Remix.run Logo
Stay discoverable in search while disallowing AI training(blog.cloudflare.com)
44 points by djfergus 3 hours ago | 28 comments
gdiamos 2 minutes ago | parent | next [-]

I wouldn’t trust an AI company to honor this as far as I could throw them

nirmeetimthebes an hour ago | parent | prev | next [-]

"Accountable" is just a fancy word for "pinky promise, but with a label." Nothing stops the data from ending up in a training run once it's already been fetched.

userbinator 28 minutes ago | parent [-]

...and the only way to stop[1] that is by effectively DRM'ing everything, which is a level of dystopia that I don't think even Stallman ever anticipated, nor do I want to happen.

[1] Analog hole and other workarounds aside, naturally.

1vuio0pswjnm7 an hour ago | parent | prev | next [-]

"Cloudflare classifies bots by behavior, and a single bot can exhibit more than one behavior."

Is that really true

CF classifies anyone not using a popular browser with Javascript enabled as a "bot"

CF fingerprints www users

As an example, look at CF's Permissions-Policy HTTP response header on a site with CF "bot protection", i.e., the "checking your browser" CAPTCHA nonsense (challenges.cloudflare.com). Then look at IA's Permissions-Policy response header. One CDN is advertiser-focused, the other is user-focused

IA = Internet Archive

userbinator 31 minutes ago | parent | next [-]

CF classifies anyone not using a popular browser with Javascript enabled as a "bot"

This is my biggest complaint about CF. They are implicitly supporting user-agent discrimination in favour of Big Browser, instead of discriminating on actual behaviour.

...and of course there are already companies running tons of VMs with "officially sanctioned" browser + OS stacks, that can get past all these "protections", for a fee.

"AI bots" is the newest boogeyman they came up with to take away freedom.

devmor an hour ago | parent | prev [-]

As far as I can tell, after months of fighting being DDoSed by Anthropic and OpenAI across 50+ sites - Cloudflare also allows what it considers "good bots" through all of your bot blocking rules, with no option to turn this off unless you pay them money.

GetSMS 22 minutes ago | parent | prev | next [-]

This seems useful for my site. I don't really want competitors' AI systems use our research data to train their models.

skybrian 2 hours ago | parent | prev | next [-]

I didn't know websites could opt out of providing data to Google's AI training. Looks Google added support for this via 'Google-Extended' in robots.txt back in 2023:

https://blog.google/innovation-and-ai/products/an-update-on-...

kinduff 2 hours ago | parent | prev | next [-]

I maintain a cloud IP ranges database, and I'm going to test this out.

I have my doubts, though. A formal title like "Accountable" (capitalized) sounds deliberate, but I can't help imagining the renewal email:

"Hey, want to renew your Accountable™ license? Just pinky promise again that you use your IPs for what you say you do."

mskalski 2 hours ago | parent | prev | next [-]

I wonder if protocols like Web Bot Auth [1] will see wider adoption. At least as a supported mechanism for those bots which identify themselves. The rest probably still have to be treated with Anubis. In my free time I've recently been experimenting with a Web Bot Auth implementation as an Envoy dynamic module [2] to have a way to define some additional policies for the traffic from bots.

[1] https://datatracker.ietf.org/doc/draft-ietf-webbotauth-https... [2] https://github.com/michalskalski/envoy-web-bot-auth

fraywing 2 hours ago | parent [-]

I'm playing around with it for my MCP hiring protocol ojcp[1] and it seems to work very well for signing attestations at the header level.

[1] https://github.com/ojcp-org/ojcp

mskalski 2 hours ago | parent [-]

Thanks for sharing, it is interesting use case

AnonC 2 hours ago | parent | prev | next [-]

> Accountable mixed-use crawlers remain allowed for search. Every other training crawler is blocked, including the training-only crawlers run by Amazon, Anthropic, Meta, and OpenAI — blocking those does not affect search.

> We also categorize the relevant crawlers from Amazon, Anthropic, Meta, and OpenAI as Accountable. These organizations separate their Search and Training crawlers, so Cloudflare can block the Training crawler without affecting search.

I find it difficult to trust that either Meta or OpenAI would use their separate search and training crawlers only for the respective purposes. Their pinky promises have no value, IMO. Both companies are premised on deceptive behaviors.

dzhiurgis an hour ago | parent | prev | next [-]

If this admin is serious about AI growth they’d make anti-scrapping illegal.

DaSHacka 39 minutes ago | parent | next [-]

I don't think this admin even knows what scraping is. Unless it's "scraping the bottom of the barrel", something they're very familiar with.

userbinator 22 minutes ago | parent | prev [-]

Just make user-agent-discrimination illegal.

zergrush 3 hours ago | parent | prev | next [-]

what weirds me out is the analytics

theres no way my index.html page with nothing is getting 10000 hits a day

wtf?

itake 3 hours ago | parent [-]

7 per minute.

I use my high school’s website to test Internet connectivity bc the domain is short and they don’t do a TLS redirect (making it easy to detect WiFi portals).

JoshTriplett 2 hours ago | parent [-]

neverssl.com

DaSHacka 35 minutes ago | parent | next [-]

Wish the admin never added the SSL redirect, its literally the namesake lol

I just want basically captive.apple.com with a shorter domain and the webserver not even listening on port 443 at all.

Surprised someone hasn't made this yet, it only requires one spare public IP.

itake 39 minutes ago | parent | prev [-]

I use this too, but my high school url is 8 characters. neverssl.com is 12. :)

gchamonlive 3 hours ago | parent | prev | next [-]

Cloudflare, enabling the problem and the solution since, how long has it been?

arm32 3 hours ago | parent [-]

(checks watch)

17 years

Fun lava lamp story, though

arm32 3 hours ago | parent | prev | next [-]

What does this new setting actually do? Does it block their IP ranges too, I hope? As if Meta, for instance, is actually going to respect Accountable, via themselves or their partners, quite frankly is eyebrow raising at best.

gleezard 3 hours ago | parent | prev [-]

A bit too late honestly (?). With so many people who have shifted over to reading AI summaries as a primary search response, those with AI-enabled sites will win by attrition.

There is no going back from this. And the internet is a relatively new phenomenon. Recklessly, blindly applying ads to pages in hopes of generating revenue is a very silly thing to do. Technology with ad blockers and now AI summaries has taken that away. New business models, perhaps actually decent ones are required.

Death of ads everywhere? Good fucking riddance.

Posted from LibreWolf.

tracerbulletx 2 hours ago | parent [-]

All this attitude does is tear down the only viable income source for independent publishers and demonizes them for trying to make money, while everyone let's huge corporations off the hook for it because "well that's just what they do"

gleezard 2 hours ago | parent | next [-]

Advertising in the way it’s done is demonic in and of itself. I don’t care - find a better business model.

octoberfranklin an hour ago | parent | prev [-]

Independent publishers can't afford to run an ad network.

You aren't independent. You work for the BigTech company that serves ads on your site.