TecharoHQ/anubis

> that stupid anime girl who is on way too many open source web sites I assume you're referring to https://github.com/TecharoHQ/anubis . As I understand, this is a tool for blocking bot traffic and is sometimes used as DDOS protection. In my experience it's less obtrusive than Cloudflare, and it's open source and competes with Cloudflare's near monopoly on DDOS protection. I don't think we should be discouraging people from protecting their sites from unwanted traffic.

…aScript-based challenge, my server got overloaded, but switching back to the PoW solution fixed it [0]. I also semi-hate Anubis since it required me to add JS to a website that used none before, but (1) it's the only thing that stopped the bot problem for me, (2) it's really easy to deploy, and (3) very few human visitors are incorrectly blocked by it (unlike Captchas or IP/ASN bans that have really high false-positive rates). [0]: https://github.com/TecharoHQ/anubis/issues/1121

The bot problem can be solved. Anubis is one such answer [0]. Cryptocurrency and micro transactions are another. In the last few decades, spam was a problem because the marginal transaction costs of information exchange were orders of magnitude lower than they had been. Note that physical mail spam was, and still, is an issue. Focusing on perceptual or fuzzy computation as the limiting factor, through captchas and other 'human tests', allowed for most spam to be effectively mitigated. Now that intelligence is becoming orders of magnitude cheaper, perceptual computation challenges no longer work, but we can still do computation challenges in the form of proof of work or proxies thereof. Sp…

I have heard great things about Anubis, although I have not needed to use it myself: https://github.com/TecharoHQ/anubis

Maybe instead of asking "questions" to a corporation which their only interest is profit, is now beholden Wall Street and wouldn't care what we think, we should look for answers and alternatives like BunnyCDN [0], Anubis [1], etc. [0] https://bunny.net/ [1] https://github.com/TecharoHQ/anubis

Have you tried Anubis or similar tools? I've had similar issues with bot scraping of a forum taking all server resources, and using PoW challenge solved the problem. https://github.com/TecharoHQ/anubis

Thinking along the same lines a PoW check like like anubis[1] may work for OP as well. [1] https://github.com/TecharoHQ/anubis

>Also not much excuse for xss these days. XSS is not dead, and the web platforms mitigations (setHTML, Trusted Types) are not a panacea. CSP helps but is often configured poorly. So, this kind of widespread XSS in a vulnerable third party component is indeed concerning. For another example, there have been two reflected XSS vulns found in Anubis this year, putting any website that deploys it and doesn't patch at risk of JS execution on their origin. Audit your third-party dependencies! https://github.com/TecharoHQ/anubis/security/advisories/GHSA-jhjj-2g64-px7c https://github.com/TecharoHQ/anubis/security/advisories/GHSA-cf57-c578-7jvv