It really sucks for small businesses. Their websites get absolutely hammered and they can’t afford or don’t know how to stop it. Cloudflare ends up winning as they’re the easiest solution.
It works similar to cloudflare WAF but is an open source software. It can be on your own infrastructures even if its a $5 VPS.
The idea is same let the bot or AI agent do more work than it takes to serve that request. Also it needs to follow rules, similar to cloudflare enterprise web application firewalls. It was OWASP CRS and J4A TLS support.
Considering sibuna it's anubis backwards.
Look like rust rewrite to make more performant?
What prevents other hosting sites from providing similar tooling?
As a user (bot or flesh) you have to jump through these hoops, and to the website operators they get fewer complaints when users (and bots) are able to contort themselves in predictable ways. Versus you'd perceive as a website operator, if your blocking worked at all, that you'd risk seeing a precipitous dropoff of bots if you did things in bespoke ways, as both bots (true positives, among dd and cf survivors) and people (false positives) get jammed.
The net effect in this model would be that such things as cloudflare and datadome take money from websites in order to block "dumb" bots and enfranchise "smart" bots to the point of creating a market for bot services. People that want to bot have to use AI or go to bot service providers.
For website operators that's a worthwhile exchange for dollars, in that dumb bots can cause a lot of harm in wasted compute. Bots are typically dead end users who won't buy ever anyway, or merely inefficient way of doing business if they scrape excessively. And many do scrape excessively.
"reform school for bots" is a good mental model. For this to work, the "reforms" have to be consistent so that bots can conform to them.
It's a peculiar equilibrium and I am not sure that it's all that stable as an equilibrium. Would be a good subject for a formal treatment, game theory and economics.
And the problem often isn't some advanced attack. It's enough to follow links with session params, generate endless urls or ignore robots.txt to turn a regular crawler into a load generator. A site owner needs crawler protection from specific behavior and not another list of known bot signatures
What really sucks is e.g. Gemini that pulls images without being able to go to the source (unless it changed recently.)
Edit: I didn't read "logs"
Any answer to that along the lines of "do something more complex" or "optimize your site for load" to be able to deal with the rampant bad behavior of multi-billion dollar companies is unpalatable to most.
This is one of those things that might be best solved through policy and law. There probably will be some changes to policy and law to help, eventually. That stuff usually takes a while, and that's always been a problem for those suffering in the interim.
We started with caching but this created a new kind of problems of its own (veterans know what circus of man eating from outside out clowns this create) but client was mad manual refresh is causing "freezes" in the system.
So we ban LLM and problem solved until client starts asking why ChatGPT, Claude, whatever he prefer can't access data and release him/her from pain of using brain
phpBB will assign you a randomized session if if you visit it anonymously (without logging in), and will serve the page to you with that sid param added to all links. Using that link will load a page without the sid param appended to links, because the system assumes you have a session I'd saved in a cookie since it saw you have a sid, even I'd you don't have/didn't send a cookie with it. Following any of those links starts the chain over if you aren't sending a cookie along with a sid, which the AI scrapers never do so they can't easily be blocked by that, and a new unique sid is generated, and all the links have the new sid appended.
Every page with a unique set of params and values needs to be investigated, because it can be an entirely different page, so AI scrapers will scrap forever, always finding more and more URLs to harvest, even though they're all duplicates of what they already have. It's easy to have multiple scrapers stuck going through a very small bulletin board continuously.
Maybe they've gotten smart enough to deal with this situation in the last few months, or maybe they put in a specific workaround. I ended up just throwing the site behind cloudflare because spending time trying to outsmart AI agents in a battle of escalation doesn't seem like an effective use of my time.
Requires login
Bunny.net is another one that I find similar to Cloudflare from pricing and functionality perspective
I've been wondering to myself "how can I get people to go through a login process without going through a login process?" for a few months, and I've come up with a simple solution which I'll be implementing in the next few weeks.[1] Like the other technical measures it doesn't identify bots but there will be a gate with backpressure that at a point in time a given IP address has some probability (adjusted in realtime based on $things) of passing through, and through my mysterious process is then "logged in". Then that address is pretty much given a free pass as long as its behavior remains "human". Real humans may be denied access initially and have to try again, and their luck will be affected by how aggressively the bots are fighting it out at that point in time. This isn't much different than the extant reality, but it is in terms of what happens after an initial successful page load. It's an experiment, I'm hoping it's tunable so that the experience is more or less indistinguishable from the status quo; we will see.
I'd love to find a group of likeminded individuals where we can discuss some of this TLP:YELLOW or Chatham House Rules. If you are savvy enough to hunt me down and can demonstrate that you're a real human, small operator, and that you can keep things closely held I'll talk with you, if you want someone to run your mitigations that would cost money.
[0] Had an episode last week where somebody scanned approximately 1000 URLs (maybe 60% of the discoverable URLs) over six hours. 1200 addresses fetched exactly one URL, another 400 or so fetched two or three. Every one of those URLs was fetched exactly two times. Real showshoe stuff, nicely done.
[1] Firewall rules and fail2ban. I give fail2ban special powers in terms of the logs it follows and the actions it can invoke. Conntrack without conntrack (of course the firewall has conntrack, it's just not the best option for this use case).