25
Certified Lore Drop moment
Something that hasn't been mentioned much in discussions about Anubis is that it has a graded tier system of how sketchy a client is and changing the kind of challenge based on a a weighted priority system.
The default bot policies it comes with has it so squeaky clean regular clients are passed through, then only slightly weighted clients/IPs get the metarefresh, then its when you get to moderate-suspicion level that JavaScript Proof of Work kicks. The bot policy and weight triggers for these levels, challenge action, and duration of clients validity are all configurable.
It seems to me that the sites who heavy hand the proof of work for every client with validity that only last every 5 minutes are the ones who are giving Anubis a bad wrap. The default bot policy settings Anubis comes with dont trigger PoW on the regular Firefox android clients ive tried including hardened ironfox. meanwhile other sites show the finger wag every connection no matter what.
Its understandable why some choose strict policies but they give the impression this is the only way it should be done which Is overkill. I'm glad theres config options to mitigate impact normal user experience.
56
Its winter where I live and winter means cold. Currently its below freezing outside. My offgrid heating is limited to the point I have to sometimes layer up to be comfortable.
I discovered a technique that helps me out a lot this season. A 12v car blanket wraped around your shoulders like a poncho and then put a heavy coat layer. Its a really effective way to insulate both yourself and the blanket.
You might be wondering why a 12v blanket instead of a house electric blanket. For offgrid power a 12v blanket is much easier on limited battery systems. Also, 12v blankets dont have 8 hour safety shutoffs they stay on forever.
In the picture is my polar grade Baffin booties most comfortable Cold weather slippies you can get I hightly recommend if you get cold feet.
The only other tip I have is good layering. Wool socks, multiple thermal underwear layers, hat and gloves. Each piece of clothing added helps even out the difference. Electric just amplifies h effect and makes it so you don't need as much.
Put thermally insulated blanketing on your furniture. Wool blankets are good and duvet type puffy blankets are useful. Consider making an insulated hot table.
Theres a compute option that doesnt require javascript. The responsibility lays on site owners to properly configure IMO, though you can make the argument its not default I guess.
https://anubis.techaro.lol/docs/admin/configuration/challenges/metarefresh
From docs on Meta Refresh Method
Meta Refresh (No JavaScript)
The metarefresh challenge sends a browser a much simpler challenge that makes it refresh the page after a set period of time. This enables clients to pass challenges without executing JavaScript.
To use it in your Anubis configuration:
# Generic catchall rule
- name: generic-browser
user_agent_regex: >-
Mozilla|Opera
action: CHALLENGE
challenge:
difficulty: 1 # Number of seconds to wait before refreshing the page
algorithm: metarefresh # Specify a non-JS challenge method
This is not enabled by default while this method is tested and its false positive rate is ascertained. Many modern scrapers use headless Google Chrome, so this will have a much higher false positive rate.
You know the thing is that they know the character is a problem/annoyance, thats how they grease the wheel on selling subscription access to a commecial version with different branding.
https://anubis.techaro.lol/docs/admin/botstopper/
pricing from site
Commercial support and an unbranded version
If you want to use Anubis but organizational policies prevent you from using the branding that the open source project ships, we offer a commercial version of Anubis named BotStopper. BotStopper builds off of the open source core of Anubis and offers organizations more control over the branding, including but not limited to:
- Custom images for different states of the challenge process (in process, success, failure)
- Custom CSS and fonts
- Custom titles for the challenge and error pages
- "Anubis" replaced with "BotStopper" across the UI
- A private bug tracker for issues
In the near future this will expand to:
- A private challenge implementation that does advanced fingerprinting to check if the client is a genuine browser or not
- Advanced fingerprinting via Thoth-based advanced checks
In order to sign up for BotStopper, please do one of the following:
- Sign up on GitHub Sponsors at the $50 per month tier or higher
- Email sales@techaro.lol with your requirements for invoicing, please note that custom invoicing will cost more than using GitHub Sponsors for understandable overhead reasons
I have to respect the play tbh its clever. Absolutely the kind of greasy shit play that Julian from the trailer park boys would do if he were an open source developer.
609
Anubis is awesome and I want to talk about it
(media.piefed.social)
I got into the self-hosting scene this year when I wanted to start up my own website run on old recycled thinkpad. A lot of time was spent learning about ufw, reverse proxies, header security hardening, fail2ban.
Despite all that I still had a problem with bots knocking on my ports spamming my logs. I tried some hackery getting fail2ban to read caddy logs but that didnt work for me. I nearly considered giving up and going with cloudflare like half the internet does. But my stubbornness for open source self hosting and the recent cloudflare outages this year have encouraged trying alternatives.
Coinciding with that has been an increase in exposure to seeing this thing in the places I frequent like codeberg. This is Anubis, a proxy type firewall that forces the browser client to do a proof-of-work security check and some other nice clever things to stop bots from knocking. I got interested and started thinking about beefing up security.
I'm here to tell you to try it if you have a public facing site and want to break away from cloudflare It was VERY easy to install and configure with caddyfile on a debian distro with systemctl. In an hour its filtered multiple bots and so far it seems the knocks have slowed down.
My botspam woes have seemingly been seriously mitigated if not completely eradicated. I'm very happy with tonights little security upgrade project that took no more than an hour of my time to install and read through documentation. Current chain is caddy reverse proxy -> points to Anubis -> points to services
Good place to start for install is here
Its food man. It belongs if you like it, it doesn't if you don't. I don't understand some of these arguments where "the originating culture did it this way so it belongs!" Who cares how people half way across the world make their burritos, fuck culture and tradition. Cooking is art, do what you want and make it how you like. Personally I put rice in because its an easy nutritious filler that doesnt impact taste or texture too bad and which extends the good meats and seasoning and stuff out a couple meals.
Okay but what the fuck is up with the first un-highlighted part?
... I really hoped that this wasn't a thing, but im not surprised in the least.
Its just fucking painful, man.
You know something cm0002 just wanted to let you know I appreciate the dichotomy formed between posting these shitpost memes making fun of corporate AI trash one second while simultaneously posting genuinely informative news keeping the localllama community updated the next. It helps keep it real.
I havent used twitter in many years. Do they really let their llms have a twitter account and be taggable like this? I though they would have learned it doesnt worked out so great when microsoft tried it with TayAI years ago.
Inferior rehash version of the OG
I hate that the basic polygons and their 3d counterparts are all people think of theyre so boring. Fuck Circles/spheres, Fuck squares/cubes, and no, hexagons are not the bestagons. You want to know what natures perfect shape is? Its a tie between the Mandelbrot Set and maybe Pascals Triangle if you consider that a kind of data structure shape. Your shape efficently packs interior space in a minimum surface area? Thats cool, mine encodes the entirety of combinatorics with fractal geometry and acts as an actual map showing the boundaries between order and chaos. Your shape aperiodically tiles the plane? Thats neat, mine geometrically encodes the logistic map which governs things like animal population changes over time.
Imagine a race of star treck aliens flying around in one of these things and tell me it wouldn't be more visually interesting than a big technophile bondage cube.
view more: next ›
SmokeyDope
0 post score0 comment score
joined 5 months ago
I stepped up my nerd game to start trying to land an IT job of some kind. I learned computer networking to set up my own website on recycled hardware and began writing about it. I started developing on a game engine making modules and making art assets to maybe one day make a commercial product. I released like a dozen open source projects under open source licenses.
It all kind of culminated with Christmas. The kids in my life have been begging for multiplayer Minecraft server but Microsoft destroyed the he so hard with money grabbing we refused to pay for realms or make a bunch of Microsoft accounts or whatever.
So, I rolled up my sleeves and got to work on creating a mineclonia server built on luanti/minetest engine, patching in all the Minecraft assets like textures, sounds, music that I legally own with python tools I built myself and released,
I really wanted an in game fullscreen map and nobody had ever figured out how to make one on luanti engine so I so spent a few weeks developing one from the ground up. I released the map mod two days ago and people quickly noticed saying I had changed the game forever, congratulating me on my technological achievement or whatever.
Its just a little frustrating because it feels like I'm somewhat competent at the nerd professions but I have no idea how to advertise my talents or if what I'm doing even translates to real Dev work. How Does creating universal map colorizer + generator for proceeduraly generated voxel worlds or designing a full model animation interpolation system for an engine from scratch or hosting public services on my own network built from scratch powered by solar turn into resume stuffs? That'd what I guess new years focus needs to be