[xboxnolifes]

Your theoretical counterargument falls apart by the reality of just putting up anubis and comparing the before and after. I don't understand why this argument shows up in every thread about anubis. There are plenty of people and orgs who have empirical before and after results. We don't need theoretical arguments when there exists actual data.

[jsnell]

The exact claim I was replying to "It does that by increasing the cost of scraping, not by preventing it entirely." In that context, quantifying the cost isn't theoretical nitpicking!

Anubis works to the extent it does because in counter-abuse security by obscurity tends to be the best security of them all. Right now Anubis isn't popular enough for many scrapers to try working around, so they don't. But they will pour resources into working around Turnstile and Recapcha. In this regime, the exact challenge is irrelevant. Anubis would be just as effective if the challenge was running a javascript function to add two numbers instead of a proof of work.

Proof of work is just a uniquely dismal basis for a counter-abuse challenge.

[margalabargala]

Proof of work is fine if you can make it demonstrably take a few seconds. If 100 IPs are scraping you as fast as they can, making every 100ms request take 2.1 seconds means you're getting hit with 20x less traffic per unit time.

[microtonal]

falls apart by the reality of just putting up anubis and comparing the before and after. [...] We don't need theoretical arguments when there exists actual data.

And the data says it stopped working for some sites that actually have a lot of data.

We apologize for a period of extreme slowness today. The army of AI crawlers just leveled up and hit us very badly. [...] It seems like the AI crawlers learned how to solve the Anubis challenges. [...] However, we can confirm that at least Huawei networks now send the challenge responses and they actually do seem to take a few seconds to actually compute the answers. It looks plausible, so we assume that AI crawlers leveled up their computing power to emulate more of real browser behaviour to bypass the diversity of challenges that platform enabled to avoid the bot army.

https://social.anoxinon.de/@Codeberg/115033790447125787

[inigyou]

It's not because of the PoW though, it's just because the scraper doesn't run JavaScript. The alternative package called go-away does these tests without the PoW.

[TylerE]

Captchas worked for a few years too. Then computers got better at solving them than humans, and we're still dealing with the fucking useless things decades later.