itintheory

> standard windows way

The thread you linked to suggests 'timeout'[0]

[0] https://learn.microsoft.com/en-us/windows-server/administrat...

But that's still DNS, right? Where does it bleed over into an LLM API? I understand there are DNS to LLM server projects, but how would the agent discover one? And I'm guessing most people who run something like that don't expose it publicly...

Right, but your have to run this server somewhere, which the agent couldn't do.

What DNS service did the agent discover that allowed it to execute arbitrary llm queries? And how?

Seems like this requires operating a proxy somewhere. In TFA it seems like all they needed was a DNS client, but I'm not at all clear how that could work. I'm definitely curious about the technique though.

On the quick start page it looks like you just pass it as a CLI argument: https://docs.plannotator.ai/open-source/start/quickstart

Couldn't you commit the plan markdown to git to get the tracking you're referring to?

What kind of fingerprinting are you thinking of? JA4? I haven't found a way to do that inexpensively at our scale, but we may have to go that route - looking at CloudFront bot mitigation.

For behavioral, we have Anubis honeypot functionality turned on, but it doesn't seem to be effective for 99% of scrapers. Anubis is also running behind TLS termination, so I don't think it can do full JA4. It does have the less robust JA4H apparently, but I'm not sure how effective that will be.

Edit: Oh yeah, forgot to mention - it's almost 100% residential proxies. Primarily China Telecom and China Unicom. Unfortunately those providers are HUGE and also host a ton of legitimate users all over Asia.

This was just blocklist based. We had the main community list and a handful of the curated paid lists enabled.

wrt bot detection - this sounds very much like Anubis which we're also using with some success.

We had the main community blocklist and several of their pricey paid blocklists enabled in a PoC capacity. We had a lot of legitimate users end up blocked. In some cases these may have been VPN exit nodes, or users on CG-NAT, or devices on a shared network with some other compromised / bot device. I didn't get 100% of the details, just that we were inundated with support requests from real users that ended up blocked.

The basic software is open source, and the list is free if you're running the tool and contributing detections back. They do have some curated lists that you have to pay for.

It's quite a bit less expensive than most other commercial products of this kind that I've looked at.

We implemented CrowdSec for bot/scraping mitigation. The architecture is sound, but it ended up having an unacceptable false positive rate for us. This may be an issue with any kind of IP reputation approach. After a couple of months of work getting it ready to go I had to turn it off after a couple of days.

Goldbacks have entered the chat. [0]

[0] https://www.goldback.com/

The data IS available. You can download it all from several sources in one big dump. And yet we're still scraped.

I just finished reading a scifi book called Venemous Lumpsucker which had this type of system as a minor plot point. An interesting twist was that there were essentially smart-contract based non-disclosure agreements that could effectively disable attestation for photos and videos on a specific device that had consented to the NDA.

As someone who operates a large non-profit public data driven website, I have some VERY strong feelings about scrapers. We looked into various commercial solutions (Datadome, HUMAN) and based on our traffic estimates from logs we'd be looking at at least 250k/yr for bot mitigation. Anubis is offering a temporary reprieve, but after reading the recent kernel.org article [0] it's increasingly clear that this is a temporary bandaid.

The cheapest solution is to require a login and rate limit by API key. I also have strong feelings about the tragedy of the commons.

[0] https://people.kernel.org/monsieuricon/creepy-crawlies

Looked into it - the bot operators also own, or are associated with, the sites that show the ads. The site showing the ads gets some percentage from Google for each click through conversion, eg app install. So app owner pays $10, google keeps $4, bot / website operator keep $6 or whatever percentages.

How does the bot farm profit? Did I miss it in the article somehow?

This is the bread and butter for commercial VPN services. The VPN knows who you are (maybe, unless you pay crypto/cash), and the rights-holders know your VPN address (from joining/logging a BitTorrent swarm, for instance), but the better providers keep no logs, and I'm guessing there's too many individuals to target effectively.

I've received a nasty letter from the ISP over BitTorrent (someone's phone joined my wifi, torrenting without my knowledge), but using a VPN seems sufficient. I think the Hetzener suggestion is a VPS for running the software stack. You could alternatively self host on hardware in your home.

Yeah, I really have no idea what's going on here. Maybe I too could burn some tokens to have claude explain it to me, but I won't.

Could you share examples?

Right, I'm not a fan of the ID check or identity/age verification. I'm just trying to understand the conspiracy theory kind of idea that "they're trying to get all our IDs!!!1!!" sentiment.

Sure, but this "invention" isn't new. It seems to make the internet rounds every few months. Here's one from 11 years ago that looks almost identical: https://www.youtube.com/watch?v=uPVQMZ4ikvM - I wonder how their "preliminary patent application" went...

Whose cause? I think the government already has our IDs, given that they issued them.

We have a local thrift store that sorts and stores the cables very nicely. 95% of the time I can find exactly what I need right away.

That doesn't mean I don't also have my big box of cables, but just offering an alternate strategy.

Am I missing something? I get black text on a yellow background, and no apparent toggle...

Not sure if this counts as 'modern', but I had the unfortunate experience of driving near Seneca Meadows[1] recently. I can't begin to describe the visceral level of horrendous stench that is perpetually downwind of this facility.

[1] https://en.wikipedia.org/wiki/Seneca_Meadows_Landfill

Here's a video of it in action: https://www.youtube.com/watch?v=41b8fw3_wP8

I keep reading this about old.reddit.com and yet I keep using it without being logged in. It must be some kind of A/B testing or slow rollout? Or maybe it's regional?

Bitwarden has lost the plot. The most recent Windows update is so bad. It has way lower information density in the UI, more buttons to click for the same use, no longer puts focus on the search field by default (this one makes me irrationally angry), and on one of my Win 11 installs can't lock the vault, manually or automatically. How could they mess up such a simple app that worked fine for so long?! What perverse incentives caused this nonsense?!