How do you get better when you're already amazing?
When you're amazing, you understand what you're doing and where to improve. For very complex systems, the improvements will be in confined areas (not rewriting everything but noticing a bug or reading about another project which found that some other hyperparameter works better). Or even if you have no idea, the simplest way would be making random tweaks and seeing which ones are advantageous
> It was used by Kramnik to test the hypothesis whether no-castling chess was viable (basically chess, but disallowing castling).
Viable in what way? That it's advantageous to never castle if an engine learns to play with that directive? Or that it still makes for a fun game with that new rule?
My "10+ years" was not referring to any specific milestone. It was referring to the general flow of time. It's been 10 years since 2016, twenty since 2006, and more than 40 since writing my first program. Lots has changed every 10 years in that period, both in my skills and the environments i program in, but shell/emacs/makefile remains a staple of that process.
Ah, well the question you were answering spoke of 2021. It's not about not changing your practices in a decade but about LLMs. Apparently you dodged both questions by neither referring to 2021 nor to the thing that became somewhat usable in 2021 xD
I'm sure there exist examples where people maliciously give tasks (captchas) out that have no chance of getting the person anywhere, but it's definitely not common
Consider yourself lucky. I routinely run into tarpit Google reCAPTCHAs and I don't even use a VPN. I think it's because I run Linux and the site admins treat anything besides Windows, Mac, iOS, or Android Chrome as suspicious enough to blacklist. It has gotten to a point that I literally never even _try_ to do image-based CAPTCHAs anymore. If I can't access the site, oh well.
I also get infinite captchas but it's imo not a tarpit if it's not intentional but a bug
Edit: looked up the term, DDG shows a Wikipedia card saying "A tarpit is a service on a computer system that purposely delays incoming connections." (purposeful)
It may seem purposeful on Google's part but I bet that if we could get through to the developers for answers, it's probably not designed that way but we're running into a case where the system isn't designed to handle it
Which could be said to be intentional (excluding people with our FOSS setup), I guess
> requiring 1 second of compute before allowing a page load
After 1 solve, you get a cookie and can load tons of pages with it. Scrapers and user agents alike will need to spend the compute only once to get a valid session for themselves
Seems to be working so far though. Fwiw, lots of silly things stop bots until someone puts their mind (or tokens) to bypassing it, and then the blocking mechanism has to adapt. We'll see how it plays out, for now it's a lot better than begging big brother (cloudflare, google, or amazon captcha) for access, so I'm quite appreciative of what Techaro is doing
The issue is that scrapers are rotating their IP and essentially performing a DDoS attack. Anubis is part of a defense-in-depth solution. If scrapers reuse a cookie, traditional anti-abuse mechanisms will work.
I don't know what you mean by traditional anti-abuse (typing over two words from an image?), but switching IP addresses rapidly, while staying recognisable as one entity because of the unique cookie, is not normal user behavior so this would be trivial to filter out for something like Anubis and require another solve. Maybe that's what you meant though?
>If scrapers reuse a cookie, traditional anti-abuse mechanisms will work.
Scrapers can't change their strategy? It's not hard to think of mitigations: keep on using a session until you're banned, and failing that rotate your IP. Nowadays you don't even need to think. You can probably tell a LLM "write me a scraper that has adaptive anti-anti-bot mechanism".
Yes, but you normally don't try to fight all strategies up front, you add stuff on a need-to basis. Currently, lots of people are in the stage of "need to get this thing using bunch of IPs to stop hammering my servers", apparently Anubis helps them with that. If that stops working, other tactics are tried, and so it goes on for the life of your service. Hasn't stopped yet, doesn't seem to be stopped soon either.
That argument also works against anubis. Why bother forcing clients to solve a PoW challenge, when you're fighting a bunch of unsophisticated attackers that will be deterred by a javascript challenge that requires them to solve `result = x + y`?
You're not fighting unsophisticated attackers. 50% of them are, maybe. The rest? They're actively hostile, detecting blocking attempts, moving on to botnets, DDoSing you and trying everything they can to bypass you.
People have been sent to jail for participating in LOIC attacks which were less destructive that what these bots do on the daily.
Point is, you get problems because of something like this, you try either approach. And when that stops working (because eventually it will), you add something else. Some work better against some actors, but also feels like it never ends, so slowly you add more things. I don't think Anubis is uniquely able to stop that particular type of annoyance, it's just one of the tools you can see if it helps. If you want to try something else before, makes a lot of sense to do so.
Plenty of these abusive scrapers are utilizing retail residential proxies, which will be applying forced rotations to avoid "burning" their compromised and or otherwise surreptitiously utilized IP address.
I would disagree with the Anubis effectiveness falling off, but the llm bros are throwing life itself into training to defeat any “perceived” challenge.
Is there a place where I can try out if my browser is compatible? Easier to find out now than when I'm trying to get work done and a million websites now have it deployed
On https://wasm-feature-detect.surma.technology it shows that I don't have 3 of all these features but I'm not sure if Anubis needs any of them to not kick me back to the pure JS solution
Which would apparently be bad because
> The WebAssembly that's shipped with this flow is ridiculously performant. This may mean you need to adjust the difficulty [upward, to avoid that bots solve it trivially when they support wasm, I assume this means]
combined with
> The wasm2js flow doesn't currently have a way to update the progress bar [so you have no clue about remaining time]
(wouldn't be the first time that I gave up on a page because it was stuck on 0 hashes per second)
If you don't disable browser features for fun and/or sport, Chrome as of version 120 or later (or another browser of that vintage) will use the optimized flow.
Bit sad that the default assumption is that everyone should use Google Chrome, even when explicitly asking for a compatibility tester. I'm asking because I don't use Google's browser
Didn't they launch only their first device (considering this is the sixth generation) in the USA a few months ago? Hopefully the replacement parts are yet to come. I'm not sure why it's so difficult, perhaps it's that they're stretched too thin and barely managed to get the base device to market there at all
I bought one a few years ago. Good device, too big for my hands (back then, there were still smaller options so I bought one of those smaller ones in second-hand). Not having spare parts available would make me hesitate since that's like 50% of the point (fair sourcing being the other half), but besides that it's a (big) phone like any other
Ten? So like Android and Linux flavors? I'm not sure I even know of ten: e/OS, Calyx, Lineage, Ubuntu Touch, eh is there like Mobian or something still alive... how do they get to ten?? Do they also all fully work? Camera and calling (and not only on 2G) for example?
I'd be interested in the list, the website you've linked is super sparse (the full menu is like shop, some feel-good pages about device deposit and impact, blog, and contact us - no knowledge base, documentation, or somewhere where you'd expect to find OS info or even downloads)
Okay that's six: the ones I forgot are iodéOS and Postmarket (possibly the most popular Linux mobile, idk how I forgot about them), plus Shift's own custom OS which I'll count as two because there's a googleful and a googleless variant which is a relatively significant change, plus LineageOS and e/OS which I had mentioned. That's a lot of choice indeed! Thanks for the link
SailfishOS is another popular mobile Linux distro you should be aware of - it's been around for a long, long time - in fact its heritage can be traced all the way back to Nokia's Maemo OS (circa 2005), which became famous in the community with the Nokia 900.
And then in 2010, Maemo merged with Intel's Moblin to become MeeGo (featured on the Nokia N9). The MeegGo engineers who were let go (due to Nokia x Microsoft) then created Mer, and eventually started a new company called Jolla, who created SailfishOS based on Mer.
It's been 13 years already since SailfishOS was out, and if you include the Maemo heritage, it makes it the oldest surviving mobile Linux distribution.
When you're amazing, you understand what you're doing and where to improve. For very complex systems, the improvements will be in confined areas (not rewriting everything but noticing a bug or reading about another project which found that some other hyperparameter works better). Or even if you have no idea, the simplest way would be making random tweaks and seeing which ones are advantageous
reply