Hacker News Reader

And, fundamentally it can't be opensource. Bot detection (like anti-fraud more generally) is an adversarial game that relies on hidden techniques. Open-sourcing it means you lose that advantage and make life much easier for anyone trying to get around it.

View on HN

There's zero reason it cannot be opensource. Proof-of-XXXXX schemes do not rely on obscurity to be functional.

The schemes large players use to increase the cost of e.g. creating new accounts on their services do in fact rely on obscurity. They target developer cost, not compute cost.

But that's not what Anubis (the subject of TFA, and most of the comment threads here) is/are about.

I think it's exactly what Anubis is about? I'm pretty familiar with what Xe is doing.

...You're computing a hash, not making accounts or anything else that relies on obscurity though?

You're computing hash in order to block automated web requests. The hash isn't the point --- the hash cost is the part of this system that isn't going to work long term.

I think there's probably a platform for it that you can open source --- the virtual machine, or the core of the virtual machine or something, but yeah, you're right, this is something Anubis will have to contend with long term; the effective solutions for this all benefit from obscurity.

Reply on news.ycombinator.com