But the scraper is making way more requests and is paying for all that compute.

This is the basic misconception behind the Anubis design. In an anti-spam system, there's a user/abuser reward asymmetry. Users make single requests and get some constant reward V. Abusers make millions of requests and also get some constant reward V. Proof-of-work exploits the asymmetry: costs are, by a factor of ~millions, disproportionately imposed on abusers.

That's exactly not what happens with scrapers. Scrapers make millions of requests, yes. But each one of those requests produces an average (token-denominated) reward V'. There's no asymmetry at all: you're just adding a fixed cost to each reward, for both users and abusers.

That's before you even get to questions like "does the system actually work, or does a single solve get practically unbounded rewards".

▲

progval 4 hours ago | parent | next [-]

> There's no asymmetry at all: you're just adding a fixed cost to each reward, for both users and abusers.

There is: users solve the PoW once, scrappers solve it every time they rotate IP addresses. Some of them change their IP address on every request, so they keep solving the PoW over and over.

	▲	tptacek 30 minutes ago \| parent \| next [-]
		That doesn't matter! Every time they successfully solve the challenge, they're getting the token reward. That's the missing asymmetry. In an anti-spam system, 99.999% of all transactions are unrewarded.
	▲	sunoforbrazilia an hour ago \| parent \| prev [-]
		[flagged]

▲

cyberax 3 hours ago | parent | prev | next [-]

I have a small personal site with an exposed Git repository. I'm getting crawled from about 100000 residential IPs from several ASNs (mostly in Brazil). Each crawler makes a couple of requests per minute.

Anubis doesn't really help against this.

▲

graemep 5 hours ago | parent | prev [-]

I wonder whether what Anubis is doing might be blocking agents that do not run JS or that have a timeout (or humans who give up as I just did)

	▲	tptacek 4 hours ago \| parent [-]
		I suspect that's most of the value, and that the deterrent is about software construction and not about the proof-of-work, which I've been saying for the last year is a productive direction for Anubis to head towards. Instead, it's just sort of tormenting normal people, as a kind of performance of anger about AI. Which: I get! If it's your site, perform all the anger you want.

▲

semiquaver 5 hours ago | parent | prev | next [-]

no, a single solve returns a token which entitles the scraper to access the site as much as it wants for one week.

▲

NobodyNada 5 hours ago | parent [-]

The token should only be valid for one IP, so the scraper has to keep solving challenges if it rotates IPs.

▲

semiquaver 5 hours ago | parent [-]

OK, but that doesn't change anything. You have a large pool of IPs, each of which only needs to expend a handful of extra milliseconds of work to get unlimited access to the protected resource.

Even if you had to solve a L6 challenge for every request it's faster than the total RTT time of most servers. In other words not a meaningful barrier. And L6 is already a level which severely interferes with human usage of a site.

a $5000 ASIC-based device can hash SHA256 at 200TH/s or more.

▲

inigyou 3 hours ago | parent | next [-]

The way they're internally implemented doesn't allow pinning an IP. They buy a rotating proxy service from a vendor, and don't get to choose their source IP.

▲

dspillett 3 hours ago | parent | prev | next [-]

> In other words not a meaningful barrier.

And yet many report it works, at least for now, and the excess load due to scraping activity falls precipitously when Anubis or similar solutions are used. Maybe once this sort of challenge is used almost everywhere we'll see concerted attempts to get around it, but for now it is easier for them to just move on to another target.

> a $5000 ASIC-based device can hash SHA256 at 200TH/s or more

Peanuts for the big players, but many (almost all?) running smaller scale scraping operations are going to find $5000 rather prohibitive, and they are unlikely to be able to integrate it as they are probably running a “stock” scraper that they didn't write themselves.

▲

LatticeAnimal 4 hours ago | parent | prev [-]

Some of the asymmetry might be regained if anubis had thousands of variations of PoW algorithms, each different enough that they must be solved independently.

I wonder if AI might be able to come up with new PoW algorithms in a nightly CI job so every day is a different puzzle...

▲

inigyou 3 hours ago | parent | next [-]

You can do this on yours. Just have the client and server add an extra "2" after the challenge key or something. A different client which extracts the challenge key and does its own processing will only generate invalid responses.

	▲	LatticeAnimal an hour ago \| parent [-]
		Cool, so then that invalidates the ASIC problem, right?

▲

CursedSilicon 3 hours ago | parent | prev [-]

...That sounds like entropy? As in, the thing computers are bad at (truly random numbers) and /dev/urandom in your kernel already spits out an approximation of?

▲

DarmokTanagra 3 hours ago | parent | prev [-]

not if its running on someone else's device