I host tons of open source projects on https://forge.sciactive.com/
Recently, it was getting absolutely hounded with tons of meaningless requests. I’m assuming they are just results of AI.
So, I put Anubis in front of it. Now images hosted there won’t load on other sites, people have to wait forever to see the code, and the experience on phones is even worse. Just because AI doesn’t respect anything, and the people who run it are too stupid to realize that.
This is why we can’t have nice things.
Just because AI doesn’t respect anything, and the people who run it are too stupid to realize that.
They’re perfectly capable of realizing it. How do you think it got built that way? They don’t respect anything, either.
True.
You can set a trap that isn’t in robots.txt or is forbidden there. Anyone who ignores your robots.txt is not friendly.
It’s odd, I see so many people complain about Anubis taking a significant amount of time, but I’ve only ever had it 1-2 seconds on my devices
This makes a difference on Forgejo: https://github.com/go-gitea/gitea/pull/34024
Also, obviously, a caching reverse proxy. Forges and wikis are hard because the bots drill down into the thousands of version control pages that get generated on demand and cant be cached.
If I didn’t enjoy the cat & mouse of it, I’d definitely walk away from running a site. Just out of curiosity, I created an hourly graph today showing malicious bot, legitimate bot and human ratio graphs for one of my sites. The malicious hits make up around 80% hourly and human hits are usually well under 10%.
What sorts of measure you have taken to prevent bots from exhausting your compute and bandwidth
Another example expanding on my previous comment.
This IP from Hong Kong hit my site over 5,000 times in a couple minutes. The first 12 page loads were legitimate URLs and got served. On their first exploit attempt, they were blocked and the remaining 4,98x page loads were no-effort 403s. This type of thing has made it possible for me to have a cheap public-facing site as I wouldn’t be able to afford an endless array of malicious IPs doing this day in and day out. Before I went this route, I would have to shut the site down during high impact periods of these visitors as they’d corrupt and crash the database.
As soon as an IP is determined to be malicious, subsequent pageloads result in a single query to match the IP and they get dumped to a 403 static error.
With the bots that hammer a site looking for the top 1,000 or so exploitable URLs or partake in speed scraping, this has worked wonders for my server load. I catch them in their 1st-5th page load and the rest just result in basically no effort on the part of the script.
I host a few sites and I haven’t had a problem yet. Sure, logs suggest a majority of traffic is bots, but the cheap VPS I’m hosting on hasn’t melted so I haven’t been motivated to do anything about it.
i run a small browser game on a hetzner vps and for me the bots were never a load problem, it was the stats. the game shows how many people are online and every crawler that opened the live stream counted as a new player, in early october it was 28 of 61 stream opens. then a headless chromium on residential proxies, different ip every time, made 40 fake players in two days. what caught it was the Sec-CH-UA header, it said chromium 146 while the user agent said chrome 120, real browsers don’t mismatch like that. i don’t block them now, they just stop counting as people, which is kind of depressing too i guess
Personally I proxy everything through cloudflare tunnels using a wildcard cert, and have Authelia in front of everything. No open ports.
Haven’t had bot problems since swapping to this setup.
You do have open ports as it goes though Cloudflare. If Authelia ever has a CAVE you could be pwded. Cloudflare is nice but it gives a false sense of security and routes everything unencrypted though a large tech company.
Sure, but that’s true of anything you use to try to keep your network secure. Your VPN is also one CVE away from opening your network to bad actors.
If you are that worried, you shouldn’t have anything accessible outside your network at all, even though a VPN.
The difference is that Cloudflare has access to everything and exposes your stuff directly on the internet. A VPN would be far more secure with the tradeoff of inconvenience.
I found that using a wildcard domain cert for HTTPS and an uncommon higher port number works just fine to avoid crawlers and scrapers. I also hide my ssh port behind WireGuard because I got annoyed with the bots filling up my logs with failed attempts. I’ve been doing that for nearly a year now and I have had no more issues with bots
I’m going off the assumption that the people who run crawlers and scrapers are going for known common ports for quick ease of access
I don’t feel the need to run anything extra such as Anubis either. The inconvenience of using an uncommon higher port number has been minimal and I still get to enjoy my tiny corner of the internet
Higher port? I suppose you just run things for yourself and never share them on the public internet then.
I share my site with only with people I know personally and they don’t seem to have any issue accessing my site
They don’t seem too bothered adding
:8000to the address. Also they are usually connecting at home or on their phone and are not frequently visiting it so the inconveniences are minimalMost people getting hammered by bots are running public facing websites. There a custom port is suspicious as heck.
A limited access service like yours is better served by a VPS or a simple login before everything.
I don’t understand how it’s suspicious if I am sharing my address with a custom port to people I know. I even take time to explain why I do it and in a way a nontechnical person would understand
The connection is still encrypted because I have a proper domain cert. There’s no warning or any other issue. I have spent more time securing my hardware/operating system/software than anything else, often taking priority over hosting more services
Do I really need to take all these extra steps like a VPS or a login for a basic blog generated from markdown files and a basic file server that has copies of my git repositories? Seems excessive when I already found a solution for myself that takes less effort and works to my satisfaction
I think there’s value in experimenting outside the current set standards and norms. Especially since corporations and states are obviously abusing the trust of these standards and norms for their own personal benefit
I personally feel like a small web/indie web can find their own their place again on the internet with a little creativity and a will to break away from the current norms. Trying to do more of the same will eventually lead to issues like burnout or ever growing frustration
I’m doing this for fun and for myself above all else. Experimenting with different, low effort approaches to the crawler/scraper issue is fun for me. Involving more outside services or adding more internal software does not sound like fun to me. It doesn’t sound like much fun for other people in this thread or by the original blog post either
Yeah, internet is no longer the interesting place it used to be. Interesting, intriguing, exciting. Now it’s worse than going to a tax office… the day before taxes… On Christmas… 😂
We should all go back to HTML and web rings
And Usenet but with spam filters somehow
I am actually trying geminispace. It has nothing to do with google btw, but it’s quirky, it’s weird and I am actually getting some old internet vibes
It’s hard to post original work to share but also know it can just get scraped but I can’t give up personal websites. Social media looks so bland and seeing completely personalized blogs are the most enjoyable part to the internet now. Spending more time in niche spaces on the internet more than ever.
The AI scrapers and all the PITA they cause is one of the primary reasons I don’t host a blog site.
Indieweb suffers heavily due to this.
I run a DaaS product Trace Jobs that serves job posting data.
My expectations are pretty low and am never disappointed. Self-hosting can be pretty affordable.
