diffiediffie@mk.absturztau.be
Sep 20, 2026, 6:16 AMI still can't believe that Anubis really helps anyone.
Replies
- diffiediffie@mk.absturztau.beSep 20, 2026, 7:29 AM
@lispi314@udongein.xyz Quoting some relevant comments on LWN here:
Anubis doesn't seem to be working anymore here
Posted Jul 10, 2026 22:34 UTC (Fri) by koverstreet (subscriber, #4296)
Parent article: An update on the scraper situation
I started seeing a ton of AI crawlers hammer all my git endpoints, and they're going right past the anubis checks; it seems a least some crawlers are using full web browsers that can do the proof of work.
Ouch.
So I'm back to a script that I run regularly that just scrapes the hammering IPs from the nginx log and iptables blocks them...Anubis difficulty setting is running out of steam
Posted Sep 14, 2026 10:19 UTC (Mon) by farnz (subscriber, #17727)
We're hitting a problem point for the difficulty setting; the bots are now as willing as humans to solve a challenge at any difficulty level, which means that if you tweak difficulty up a bit more, you're going to put off humans, but not bots. - diffiediffie@mk.absturztau.beSep 20, 2026, 7:31 AM
@lispi314@udongein.xyz I found these while looking for some table of expected/typical cracking times for the difficulty settings… Is there such a table anywhere?
- diffiediffie@mk.absturztau.beSep 20, 2026, 7:36 AM
@lispi314@udongein.xyz Digging in the Anubis docs for some information, I found that there is also this non-PoW challenge:
The preact challenge sends the browser a simple challenge that makes it run very lightweight JavaScript that proves the client is able to execute client-side JavaScript. It uses Preact (a lightweight client side web framework in the vein of React) to do this.
What? Using “Fast 3kB alternative to React with the same modern API” (quoting the Preact NPM page) to test that the client can execute JavaScript? :blobfoxnotlikethis: 
LisPilispi314@udongein.xyzSep 20, 2026, 7:39 AM@diffie Not as such, but this blog hits on most of the issues and references the https://lock.cmpxchg8b.com/anubis.html#numbers article .
Other than throttling and limiting the number of concurrent connections, there isn't much to do for git endpoints.
And cgit/gitweb basically gets login-walled.
GNU/翠星石Suiseiseki@freesoftwareextremist.comSep 20, 2026, 9:23 AM@lispi314 @diffie You can't limit the number of concurrent git connections, as git is incredibly bursty.
You can set a high ratelimit and see if you can carry out 2 git clones without blocking yourself - turns out not high enough.
Although, you can heavily ratelimit git for anything but git's useragent.- LisPilispi314@udongein.xyzSep 20, 2026, 9:52 AM@Suiseiseki @diffie > You can't limit the number of concurrent git connections, as git is incredibly bursty.
You can, including for git itself. I have setup my own nginx server to do so.
(Although I did configure it to favor LAN-sourced connections afterward.) - GNU/翠星石Suiseiseki@freesoftwareextremist.comSep 20, 2026, 9:59 AM
- LisPilispi314@udongein.xyzSep 20, 2026, 10:00 AM@Suiseiseki @diffie > Yes, you had to configure it to not block yourself.
No I just didn't feel like like dealing with the early 2000s bandwidth I give to the public for it.
Well okay yes I also didn't make it subject to the connection limit because I simply don't do multiple at once.