic to the idea of not wanting to run JS, to a first approximation modern browsers are JS engines that have graphical displays. How things should be vs how they are is a classic is/ought problem. The world took a vote on what a browser’s meant for and we lost. Fighting it today is rough; tomorrow, futile.
    - gruez 11d ago
      >Gotta agree. Turning tracking cookies off? Sure! Turning session cookies off and then complaining that the server doesn’t remember you? Uhhh… No, because there are technologies that don't have this issue, eg. privacy pass.
    - perching_aix 11d ago
      There's no mechanistic difference between the two types of cookies, let's not pretend this is an actual config choice that people are making. Whenever I hit Anubis, I simply go "keep your secrets then" and take my leave. The vast majority of the sites posted to HN (that catch my fancy) work fine or fine enough, and are better for it. If I really, really desperately want to check something out, I can always just turn stuff back on. Turns out, I rarely do. Shoutout to the particularly dogshit few that don't just require cookies and JS, but even third party JS. For reading a blogpost or a message thread!
      - bmacho 11d ago
        > There's no mechanistic difference between the two types of cookies, let's not pretend this is an actual config choice that people are making. They probably meant 3rd party cookies. It's common to block those. 1st party cookies not so much.
      - nosioptar 10d ago
        The Anubis anime girl is an instant tab close for me, especially while in public. I dont like having to explain to people that I'm not one of those creepy anime guys.
  - gkbrk 11d ago
    Clearing cookies when all you want to do is read static content is not "breaking expected behaviour on websites".

packetlost 11d ago

I wonder if you could convince the Anubis author to implement x402 payments to bypass the PoW

JsonCameron 11d ago
This could be done at the web server level, not requiring changes to Anubis
- packetlost 10d ago
  It could be, but if it's a few lines of config in Anubis it would be easier and more likely to actually be done.
apoorvkhanna88 11d ago
[flagged]

dist-epoch 11d ago

Then we could implement an exchange, so that if you generate too much Anubis POW, you could exchange it with others. We could link it to a site, you generate for HN, I for Reddit, but it so happens that you visited Reddit more and I HN, so we depleted our Anubis POW, so we could exchange some Reddit Anubis with some HN Anubis.

ssl-3 11d ago
And then, we can inextricably link it to a new cryptocurrency -- let's call it BotCoin -- and make Sam Altman pay for it!
kelvinjps10 11d ago
Basically reinventing crypto one step at the time.

lxgr 11d ago

Or something that shadier websites could calculate ahead of time in your browser, then spend on your behalf. I feel like Anubis is ironically speedrunning a lot of discoveries the crypto folks have already made several years ago...

Terr_ 11d ago
What if the work output was bound to a particular source IP? That'd stop most "theft" at the expense of discards when your device switches networks.
- xena 11d ago
  Anubis does this. Happy Eyeballs (https://en.wikipedia.org/wiki/Happy_Eyeballs https://en.wikipedia.org/wiki/Happy_Eyeballs), IPv6 privacy extensions (https://oneuptime.com/blog/post/2026-01-15-ipv6-privacy-extensions-security/view https://oneuptime.com/blog/post/2026-01-15-ipv6-privacy-exte...), and devices migrating between home and mobile IP addresses as the person moves have all caused issues with this. Fixing this is hard, but I have been trying.
  - wolrah 10d ago
    Happy Eyeballs and switching to/from mobile are definitely hard problems to deal with in a privacy-friendly way, but I don't think IPv6 privacy extensions should really matter here. Just treat a /64 the same way you'd treat a /32 in IPv6-land. It may represent multiple users, but they're all sharing the same internet connection which is as much as the global internet really wants to tell you. Whatever's on the user-controlled side of the address is of course untrustworthy anyways.

tomodachi94 11d ago

Privacy Pass does something similar to what you describe: https://developers.cloudflare.com/waf/tools/privacy-pass/ https://developers.cloudflare.com/waf/tools/privacy-pass/