Who does Anubis actually stop?

(fzakaria.com)

35 points | by type0 2 hours ago

11 comments

  • jdlshore 1 hour ago
    Hmm, I don’t think I agree. The author is claiming that Anubis is meant to stop individuals using LLMs, but I don’t think that’s its purpose. I believe its purpose is to reduce mass scraping of data that puts excessive load on systems. It does that by increasing the cost of scraping, not by preventing it entirely.

    Specifically, bad actors were ignoring robots.txt and rotating IPs to make blocking difficult. Anubis serves to make new connections more expensive, so that people will reuse a connection/cookie, and then falls back to normal means of preventing bad actors.

    (That mass scraping is the result of AI training companies, yes, but it’s the mass scraping that’s the problem, not the LLMs.)

    • TomatoCo 1 hour ago
      There's plenty of arguments that mass scrapers have compute to spare but it seems to me that if Anubis makes it 100x more expensive to scrape then, for any given scraping budget, that means you get scraped 100x less. Which is the difference between your server buckling under the load or continuing to serve reliably.
      • VladVladikoff 17 minutes ago
        In my experience, not really. Each asset is made by a new proxy, eg some TV somewhere, they send every new request via a new IP address, which is a new machine, and it doesn’t matter how long the response takes, they have already rotated to the next ip immediately and sent another request. Most of these providers have millions of IPs, and it generally doesn’t take millions of requests to scrape a website (unless it’s really big!)
        • inigyou 16 minutes ago
          And each new IP triggers a new Anubis challenge. Isn't it great?
      • dullcrisp 32 minutes ago
        If compute isn’t the bottleneck then it wouldn’t make it 100x more expensive to scrape. Of course if it does, then it’ll be effective.
    • inigyou 17 minutes ago
      It does it by blocking the scrapers because they are really stupid scrapers. go-away blocks them too, by seeing if they load images, a much quicker test.
    • jsnell 1 hour ago
      Except it does not actually increase the cost of scraping meaningfully. Compute is really cheap. The compute for minting an Anubis cookie will cost less than a thousandth of a cent even assuming the attacker uses the same JS implementation of proof of work rather than an optimized native implementation. That cookie can then be used for hundreds of requests.

      How big of a deterrent is a millionth of a cent per page going to be? A non-existent one. Just the bandwidth from a residential proxy will cost the scraper orders of magnitude more.

      Proof of work just isn't a viable counter-abuse challenge, even for something as low-yield as scraping. (It might be economically viable as a counter against some types of DDoS attacks, since they're even lower yield. But in practice it just moves the attack surface to the proof of work validation service.)

      • xboxnolifes 56 minutes ago
        Your theoretical counterargument falls apart by the reality of just putting up anubis and comparing the before and after. I don't understand why this argument shows up in every thread about anubis. There are plenty of people and orgs who have empirical before and after results. We don't need theoretical arguments when there exists actual data.
        • jsnell 13 minutes ago
          The exact claim I was replying to "It does that by increasing the cost of scraping, not by preventing it entirely." In that context, quantifying the cost isn't theoretical nitpicking!

          Anubis works to the extent it does because in counter-abuse security by obscurity tends to be the best security of them all. Right now Anubis isn't popular enough for many scrapers to try working around, so they don't. But they will pour resources into working around Turnstile and Recapcha. In this regime, the exact challenge is irrelevant. Anubis would be just as effective if the challenge was running a javascript function to add two numbers instead of a proof of work.

          Proof of work is just a uniquely dismal basis for a counter-abuse challenge.

        • inigyou 16 minutes ago
          It's not because of the PoW though, it's just because the scraper doesn't run JavaScript. The alternative package called go-away does these tests without the PoW.
        • TylerE 18 minutes ago
          Captchas worked for a few years too. Then computers got better at solving them than humans, and we're still dealing with the fucking useless things decades later.
      • ragall 57 minutes ago
        > How big of a deterrent is a millionth of a cent per page going to be? A non-existent one.

        In practice, this would seem to be false, according to the admins of said sites.

    • ddtaylor 1 hour ago
      There is no distinction between the two. If one can do it the other can just as easily. I know multiple people right now that can scrape any a site very easily.

      I do this at scale and it took me very little time to set up and almost no resistance. So anyone who thinks that this is difficult or you're preventing people from doing this at scale, you're wrong.

  • novafunc 1 hour ago
    Anubis's primary goal is to prevent web scrapers from DDoSing a website. It's not meant to be an unbeatable challenge or only allow humans like Google's more privacy-invasive captchas.

    You do the proof of work, you get the content. Not all web scrapers are willing to do the work, which reduces the strain put on web servers.

    It's by no means a perfect system. It's goals in part prevent it from doing so. It tries to not be too annoying for humans, to not block real users, and not be privacy invasive.

    • what 29 minutes ago
      >tries not to be annoying

      The little anime girl is pretty off putting. I bounce when I see it.

      • arn3n 26 minutes ago
        It’s meant to be both funny AND highly unprofessional; Anubis makes money of licensing a version of the firewall where you can change the image.

        It’s a good strategy; personal websites and blogs can display the anime girl without fear, and companies that care about their image end up paying. Win-win.

      • 710dev 18 minutes ago
        [dead]
  • yellow_lead 1 hour ago
    > The exact adversary Anubis targets defeats it trivially.

    Wrong, anubis stops mass crawling of web pages, by requiring a proof of work, which makes accessing these websites more expensive.

    Anubis was not built to stop individual users with llms.

    • drum55 1 hour ago
      Claude Opus can make an optimized version of the proof of work solver that’s more than 10000x faster than the javascript one, in about 5 minutes time. Who is this stopping exactly? It’s the wrong tool in the wrong place.
      • Macha 1 hour ago
        Practically, the people indiscriminately scraping don't bother to do the work to bypass it or implement the POW test, which results in reduced CPU load for all the properties that were having trouble with scrapers before. Until scrapers start implementing it en masse then, it still serves its purpose.
        • greyface- 58 minutes ago
          > Until scrapers start implementing it en masse

          If it becomes widespread (as it has been doing), they will. Anubis' strategy only works while it remains a niche approach only adopted by a small number of sites.

          • Macha 46 minutes ago
            And then people will move to a new solution.

            I think this is a pragmatist vs idealist debate. The pragmatic answer is that Anubis solves a problem now, and so it will be used until either it doesn't or a better solution presents itself. The idealist approach is that it's obvious that there's ways to get around Anubis, and so some people argue from there that it shouldn't be used. But the only other alternatives being offered are to either eat up the costs (in server resources or engineering time), or to go behind cloudflare with its own tradeoffs.

            • greyface- 30 minutes ago
              Anubis is the penicillin of web hosting.

              Every individual practitioner has a strong incentive to overuse it, because it's extremely effective for them individually. Every additional practitioner that uses it increases the selection pressure on their collective adversary to develop resistance. Eventually, it reaches a tipping point and becomes ineffective. But the ecosystem-level impact of its historical use remains, and makes things worse for everyone.

              Recently, the baseline expectations of the Web have shifted, and I need to enable JavaScript to read a non-CloudFlare-proxied simple HTML site like LKML. I do not expect this shift will revert once Anubis outlives its effectiveness.

              • Macha 17 minutes ago
                Viruses do not have motivations, so it’s hard to assign blame to them. The companies running badly behaving AI scrapers are run by people with more of a mind than viruses, so please direct your complaints about the second order effects of their actions that way, rather than on their direct victims.
              • Krutonium 14 minutes ago
                I do want to note that my website has Anubis, and does not require Javascript. You can configure Anubis to test in other ways, JS is just the default.
                • greyface- 8 minutes ago
                  Thank you. I decrement my Anubis-ire counter by 1 whenever I encounter a site configured like this.
          • drum55 40 minutes ago
            The barrier is a two sentence prompt to Claude to add a patch to curl that does 500MH/s to the 50kh/s the javascript version does on the same hardware, it only works because it’s obscure and largely irrelevant.
          • inigyou 14 minutes ago
            Then they'll change what Anubis does.
        • PunchyHamster 33 minutes ago
          That was true but with AI that could be automated pretty easily. Sure, not worth for random blog but random blog won't get the traffic anyway
      • Kuinox 1 hour ago
        The difficulty is increased when the server get heavy traffic.
        • drum55 43 minutes ago
          Then the only people who can use it are the ones with a GPU implementation.
          • Kuinox 29 minutes ago
            No, the value of scrapping the page is long gone and the scrapper would have moved on. The users would still access the page by waiting a bit.
  • nitwit005 1 hour ago
    This mistakes the goal. It's not to block the scrapers, but to discourage excessive (and costly) scraping.

    The Anubis cookies are bound to particular IP address. The scrapers are often using a large set of IP addresses, so they'll be paying a far higher cost than this suggests.

    • ssl-3 15 minutes ago
      There are multiple goals at play. They're easy to find in HN comment sections whenever these topics arise.

      One goal is to reduce excessive scraping, usually for monetary or performance reasons. This is the goal you mention, and is motivated by a desire keeping the thing working at all.

      Another goal is to stop bots from ingesting the content, carte blanche. This goal is motivated by a desire to dictate how bots (and by extension, people) may use the information that is otherwise freely-available on the web.

      These are not the same goals.

  • throw0101d 1 hour ago
    I was curious about the name:

    > Anubis is a Web AI Firewall Utility that weighs the soul of your connection[1] using one or more challenges in order to protect upstream resources from scraper bots.

    * https://anubis.techaro.lol/docs/

    > The Weighing of the Heart would take place in Duat (the Underworld), in which the dead were judged by Anubis, using a feather, representing Ma'at, the goddess of truth and justice responsible for maintaining order in the universe. The heart was the seat of the life-spirit (ka). Hearts heavier than the feather of Ma'at were rejected and eaten by Ammit, the Devourer of Souls.

    * https://en.wikipedia.org/wiki/Weighing_of_souls#Ancient_Egyp...

    • aboardRat4 1 hour ago
      >>I was curious about the name:

      That's knowledge usually learnt in primary school.

      • Terr_ 21 minutes ago
        Grades 1-5 is a little hyperbolic, IIRC my "World Religions" class was probably middle/junior-high school.

        In any case, it's not the type of common knowledge which warrants your scornful response.

      • Rendello 17 minutes ago
      • j-bos 50 minutes ago
        Or scholastic book fairs (showing my age)
      • theshackleford 55 minutes ago
        > That's knowledge usually learnt in primary school.

        Perhaps where you reside, I’m unsure why you would believe it to be universal.

      • ThrowawayTestr 1 hour ago
        I mean I know about the heart weighing thing but I'm pretty sure I didn't learn it in school.
  • inigyou 18 minutes ago
    We don't know who is doing the really dumb global scraping attack, but that's who it's meant to stop.
  • cjd8 1 hour ago
    Funny, I'm working on a simple tool that pulls the atom feed of the latest patches from lore with Python, and I just slip a User-Agent header into the requests.get() and it works great.
  • patchtopic 43 minutes ago
    perhaps the author, instead of the "I'm so clever" theoretical arguments from the client side, actually implemented Anubis on the server side and observe the results.

    I have set it up on a few sites being relentlessly hammered by clearly idiotic bot traffic, and it drops bot the traffic levels from insane to manageable. I don't even care if the traffic is AI or bots, if the bot has gone to the same effort as the author has the bot may even just access the site in a responsible manner and that's fine.

  • satvikpendem 1 hour ago
    Exactly, it's the same as Cloudflare captchas where only certain blessed devices and browsers can seem to actually pass it. Ironically, adding Anubis accelerates the death of the open web.
    • grim_io 1 hour ago
      Open to whom?

      There can't be a truly open web if the guys with all the resources in the world have the incentive to absolutely crush you by draining all of your resources.

      They won't crush you out of malice, but by accident, like an ant.

    • pibaker 20 minutes ago
      A world without cloudflare does not necessarily mean a world where anyone can access any website. It could very well be a world where anyone can point a DDOS at any website and make it inaccessible to everyone.
    • nitwit005 1 hour ago
      Cloudflare got it's early business from sites being taken down by DDOS attacks. The early users of Anubis were often sites taken down by scrapers.

      Not a fan of either solution, but the sites simply going offline does not promote an "open web" either.

    • mike_hock 37 minutes ago
      No, this is not the same as Cloudflare fascism. You're free to use any JS runtime to solve the challenge.
  • PunchyHamster 34 minutes ago
    Well, my call on this thing being useless waste of time of everyone involved was correct. Compute wasted on AI tokens alone is probably far more than some cpu for token solving, better invest time into caching it well (or blocking agentic traffic entirely if that's your jam)
  • lrem 1 hour ago
    Uh wait, a cookie that can be reused for a time to fetch the rest of the content? That's the exact opposite of what I'd intuitively want for this system...
    • recursivecaveat 28 minutes ago
      If you behave yourself and reuse the same cookie/IP instead of trying to hide your identity, other tools can be used to block you if your request volume is crazy. It also means regular people only have to solve once.