14
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 20 Aug 2026
14 points (100.0% liked)
Privacy
50513 readers
279 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 6 years ago
MODERATORS
While Cloudflare, as well as Anubis and other "anti-bot solutions", do behave like MitM, they only become a MitM in two situations:
- When the webmaster injects one of those third-party malware into their website.
- Very unlikely, when the network administrator (e.g. the wi-fi from a library or university) is deliberately acting as a MitM through a transparent proxy, and it's somehow using Cloudflare.
As for me, personally, I don't see these anymore. I built myself an userscript (FireMonkey), targeted at every domain, programmed to do a
window.close()(close the tab) if the title is one of the strings "Just a moment..." (Cloudflare), "Making sure you're not a bot!" (Anubis), "Cookie monster!" (also Anubis), "Checking you are not a bot" (some Anubis fork) or "One more step" (Google recaptcha). If the title matches, the tab is closed before any non-consented cryptographic challenge (i.e. those "solutions" don't even dare to ask for user consent before "checking the browser", therefore it's a non-consented relationship and a behavior indistinguishable that of a malware) starts to overwhelm my decade-old laptop CPU.Yes, this means I'm not having access to whatever content is behind the wannabe-cryptojacking tool, but if the webmaster does not respect my personal device and my right to consent (i must emphasize: all those "solutions" start straining the CPU with cryptographic challenges as soon as the user accesses the page, without asking for user consent beforehand, therefore it's a non-consented relationship and a malware-like behavior), I can't help but speed-run my search for the exit door. I'm not submitting myself and my personal device to malware (the webmaster pushing CF/Anubis/etc to non-consentedly run on my laptop ain't gonna buy another laptop for me if mine died so I'm better as far as possible from their website).
!privacy@lemmy.ml
so hosts defending themselves From being ddosed by ai scrapers is now "malware" because it requires executing instructions on your computer? lol which ai company do you work for
Have you ever seen a "This site uses cookies, accept / reject"? This has a name, it's called CONSENT.
I'll repeat: there's something called CONSENT. I.e. the ability (and the right) for someone to CONSENT.
Could one fight a non-consensual relationship, AI crawlers DDosing the hell out of the whole Web, by pushing non-consensual relationships, injection of third-party JS code programmed to solve cryptographic challenges without prior consent of the user?
Because this is precisely my point when I criticize Cloudflare, Anubis, Google Recaptcha and whatever other "Proof-of-work anti-bot solution" out there.
NONE of the mentioned solutions ask for user consent before proceeding with the challenge (e.g. "this site needs to check your browser through heavy computation, proceed / leave"). The "challenge" starts as soon as the page is accessed, as in, zero clicks required for them to start using the CPU (thus, my apologies, I called these things simply as "malware", I should've called these things "zero-click attack").
To make things worse, the "challenge" can accommodate itself across multiple CPU cores by using JS
SharedWorkers, thus effectively getting to using 100% of the CPU, regardless of any other parallel uses of CPU (e.g. other tabs opened at the background, or other software doing jobs). Using a 100% of CPU for a couple seconds, potentially minutes depending on the current difficulty level, WILL increase temp. Laptops are particularly sensitive to CPU temp due to lack of proper cooling, so it can easily get to 90C, which is a dangerous temp.And I'm unable to know beforehand if a website injects "anti-bot challenge" when I stumble upon a link on social media.
My only PC is an Acer ES1-572, it got an Intel i5-7200U; if you look it up, you'll realize it's a decade-old laptop. I'm fucking unemployed so I can't afford a new laptop. And if my laptop dies upon being literally fried by a long session of "checking your browser", neither the webmasters nor the owners of the anti-bot solutions are going to give me reparation for the damage they indirectly inflicted onto my personal device. It's, thus, on me. And still I'm the evil one? REALLY?!
But, hey, don't worry! If you didn't read this part, I'll repeat it again: I'm CLOSING every website that uses one of these tools. Differently from the non-consented push of a third-party JS, I AM NOT FORCING my way into websites. If you're a webmaster, you just need to put something like "Cookie monster!" in your
document.titleand my userscript will auto close your website and I'll never visit it anymore. Unless you're going to buy me another laptop, you stay with your sacred website while I stay with my good ol' laptop.Oh, and there's the irony: those whirling machines at hyperscale data centers are designed for heavy computations such as those involved in PoW cryptographic challenges, and the AI techbros got "infinite money cheat" to spin up new ones... Techbros are likely laughing at the naivete of Anubis; Cloudflare, a corp with an AI suite of their own (another sweet irony; fight AI crawlers by feeding your content directly to another AI corp) are laughing at all the power and content being handed freely to them (sometimes webmasters are even paying for Cloudflare to be given content for their AI suite!). Meanwhile, me, an unemployed Brazilian, am compelled to avoid the so-called "modern web" if I don't want my only old laptop to unwittingly become a dead weight... and I'm even accused of working for AI companies!
!privacy@lemmy.ml
(Because I'm unable to edit my earlier reply, I'm doing a second one) Oh, and speaking of who works for AI companies...
!privacy@lemmy.ml