[jsnell]

The exact claim I was replying to "It does that by increasing the cost of scraping, not by preventing it entirely." In that context, quantifying the cost isn't theoretical nitpicking!

Anubis works to the extent it does because in counter-abuse security by obscurity tends to be the best security of them all. Right now Anubis isn't popular enough for many scrapers to try working around, so they don't. But they will pour resources into working around Turnstile and Recapcha. In this regime, the exact challenge is irrelevant. Anubis would be just as effective if the challenge was running a javascript function to add two numbers instead of a proof of work.

Proof of work is just a uniquely dismal basis for a counter-abuse challenge.

[margalabargala]

Proof of work is fine if you can make it demonstrably take a few seconds. If 100 IPs are scraping you as fast as they can, making every 100ms request take 2.1 seconds means you're getting hit with 20x less traffic per unit time.