Even the premise seems to not understand what it's trying to require. There are zero humans accessing a website by sending electrical signals to Comcast using a telegraph or pulsing a flashlight into a strand of fiber. Every web browser is a computer program running on a computer.

So is a web browser a bot? What about an ad blocker? RECAP? NewPipe? The default browser opening a link at the behest of some other program? A browser extension that downloads all your emails from your webmail provider?

Their intention is presumably not to ban those things, or equivalently, legally require them to declare themselves to be something that would cause them to be blocked. Or if it is then they're proposing something hostile and malicious. But if that isn't their intention then where is their method of distinguishing that from whatever it is they're actually trying to do?

▲

oasisbob 44 minutes ago | parent | next [-]

Someone who is using a residential proxy network, headless browsing, and/or TLS fingerprint manipulation to evade rate limits and other controls to issue large volumes of automated requests under a deceptive UserAgent string isn't difficult to describe and differentiate versus a normal user using a UA.

The proposed text of the bill is rather straightforward. It turns more on the "stealth" bit than "bot".

(a) Prohibition.—A person may not—

(1) deploy, direct, or cause to be deployed, a stealth bot to access a website, digital platform, or online service in a manner that is reasonably likely to damage, impair, or burden the technical or commercial operation of a website or other internet service; or

(2) intentionally misrepresent, conceal, or obscure the nature of the bot to appear as a human user for use in connection with a generative AI model or service.

(6) STEALTH BOT.—The term “stealth bot” means a bot that accesses, retrieves, scans, indexes, scrapes, or otherwise interacts with a website, digital platform, or online service without prior disclosure of its identity and purpose, in particular by—

(A) failing to identify itself including through a valid and accurate user-agent string; or

(B) failing to disclose the specific nature and purpose of the bot, including any proposed use and purpose of page content (including text and data mining, search indexing, inferencing, artificial intelligence development, support, or operations (such as training, fine tuning, retrieval augmented generation)) or other automated processing at the time access is requested and in a format that the website operator can access.

▲

za_creature 2 hours ago | parent | prev | next [-]

A web browser isn't a bot as long as it's controlled by a human but it becomes one once it's automated.

You are entitled to your own emails, posts, etc but you are not entitled to crawl the internet for your own purposes without stating what they are and allowing websites an opt out.

▲

AnthonyMouse 2 hours ago | parent [-]

> A web browser isn't a bot as long as it's controlled by a human but it becomes one once it's automated.

That doesn't mean anything. All of the code in a browser is "automation" -- normal users aren't hand-crafting the hundreds of HTTP requests the browser makes to render a single web page. Meanwhile there is a human somewhere telling the scrapers what to scrape.

> You are entitled to your own emails, posts, etc

Is that somewhere in the proposed text?

> but you are not entitled to crawl the internet for your own purposes without stating what they are and allowing websites an opt out.

"Stating what they are" buys you nothing when you have no way of verifying it, and you're still not providing any way to distinguish this from investigative journalism or e.g. a new competing search engine.

▲

card_zero an hour ago | parent [-]

Using a computer to do "by hand" is a vague concept, yes, but laws routinely embrace vague concepts. You used it yourself! "Hand-crafting", you said. It could be pinned down more closely to something like a single action that happens quite soon after you press a button or ... and further wrangling could ensue because it's never going to have all the vagueness removed. It's probably relative to current norms of computer use and what we do or don't automate casually (and thus describe as "by hand").

	▲	AnthonyMouse 18 minutes ago \| parent [-]
		> It could be pinned down more closely to something like a single action that happens quite soon after you press a button So leaving your webmail open is banned because it will still be checking for new messages three months after you opened the tab without any further human interaction. Likewise RSS readers or really any client which is intended to fetch new posts/messages when they appear. > It's probably relative to current norms of computer use and what we do or don't automate casually (and thus describe as "by hand"). Which is kind of exactly the problem. A new law would presumably still be on the books in ten or twenty years. Do we expect user agents by then to do only the things they do now, or will they get more capable? Banning them from becoming more capable is the problem.

▲

Spivak an hour ago | parent | prev [-]

It's a human level distinction that doesn't have technical distinction—the law handles these kinds of things just fine. The flesh doesn't know the difference between manslaughter and murder but we humans can figure it out well enough.

The world you envision where we decide that the law can't assess intent is certainly an interesting one but I don't think it would be the most functional.

▲

AnthonyMouse an hour ago | parent [-]

> the law handles these kinds of things just fine

No, people just like to claim that it does. Meanwhile legal departments are risk averse, so if nobody can articulate where the line is, you're banning all of the things you claim you're not banning. Even if a judge might ultimately come to a reasonable decision, do you want to be the one who pays the legal fees to "win" that case?

> The flesh doesn't know the difference between manslaughter and murder but we humans can figure it out well enough.

The reason things like this aren't a practical problem is that normal people can avoid needing to care about the distinction by endeavoring to not kill anyone to begin with. On top of that, the law actually does have some pretty specific rules about the distinction between manslaughter and murder.

Whereas the trouble here is that we need to distinguish between things that we specifically don't want to deter and something else which is proposed to be prohibited. The type of law that handles that kind of distinction most frequently is the tax code. The consequence is that it has to be made very specific or the result is a train wreck.

	▲	smaudet 25 minutes ago \| parent [-]
		Exactly. > a stealth bot to access a website, digital platform, or online service in a manner that is reasonably likely to damage, impair, or burden the technical or commercial operation of a website or other internet service "stealth" - what does that mean? This is largely a meaningless term. "damage, impair, or burden" - again, too vague. It would be good to specify something specific, e.g. so many tens of thousand of damage (reciprocal to the assumed fine - a journalist or user is unlikely to be reselling data at this scale, an AI scraper may incur or inflict such costs). "that is reasonably likely to" - this phrase is doing some heavy, heavy lifting, but like others have mentioned, there aren't very many "reasonable" examples, and those have to be defined in a court of law. Like you and others have said, the immediate reaction would be legal departments essentially banning any and all access, because there would be room for someone to file a suit, and even if you win, there's no guarantee you get your fees back...