Anubis is literally Hitler

@phnt@fluffytail.org why so much hate towards anubis? I would have thought having some free software against scraping bots would be a good thing (?)

@waifu Because it fails at preventing scraping bots that are smart enough to delete one "l" from Mozilla and deployed by people that will definitely not notice that. While annoying everybody else in the process. I would rather solve a boat challenge from Google or CF than stare at a page that gives me a fake progress bar for 7 seconds at best on my phone.
Record_2025-05-30-14-14-00.mp4

@phnt@fluffytail.org @waifu@mai.waifuism.life If the scraping bots remove the "I" from Mozilla, server operators can easily just block the unique user agent. Anubis isn't "a tool to stop bots", its a tool to verify connections pretending to be a browser are actual users.

@tyil @waifu Read the post you replied to again.

And since we are already in this game of slightly changing UA. What if I change it to Moozilla, or Mozillla. How will you match against that now, without manually filtering Mozilla and every legitimate UA that connects to your server away. You simply won't, and if you will, you already aren't the quintessential Anubis deployer.

@phnt@fluffytail.org @waifu@mai.waifuism.life Read the post of mine again. Anubis isn't a catch-all bot filter, its to filter out connection pretending to be a browser. I know the "lmao I can bypass Anubis with this simple trick" is the peak of /g/ hacker mentality, but in the real world everyone already knew this. It is mentioned in the blog post where the guy talks about it.

Anubis exists solely to ensure connections that act like browsers to prove they are browsers. If a connection doesn't pretend its a browser, Anubis does nothing, as is the intended effect, because at that point if the connection misbehaves, you can just block that particular UA.

@tyil @waifu
>Anubis isn't a catch-all bot filter
>2025-01-19 - Block AI scrapers with Anubis
>bypassed by slightly changing browser UA

>Anubis exists solely to ensure connections that act like browsers to prove they are browsers.
No, it exists to prevent scraping by "checking that a browser is valid". Which it does not do at all. It's trivial to change the UA in an instrumented browser.

@phnt@fluffytail.org @waifu@mai.waifuism.life You're having a really hard time reading my posts I guess. I'm sorry for you.

@tyil @waifu You are missing the point completely. There is no reason to prove a browser is "real" in the normal world. If you are trying to do that, you are trying to combat a bot attack and your mitigation simply has no effect since it can be easily bypassed.

@phnt@fluffytail.org @waifu@mai.waifuism.life

There is no reason to prove a browser is "real" in the normal world.

Okay, keep believing that.

you are trying to combat a bot attack

Correct. Sounds like there are reasons after all. Only took a whole sentence to figure that one out.

your mitigation simply has no effect

It appears to have an effect, and not just for my personal cgit. It appears a lot of people are using it because they are seeing a (positive) effect in combatting LLM scrapers with it.

it can be easily bypassed

It can, and that's ok. Because if you bypass it, you become a unique UA that I can just block with any regular UA block in HAProxy. Even if you automate "random" UAs, I can put in a pretty excessive UA blacklist with patterns if I so desire. The entire point is that a connection using a regular browser UA has to prove they are in fact a regular, legitimate browser, because blocking those isn't feasible, because you'd block nearly all legitimate traffic otherwise.

Its not a hard concept I think. I don't know why I have to reiterate the same thing three times for you, but I truly hope this time it'll stick. If not, for the love of Stallman please just cancel your Internet subscription.

@tyil @waifu
>Because if you bypass it, you become a unique UA that I can just block with any regular UA block in HAProxy
>Its not a hard concept I think. I don't know why I have to reiterate the same thing three times for you, but I truly hope this time it'll stick. If not, for the love of Stallman please just cancel your Internet subscription.

Keep living in your clown world.

Here, have a proper solution that got me 0.1 r/s of bot requests instead of 20 r/s on my git server, instead of your half-assed one.
alibabacloud-git-scraping.txt
huaweicloud-git-scraping.txt
google-usercontent-git-scraping.txt

@phnt@fluffytail.org @waifu@mai.waifuism.life Its cute that you only get 20rq/s and think that's the scale of "the real world".

As a sidenote, I'm already blocking entire ASs.

@tyil @phnt @waifu

> Its cute that you only get 20rq/s and think that's the scale of "the real world".

In the real world, the overwhelming majority of sites do not even get that. The overwhelming majority of "Anubis" deployments sit in front of sites that do not get 20r/day.

@p@fsebugoutzone.org @tyil@fedi.tyil.nl @phnt@fluffytail.org what if I want to only get connections from users and want zero bots reading my sites (that already use JavaScript) wouldn't using Anubis work for me?

@waifu@mai.waifuism.life @p@fsebugoutzone.org @tyil@fedi.tyil.nl @phnt@fluffytail.org Bots can access the site even with anubis, it just takes slightly more computational resources

@earslash@ebiverse.social @p@fsebugoutzone.org @tyil@fedi.tyil.nl @phnt@fluffytail.org I'm guessing that's enough to defer a few of them no? Why do people use it if it doesn't work for this specific purpose?

@waifu @phnt @tyil @earslash

> Why do people use it if it doesn't work for this specific purpose?

You have been on this feddy verse longer than I have and the answer to this question is the same as the answer to the question of why so many instances continue to block Gab, which has not federated since 2019: retards cargo-cult shit.

@p Mastodon block-lists never get investigated or audited. If you get added to one you're there forever. And, they LARP about things like a "consensus model" for determining block validities---but, they all just blindly copy blocks over meaning that by de-facto they have an engineered "consensus" through unanimity. Mastodon + Mastodon users really are like AI/Borg or something. Their very existence is a Fediverse blight. @earslash @tyil @phnt @waifu

@adiz @earslash @tyil @p @waifu Since this is my thread, I can derail it however I want, so here goes :).

Pete thought (thinks) that Fediverse as a network can't survive a split where basically the Mastodon and the rest divide and are unable to talk to each other.
I think that we are already at that point, or very nearly it, and things continue to be more-or-less the same. What changed over the years is a decrease in shitposting and an increase in politics sperging from poast and alike. Something that Mastodon is already mostly known as.

What scares me more than Mastodon going its own way is GoToSocial and its obsession with privacy on a network solely based on trust. I learned from silverpill that they apparently already have some kind of reply restrictions that make you unable to reply (alá Xitter) and other non-sense like that. Combined with all the authenticity and proof of origin work that silverpill has been working on, I think that this can have a much bigger impact, if it ever gets implemented broadly.


Imagine a Fediverse, where your reply can get effectively deleted, because someone remote doesn't like it and can remove that reply from their representation of a replies Collection, meaning that other server wouldn't know about it unless they specifically federate with you. Now add a function to that, that makes your reply go away even on those servers, because they respect the other remote server. Or imagine a Fediverse where your press "Post" on a reply and you get "replies not allowed", or "your reply awaits approval" back from the remote server.