"Prove that you're human by solving these machine-generated puzzles that machines can solve to give us more data to train our machines, while we run a simple script in the background to verify that you're human based on your browser's metadata."
I had a captcha a few days ago that was something like "click on all the pictures that go with this" with a picture of a saucepan and the grid was food items and other things.
I pointed my phone at it and asked Gemini and almost instantly it said "the potato in the top left and the carrots look the middle of the bottom row".
While I despise the captchas from a human perspective, the fact that an LLM can solve the challenge isn't a deal breaker. It doesn't need to be impossible for a non-human to solve, it just has to be too expensive.
It does certainly shift the equation to stuff like proof of work since a computer can solve it anyway, might as well not annoy the human.
Oh is the person riding the bicycle part of the bicycle this time? What do you want, the corner of the pedal that is just barely in the box, or the out of focus blur in the background that might be a bicycle or it might be a bear. It's hard to tell.
I have a self bound rule to never do the multi-tile single image ones. Fuck those so much, they're always wrong. I will refresh for as long as it takes to get a grid of smaller images that may also be hard but I at least have some better grasp over.
With the proof of work approach, at least it's demanding the client consume some resources, though the 'right' amount is a tricky question, either it's so trivial as to hardly matter to the scrapers, or it's hard enough to put a dent in the scrapers' build, but human operated low end devices are royally screwed..
Here the crawler simply schedules a resumption and moves on to other work. The crawler doesn't need it right now and it's free for it to wait.
I love how toxic she is to corporate professionalism.
Its also perfect marketing, the software is free with the mascot hardcoded in. The official way to change it is to contribute to get an enterprise version.
He means that many people in a corporate environment wouldn't expect a anime girl with a magnifying glass popping up on your screen, that could reflect badly on your company. Just imagine some CEO sharing his screen in a presentation and his background is a screenshot of some hentai scene or something. It wouldn't make you seem very professional in the eye of the other corporate people.
That's why companies that use anubis will usually pay for the subscription so they can replace the mascot with something else.
Not that it matters, but it's not anime style, it's a "western" style cartoon character. Compare it to e.g. the original Disney princesses, the proportions and style look like that, not like anime characters.
Hmm, well, thanks for throwing that tidbit in either way. I'm certainly not deep into that whole artform, so probably just saw big eyes + cat ears and that was the end of my thought process. 🫠
Anubis - an anti-scraping plugin for websites. I believe one of its claims to fame is placing LLM crawlers into "tar pits" (preventing them from eating website resources)
It does show up whenever you load into the site though, so I guess that makes their mascot stick in everyone's head.
The Anubis challenge could be easily and cheapely solved by any JavaScript engine. It only becomes expensive for a massive number of petitions.
If for instance you would want to register a few thousand emails in a forum anubis is not going to stop anyone.
In fact I'm sceptical about really having an impact. As even when the challenge goes up in difficulty is not that expensive compared with all other cost related to these kinds of attacks or massive scrapes.
My suspicion is that most websites using Anubis see a positive impact because most crawlers and probers doesn't take into account Anubis, so they don't even attach a way to solve the challenge and they directly go into the "rejected by anubis" bucket. But any targeted attack I suppose would pass easily, either by doing a slow attack not to up the challenge very much, or just eating the cost. Imagine an AI company that using nuclear plants for training data, the cost of solving a few million JavaScript challenges is nothing in comparison.
As a DDOS mitigation it helps, but once again it's just a matter of eating the cost by the attacker. And the attack will still deny some service as the challenge go up and new legit users would also need to solve harder challenges.
I am skeptical about the real level of protection that Anubis really provides.
At the end is an automated test. Meaning that any machine could easily solve it.
Most "attackers" wont bother solving it because they don't really care. But if they would want they could. It's sort of protection by obscurity.
The more Anubis it's used the more we see attacks that actually equip a way to solve the challenges. Then is when Anubis up the challenge and the battle begin, between how much can Anubis up the challenge so normal users can still browse and how much cost the attacker is willing to eat.
Giving that these attackers tend to have high budgets I'm not that certain about its actual capabilities to reject a targeted ddos.
As for crawling for big data. I do think that it does nothing here. Companies willing yo scrape big amounts of data, for AI training or other purposes, have massive budgets and the electricity cost of solving the JavaScript challenges become nothing in comparison. They also doesn't need ro deny the service so they could spread the scrape to keep the challenge low reducing the cost even more.
Once again, positive results we currently see in practice I believe that are caused just because most scrappers and ddos attackers are just blindly attacking and doesn't really equip themselves for Anubis. Protection by obscurity. But a well equiped attacker I don't think it would have that much trouble getting past it, specially for scrapping, or other type of bot attacks that could be slowed down.
You're right, although my understanding is that there are a lot of poorly implemented scrapers for AI services unintentionally DDoSing websites with requests, so Anubis is more of a mitigation against those.
Yeah, seems like the problem is that fundamentally it could work by upping the difficulty a smidge making it then meaningfully expensive, but the spread between slowest edge device and high end means it's impossible to chase that difficulty without screwing over low end device users..
TBF Anna's just provides a dataset for people who want it and don't directly host any of the content (they're just the index). Anubis probably isn't as necessary for them.
76 Comments
synapse1278@lemmy.world · 279 pts · 100d
I much prefer to see Anubis rather than some bullshit captcha with a grid of AI generated slop that requires 30 clicks to pass.
GalacticSushi@piefed.blahaj.zone · 101 pts · 100d
You mean 30 clicks before it tells you to "please try again" for no reason.
wonderingwanderer@sopuli.xyz · 60 pts · 100d
"Prove that you're human by solving these machine-generated puzzles that machines can solve to give us more data to train our machines, while we run a simple script in the background to verify that you're human based on your browser's metadata."
bandwidthcrisis@lemmy.world · 12 pts · 100d
I had a captcha a few days ago that was something like "click on all the pictures that go with this" with a picture of a saucepan and the grid was food items and other things.
I pointed my phone at it and asked Gemini and almost instantly it said "the potato in the top left and the carrots look the middle of the bottom row".
jj4211@lemmy.world · 5 pts · 100d
While I despise the captchas from a human perspective, the fact that an LLM can solve the challenge isn't a deal breaker. It doesn't need to be impossible for a non-human to solve, it just has to be too expensive.
It does certainly shift the equation to stuff like proof of work since a computer can solve it anyway, might as well not annoy the human.
programmer_belch@lemmy.dbzer0.com · 19 pts · 100d
To keep training the captcha solving AI of course
JasonDJ@lemmy.zip · 7 pts · 100d
Oh is the person riding the bicycle part of the bicycle this time? What do you want, the corner of the pedal that is just barely in the box, or the out of focus blur in the background that might be a bicycle or it might be a bear. It's hard to tell.
hertg@infosec.pub · 9 pts · 100d
synapse1278@lemmy.world · 24 pts · 100d
I've read somewhere the main dev has comissioned an artist to redo the Anubis mascot.
ruby@lemmy.dbzer0.com · 5 pts · 100d
funner fact: anubis itself is slop
https://github.com/TecharoHQ/anubis/blob/main/AGENTS.md
AdrianTheFrog@lemmy.world · 4 pts · 98d
That one was, but the current one is not
snowdriftissue@lemmy.world · 3 pts · 99d
The repo credits a real artist for the anubis image
https://github.com/TecharoHQ/anubis/blob/main/web/static/img/ATTRIBUTIONS.txt
nforminvasion@lemmy.world · 2 pts · 100d
I have a self bound rule to never do the multi-tile single image ones. Fuck those so much, they're always wrong. I will refresh for as long as it takes to get a grid of smaller images that may also be hard but I at least have some better grasp over.
undefinedTruth@lemmy.zip · 197 pts · 100d
Anubis is open source, self-hosted, doesn't block me just because I use a VPN and the later versions work even with JavaScript disabled!
Fuck Cloudflare, long live Anubis!
ReginaPhalange@lemmy.world · 21 pts · 100d
How exactly is a proof of work engine suppose to run, without any JS work?
idunnololz@lemmy.world · 37 pts · 100d
https://anubis.techaro.lol/docs/admin/configuration/challenges/metarefresh/
Apparently it just tells your browser to refresh after x seconds.
daniskarma@lemmy.dbzer0.com · 7 pts · 100d
That's just protection by obscurity then. Any targeted attack could do that challenge at zero cost.
jj4211@lemmy.world · 3 pts · 100d
Seems utterly pointless though...
With the proof of work approach, at least it's demanding the client consume some resources, though the 'right' amount is a tricky question, either it's so trivial as to hardly matter to the scrapers, or it's hard enough to put a dent in the scrapers' build, but human operated low end devices are royally screwed..
Here the crawler simply schedules a resumption and moves on to other work. The crawler doesn't need it right now and it's free for it to wait.
captcha@lemmy.frozeninferno.xyz · 2 pts · 100d
Which doesn't work with some browsers, but it's acceptable, I guess
Anarki_@lemmy.blahaj.zone · 2 pts · 100d
Read the docs.
mecen@lemmy.ca · 2 pts · 99d
Cloudflare is great compared to Recaptcha.
Anubis is the best by far.
chris@l.roofo.cc · 196 pts · 100d
I don't mind the second it takes. Better than the service going down because of AI bots.
Evil_Shrubbery@thelemmy.club · 130 pts · 100d
Actually the opposite for me - I love to see her for a second, brightens the day a bit, fights the evil megacorps.
raicon@piefed.social · 10 pts · 100d
-AAAnubis-chan
scoobford@piefed.blahaj.zone · 64 pts · 100d
Or cloudflare. Fuck cloudflare.
Korhaka@sopuli.xyz · 3 pts · 100d
Can take a fair bit longer on low end devices. Don't have an issue with it beyond that
webghost0101@sopuli.xyz · 130 pts · 100d
I love how toxic she is to corporate professionalism.
Its also perfect marketing, the software is free with the mascot hardcoded in. The official way to change it is to contribute to get an enterprise version.
DmMacniel@feddit.org · 20 pts · 100d
in what way?
realitaetsverlust@piefed.zip · 54 pts · 100d
He means that many people in a corporate environment wouldn't expect a anime girl with a magnifying glass popping up on your screen, that could reflect badly on your company. Just imagine some CEO sharing his screen in a presentation and his background is a screenshot of some hentai scene or something. It wouldn't make you seem very professional in the eye of the other corporate people.
That's why companies that use anubis will usually pay for the subscription so they can replace the mascot with something else.
DmMacniel@feddit.org · 24 pts · 100d
Oh I See. Fuck that sterile corpo professional shit.
alexquiniou@lemmy.zip · 10 pts · 100d
Excellent idea !
trem@lemmy.blahaj.zone · 26 pts · 100d
It's just a silly anime girl showing up on first page load. If you're deathly afraid of seeming unprofessional, that's gonna do your head in...
ComfortableRaspberry@feddit.org · 20 pts · 100d
Spot on. There were some complaints recently made by people being afraid to be seen as a furry because she has ears and a tail. It's hilarious
SCmSTR@lemmy.blahaj.zone · 2 pts · 100d
Oh man. Those people are so gd cringe it IS hilarious.
dev_null@lemmy.ml · 7 pts · 100d
Not that it matters, but it's not anime style, it's a "western" style cartoon character. Compare it to e.g. the original Disney princesses, the proportions and style look like that, not like anime characters.
meekah@discuss.tchncs.de · 7 pts · 100d
tbf it is clearly inspired by anime tho. those eyes, the skirt and the cat ears are pretty typical anime stuff
trem@lemmy.blahaj.zone · 1 pts · 98d
Hmm, well, thanks for throwing that tidbit in either way. I'm certainly not deep into that whole artform, so probably just saw big eyes + cat ears and that was the end of my thought process. 🫠
Cease@mander.xyz · 5 pts · 100d
The code is MIT licensed, what's preventing you from just removing the logo/changing it with something else....
webghost0101@sopuli.xyz · 6 pts · 100d
Nothing but them respectfully asking not to do this, pointing out that they will help you do it if you pay a contribution.
Mynameisallen@lemmy.zip · 67 pts · 100d
Take this over cloudflare any day of the week
FalschgeldFurkan@lemmy.world · 65 pts · 100d
Her face is the response to years of enshittification; without her, the modern browsing experience would suck much harder. Glory to Anubis!
Evil_Shrubbery@thelemmy.club · 44 pts · 100d
I love her!!
mecen@lemmy.ca · 42 pts · 100d
Much better than cludflare and Google recapha
Gonzako@lemmy.world · 37 pts · 100d
Thank god we have anubis
TerdFerguson@lemmy.world · 14 pts · 100d
Which god? Anubis.
Gonzako@lemmy.world · 1 pts · 100d
Im a narcissist. Im god
Crystalbound@lemmy.world · 37 pts · 100d
Who is she supposed to be?
Truscape@lemmy.blahaj.zone · 91 pts · 100d
Anubis - an anti-scraping plugin for websites. I believe one of its claims to fame is placing LLM crawlers into "tar pits" (preventing them from eating website resources)
It does show up whenever you load into the site though, so I guess that makes their mascot stick in everyone's head.
Cris_Citrus@piefed.zip · 14 pts · 100d
Thanks for explaining! ☺️ I'd seen this before I think when going to the gnome repos and was curious what it was
agingelderly@lemmy.world · 11 pts · 100d
No idea, never seen her before.
pewpew@feddit.it · 36 pts · 100d
Still better than this
daniskarma@lemmy.dbzer0.com · 7 pts · 100d
Both have different purposes.
The Anubis challenge could be easily and cheapely solved by any JavaScript engine. It only becomes expensive for a massive number of petitions.
If for instance you would want to register a few thousand emails in a forum anubis is not going to stop anyone.
In fact I'm sceptical about really having an impact. As even when the challenge goes up in difficulty is not that expensive compared with all other cost related to these kinds of attacks or massive scrapes.
My suspicion is that most websites using Anubis see a positive impact because most crawlers and probers doesn't take into account Anubis, so they don't even attach a way to solve the challenge and they directly go into the "rejected by anubis" bucket. But any targeted attack I suppose would pass easily, either by doing a slow attack not to up the challenge very much, or just eating the cost. Imagine an AI company that using nuclear plants for training data, the cost of solving a few million JavaScript challenges is nothing in comparison.
As a DDOS mitigation it helps, but once again it's just a matter of eating the cost by the attacker. And the attack will still deny some service as the challenge go up and new legit users would also need to solve harder challenges.
Hupf@feddit.org · 6 pts · 100d
Perry the platypus?
Mwa@thelemmy.club · 1 pts · 100d
Yeah Hcaptcha,Using AI against AI.
trackball_fetish@lemmy.wtf · 29 pts · 100d
+1 Anubis, cloudflare can suck mai balls
gandalf_der_12te@discuss.tchncs.de · 20 pts · 100d
I'm on discuss.tchncs.de right now and its web UI lags badly probably due to a lot of bot scaping.
If we had Anubis i guess that could be avoided.
GalacticGrapefruit@lemmy.world · 16 pts · 100d
Long live the Canadian anime catgirl!
TerdFerguson@lemmy.world · 8 pts · 100d
Jackal girl.
Anubis weighs the soul of your connection.
Rochefoucauld@sh.itjust.works · 2 pts · 100d
Cat? I thought it was a dog, because Anubis(The ancient Egyptian deity) has a dog head.
HrabiaVulpes@europe.pub · 13 pts · 100d
Looks way better than half the ads I normally see.
rants_unnecessarily@piefed.social · 10 pts · 100d
What am I missing to understand this? What is Anubis?
moonshadow@slrpnk.net · 33 pts · 100d
Beloved anti scraping/ddos tool
EchoCranium@lemmy.zip · 9 pts · 100d
I've seen this briefly pop up while looking up linux stuff online recently. Wondered what it was, thank you Lemmy community for some enlightenment!
daniskarma@lemmy.dbzer0.com · 7 pts · 100d
I am skeptical about the real level of protection that Anubis really provides.
At the end is an automated test. Meaning that any machine could easily solve it.
Most "attackers" wont bother solving it because they don't really care. But if they would want they could. It's sort of protection by obscurity.
The more Anubis it's used the more we see attacks that actually equip a way to solve the challenges. Then is when Anubis up the challenge and the battle begin, between how much can Anubis up the challenge so normal users can still browse and how much cost the attacker is willing to eat.
Giving that these attackers tend to have high budgets I'm not that certain about its actual capabilities to reject a targeted ddos.
As for crawling for big data. I do think that it does nothing here. Companies willing yo scrape big amounts of data, for AI training or other purposes, have massive budgets and the electricity cost of solving the JavaScript challenges become nothing in comparison. They also doesn't need ro deny the service so they could spread the scrape to keep the challenge low reducing the cost even more.
Once again, positive results we currently see in practice I believe that are caused just because most scrappers and ddos attackers are just blindly attacking and doesn't really equip themselves for Anubis. Protection by obscurity. But a well equiped attacker I don't think it would have that much trouble getting past it, specially for scrapping, or other type of bot attacks that could be slowed down.
softwarist@programming.dev · 12 pts · 100d
You're right, although my understanding is that there are a lot of poorly implemented scrapers for AI services unintentionally DDoSing websites with requests, so Anubis is more of a mitigation against those.
jj4211@lemmy.world · 1 pts · 100d
Yeah, seems like the problem is that fundamentally it could work by upping the difficulty a smidge making it then meaningfully expensive, but the spread between slowest edge device and high end means it's impossible to chase that difficulty without screwing over low end device users..
eah@programming.dev · 4 pts · 99d
HN comment which makes your point but is better worded
Butterphinger@lemmy.zip · 3 pts · 100d
Yet Anna's Archive still doesn't use it, curious.
Truscape@lemmy.blahaj.zone · 9 pts · 100d
TBF Anna's just provides a dataset for people who want it and don't directly host any of the content (they're just the index). Anubis probably isn't as necessary for them.
far_university1990@reddthat.com · 2 pts · 100d
Plus if need high speed access just ask. Look at nvidia llm lawsuit, they more than happy to help.
Mwa@thelemmy.club · 2 pts · 100d
plus, Cloudflare Turnslide. (i also see it equally as much)
pmjv@lemmy.world · 1 pts · 100d
hylobates@jlai.lu · 13 pts · 100d
Unfortunately, yes it does. Unless I want it to collapse regularly.
desertdruid@lemmy.blahaj.zone · 12 pts · 100d
it kinda does when the web is being scraped by bots to fuel the LLMs
spicehoarder@lemmy.zip · 1 pts · 98d
Banning crawlers doesn't have to affect UX for humans. And you can whitelist your favorite crawlers too if that's your thing.
pmjv@lemmy.world · 0 pts · 99d
spicehoarder@lemmy.zip · -3 pts · 100d
Watch out, you'll anger the hive mind.
jankforlife@lemmy.ml · 0 pts · 100d
I kinna like it
spicehoarder@lemmy.zip · -2 pts · 100d
If you're going to increase my compute to access your site, at least give me a crypto token that may or may not be worth anything