Yeah this is one of those things that hurts some real users and AI scrapers have figured out how to bypass. Not worth it IMO.

There is enough visceral hatred for the Anubis branding, I am surprised an AI skill for bypassing it hasn't been broadcast yet.

Most of the friction is just JS overhead for the computations, a compiled solver is like 1000x faster. If Anubis ever gets popular enough that scrapers care, it would be trivial to defeat. And last I checked you could bypass it by just modifying the user agent

It's actually a genius idea. If you are someone who the professional presentation of not having an anime girl on the loading page is required, then you can afford to fork over the cash to fund development.

> is a turnoff for anyone with a brand or personal image that doesn't mesh with those subcultures.

Most people either don’t know or don’t care about “those subcultures”. I bet a lot of older people think it’s a cartoon figure of Betty Boop (nurse) and miss the furry bit since it appears and disappears quickly. Most people also don’t have a brand.

So it seems like you’re describing a concern that only affects a tiny fraction of people:

- Not interested in paying for custom branding, so obviously not a corporation or influencer

- Dislikes cartoons

- Aware of, and hostile towards, “furry” subculture

That has to be an exceedingly small fraction of potential users of Anubis, and given how much businesses and branders will pay to custom-brand something, I’d counsel them to stay the course. Sure, a few never-payers will never pay, but they wouldn’t have anyways, so they can cope with Nurse Betty or look elsewhere for a competing free product.

If you think about this in physical market square terms — in other words, a bazaar — it seems horrendously rude to complain about a shop logo sticker on a free product handed out to anyone that walks up and asks for it. If you want it white-labeled so you can write your own name/logo on it, you pay for the privilege of displacing their name with yours. But you don’t stand there and loudly complain that their shop mascot has dog ears while holding a freebie bag of product, without losing the respect of everyone who hears you doing so.

If you have a brand or personal image that you are investing in, you can surely afford to invest in paying for a branded version of Anubis.

I'd argue its rather functioning exactly as intended with regards to obtaining paid users.

Also this view seems a bit elderly. For most towards the end of the millennial curve and younger, anime is no longer subculture, its just general culture at this point. Although I would agree it isnt necessarily what you'd want for every platform and web presence.

How hard is it to maintain a fork that changes nothing except the logo?

If you can't be bothered to maintain a trivial fork, then why should the author of anubis be bothered to serve your branding needs? It's not like you have a service contract or anything do you?

I think that's partly why they do it? If you care about that, you should pay?

Pay to change logo??? Just fork Anubis and remove one div... It's not SaaS first software, you're expected to deploy it on your web server.

I wish my rent would stop going up year over year.

They're not stopping you. They're asking you politely not to.

You just discovered their business model congrats.

haproxy-protection is an alternative.

It's MIT licensed, you are free to do whatever you want to it, including removing the logo. They're basically just saying "we'd prefer you didn't do this, but we're not preventing you from doing it."

It's open source, just ask your AI agent to change the logo.

that's really smart of them. Just pay to use the service you need.

you really revved the weebs with this one

You wish they'd give your preferable imagery for free and not make you feel bad for using their free software for personal gain. Your subculture is irrelevant and not special.

If you 'don't mesh' with that then you are not worth protecting anyway :)

This is like getting angry at cookie banners instead of all the companies tracking and selling your data.

You're complaining about the symptom (needing to have these checks) not the cause (if they don't, 99% of their traffic will be bots, the site will slow to a crawl and be unusable anyway).

In any case, I saw the dumb anime girl for about 2s then the site loaded. Not a big deal.

The Anubis challenge took ~5 seconds.

What do you propose instead?

The GCC bug tracker uses the meta-refresh challenge, which does not require JavaScript. Due to the fact that the server makes sure the client has waited at least 75% as long as it should, the HTML has to add one second to the meta-refresh wait. Patches welcome. Meta refresh granularity is in single digit seconds.

How is it hard for humans?

People tried this in 2013 or so, there's no point to it. Doing proof of work in javascript in a browser is so crushingly, pointlessly slow that there's no value at all. Some browsers also intentionally detect attempts to do proof of work and attempt to block it entirely.

They think scraping = money so you can just ask them to scrape (copy paste websites into a text area) and it will feel like payment.

It is not absolutely useless, empirically, which you'd discover if you had a website getting hammered by bots and experimented with anubis as a countermeasure.

While dedicated scrapers/attackers could work around it, and they could do so much more efficiently than the client-side js, almost none of them do. Unless you like paying additional hosting resource fees to serve bots, it's a worthwhile option, and is less annoying to typical human visitors than cloudflare's interactive captcha/challenge which is what most people use.

The main author is aware that the algorithm is far from ideal for this purpose. See https://news.ycombinator.com/item?id=48869064 . If more bots start to answer the primitive challenge anubis uses now, that'll hasten implementation of a different algorithm.

Don't let the perfect be the enemy of the good enough. For now, the algorithm or challenge scheme almost doesn't matter. Since it's much smaller-scale than cloudflare's challenges, that's probably why very few scrapers and botnets bother to solve anubis's trivial sha2 pow.

Targeted attacks may not be repelled at all. That's not the point.

But the people you're defending against don't do that.

They also don't load CSS but for some reason the security theater PoW won the mindshare.

Like any lock, it's mainly to deter less determined adversaries (which account for the vast majority)

The point of PoW access is not that its hard to bypass, it's that you cannot bypass it at scale.

how so, can you link to any sources?