LLM scrapers are taking down FOSS projects’ infrastructure, and it’s getting worse.

  • sudo@programming.dev
    link
    fedilink
    arrow-up
    3
    arrow-down
    3
    ·
    2 days ago

    Proof of Work is a terrible solution because it assumes computational costs are significant expense for scrapers compared to proxy costs. It’ll never come close to costing the same as residential proxies and meanwhile every smartphone user will be complaining about your website draining their battery.

    You can do something like only challenge data data center IPs but you’ll have to do better than Proof-of-Work. Canvas fingerprinting would work.

    • refalo@programming.dev
      link
      fedilink
      arrow-up
      3
      ·
      1 day ago

      Proof of Work is a terrible solution

      Hard disagree, because:

      it assumes computational costs are significant expense for scrapers compared to proxy costs

      The assumption is correct. PoW has been proven to significantly reduce bot traffic… meanwhile the mere existence of residential proxies has exploded the availability of easy bot campaigns.

      Canvas fingerprinting would work.

      Demonstrably false… people already do this with abysmal results. Need to visit a clownflare site? Endless captcha loops. No thanks

      • sudo@programming.dev
        link
        fedilink
        arrow-up
        1
        arrow-down
        1
        ·
        18 hours ago

        The assumption is correct. PoW has been proven to significantly reduce bot traffic.

        What you’re doing is filtering out bots that can’t be bothered to execute JavaScript. You don’t need to do a computational heavy PoW task to do that.

        meanwhile the mere existence of residential proxies has exploded the availability of easy bot campaigns.

        Correct, and thats why they are the number one expense for any scraping company. Any scraper that can’t be bothered to spin up a headless browser isn’t going to cough up the dough for residential proxies.

        Demonstrably false… people already do this with abysmal results. Need to visit a clownflare site? Endless captcha loops. No thanks

        That’s not what “demonstrably false” even means. Canvas fingerprinting filters out bots better than PoW. What you’re complaining about too strict settings and some users being denied. Make your Anubis settings too high you’ll have users waiting long times while their batteries drain.

        • refalo@programming.dev
          link
          fedilink
          arrow-up
          1
          ·
          3 hours ago

          What you’re doing is filtering out bots that can’t be bothered to execute JavaScript. You don’t need to do a computational heavy PoW task to do that.

          Most bots and scrapers from what I’ve seen already are using (headless) full browsers, and hence are executing javascript, so I think anything that slows them down or increases their cost can reduce the traffic they bring.

          Canvas fingerprinting filters out bots better than PoW

          Source? I strongly disagree, and it’s not hard to change your browser characteristics to get a new canvas fingerprint every time, some browsers like firefox even have built-in options for it.

          • YetiSkotch@ieji.de
            link
            fedilink
            arrow-up
            1
            ·
            3 hours ago

            @refalo @sudo If Proof of Work gets widely adopted I foresee a future where bot running data-centers can out-compute humans to visit sites, while old devices of users in poorer countries struggle to compute the required task for hours … Or is that fear misguided?