Has this occurred to y’all? My browser as of lately suddenly checks. Even if I just search on “remove trackers” and a lot of normal links, I get the note “we nEed to VEriFY yOURE not a ROBOT”… it feels like Cloudflare et al are trying to force man in the middle attacks on you. And this also occurs on other browsers with other kinds of ““verifiers””.
The web’s becoming cancerous. I hate this.
While Cloudflare, as well as Anubis and other “anti-bot solutions”, do behave like MitM, they only become a MitM in two situations:
- When the webmaster injects one of those third-party malware into their website.
- Very unlikely, when the network administrator (e.g. the wi-fi from a library or university) is deliberately acting as a MitM through a transparent proxy, and it’s somehow using Cloudflare.
As for me, personally, I don’t see these anymore. I built myself an userscript (FireMonkey), targeted at every domain, programmed to do a window.close() (close the tab) if the title is one of the strings “Just a moment…” (Cloudflare), “Making sure you’re not a bot!” (Anubis), “Cookie monster!” (also Anubis), “Checking you are not a bot” (some Anubis fork) or “One more step” (Google recaptcha). If the title matches, the tab is closed before any non-consented cryptographic challenge (i.e. those “solutions” don’t even dare to ask for user consent before “checking the browser”, therefore it’s a non-consented relationship and a behavior indistinguishable that of a malware) starts to overwhelm my decade-old laptop CPU.
Yes, this means I’m not having access to whatever content is behind the wannabe-cryptojacking tool, but if the webmaster does not respect my personal device and my right to consent (i must emphasize: all those “solutions” start straining the CPU with cryptographic challenges as soon as the user accesses the page, without asking for user consent beforehand, therefore it’s a non-consented relationship and a malware-like behavior), I can’t help but speed-run my search for the exit door. I’m not submitting myself and my personal device to malware (the webmaster pushing CF/Anubis/etc to non-consentedly run on my laptop ain’t gonna buy another laptop for me if mine died so I’m better as far as possible from their website).
so hosts defending themselves From being ddosed by ai scrapers is now “malware” because it requires executing instructions on your computer? lol which ai company do you work for
(Because I’m unable to edit my earlier reply, I’m doing a second one) Oh, and speaking of who works for AI companies…
Have you ever seen a “This site uses cookies, accept / reject”? This has a name, it’s called CONSENT.
I’ll repeat: there’s something called CONSENT. I.e. the ability (and the right) for someone to CONSENT.
Could one fight a non-consensual relationship, AI crawlers DDosing the hell out of the whole Web, by pushing non-consensual relationships, injection of third-party JS code programmed to solve cryptographic challenges without prior consent of the user?
Because this is precisely my point when I criticize Cloudflare, Anubis, Google Recaptcha and whatever other “Proof-of-work anti-bot solution” out there.
NONE of the mentioned solutions ask for user consent before proceeding with the challenge (e.g. “this site needs to check your browser through heavy computation, proceed / leave”). The “challenge” starts as soon as the page is accessed, as in, zero clicks required for them to start using the CPU (thus, my apologies, I called these things simply as “malware”, I should’ve called these things “zero-click attack”).
To make things worse, the “challenge” can accommodate itself across multiple CPU cores by using JS SharedWorkers, thus effectively getting to using 100% of the CPU, regardless of any other parallel uses of CPU (e.g. other tabs opened at the background, or other software doing jobs). Using a 100% of CPU for a couple seconds, potentially minutes depending on the current difficulty level, WILL increase temp. Laptops are particularly sensitive to CPU temp due to lack of proper cooling, so it can easily get to 90C, which is a dangerous temp.
And I’m unable to know beforehand if a website injects “anti-bot challenge” when I stumble upon a link on social media.
My only PC is an Acer ES1-572, it got an Intel i5-7200U; if you look it up, you’ll realize it’s a decade-old laptop. I’m fucking unemployed so I can’t afford a new laptop. And if my laptop dies upon being literally fried by a long session of “checking your browser”, neither the webmasters nor the owners of the anti-bot solutions are going to give me reparation for the damage they indirectly inflicted onto my personal device. It’s, thus, on me. And still I’m the evil one? REALLY?!
But, hey, don’t worry! If you didn’t read this part, I’ll repeat it again: I’m CLOSING every website that uses one of these tools. Differently from the non-consented push of a third-party JS, I AM NOT FORCING my way into websites. If you’re a webmaster, you just need to put something like “Cookie monster!” in your document.title and my userscript will auto close your website and I’ll never visit it anymore. Unless you’re going to buy me another laptop, you stay with your sacred website while I stay with my good ol’ laptop.
Oh, and there’s the irony: those whirling machines at hyperscale data centers are designed for heavy computations such as those involved in PoW cryptographic challenges, and the AI techbros got “infinite money cheat” to spin up new ones… Techbros are likely laughing at the naivete of Anubis; Cloudflare, a corp with an AI suite of their own (another sweet irony; fight AI crawlers by feeding your content directly to another AI corp) are laughing at all the power and content being handed freely to them (sometimes webmasters are even paying for Cloudflare to be given content for their AI suite!). Meanwhile, me, an unemployed Brazilian, am compelled to avoid the so-called “modern web” if I don’t want my only old laptop to unwittingly become a dead weight… and I’m even accused of working for AI companies!
All the time. There’s occasionally even websites that outright block me without challenge, run many iterations on my machine, or present a tiresome amount of CAPTCHAs (Waymo machine vision must be trained pretty well, from me labeling goddamn traffic lights, motorcycles and stairs throughout the day). Especially CAPTCHAs that load new pictures with an infuriatingly slow fade animation drive me up the wall; one of which possibly not even sufficient.
But I take it as a compliment, as it might mean my browser profile is minimal enough to trip these systems into thinking it’s a headless browser (typically used for bot traffic).
Has this occurred to y’all?
All. Of. The. Damn. Time.
The more private you try to be, the more you will hit those.
I see a couple diff behaviors. Sometimes, it succeeds and it lets me through. Sometimes, it “succeeds” but gets in an endless reload loop of the cloudflare page, and never forwards to the site. Sometimes, it convinces itself I am a robot and blocks me entirely.
No idea what drives that diff. Maybe there’s some kind of threshold sites can set, or sth like that.
I have much better luck getting past the non-cloudflare bot verifiers. There are some competitors, I forgot the names now.
Somewhat relevant: https://thebrainbin.org/m/linux@lemmy.ml/t/1858588
