Brutkey

Niko (Martin) :heart_ace:
@martinligabue@tsukihi.me
Niko (Martin) :heart_ace:
@martinligabue@tsukihi.me
Niko (Martin) :heart_ace:
@martinligabue@tsukihi.me
TudbuT (gonna have recovered by 39c3)
@tudbut@social.tudbut.de
announcement, anti llm scraper tool i made, boosts encouraged

as some of you may know i made sth called bombai (name comes from bomba and ai) thats kinda like anubis or iocaine in purpose. those solutions are kind of “fine” already, but the thing about them is that anubis sucks for regular users too, and isnt always effective, and that iocaine usually relies on lists or similar things.

scrapers unfortunately come in all shapes and sizes and with new user agents or hidden ones all the time. after using anubis for a while, i got my forgejo downed again and so i went looking. iocaine seems like a good idea, but i want something that is sure to stop my git from going down even if i dont maintain it or the lists are incomplete.

what i made now does the following:
very configurable detection entirely based on behaviour, without modifying site content
request counting
one fail = timeout, continuously resetting if attempts continue (this can be excellently combined with trap paths)
weighted by path and such
blobbing entire subnets together if desired (needed for alibaba’s bot for example)
allows setting up “trap paths” that instantly flag someone for timeout upon visit
customizable response
redirection to iocaine or other trap
zip bombs (small ones usually since most scrapers are smart enough to not decompress them fully otherwise - but it makes it cheaper on bandwidth either way)
maze similar to but less sophisticated than iocaine
plain http or html response from file

it is worth mentioning especially explicitly that paths that are expensive for the server to provide (in storage or otherwise), can be thus limited extremely well, and of course most scrapers are blocked even far before the first time they request such a path.

if interest exists and help is needed setting it up or you just want to chat about it, DO IT I WOULD LOVE THAT.

if a bot makes it through that is capable of doing any harm, i consider that a bug immediately. make an issue and ill debug either your config or the program itself.

i use this myself for a bit now, and it works excellently for me with my forgejo.

#opensource #forgejo

Niko (Martin) :heart_ace:
@martinligabue@tsukihi.me
Niko (Martin) :heart_ace:
@martinligabue@tsukihi.me
bert hubert 🇺🇦🇺🇦🇪🇺🇪🇺🇺🇦🇺🇦
@bert_hubert@eupolicy.social

Rule of thumb, whenever you are about to type in that people should "just" do something, step away from the keyboard and read up on the situation. If it were a "just" thing it would've happened by now. I know I'm a broken record on this subject, but you can really improve your thinking by just (lol) treating "just" as a signal word you are likely not seeing the whole picture.

Niko (Martin) :heart_ace:
@martinligabue@tsukihi.me
Etienne Jacob
@bleuje@mathstodon.xyz

I'm taking my little 4D maze game from 2 years ago a bit more seriously because I guess few people land there when looking for 4D mazes or games. I made a new version with these main changes: playable on mobile, daily and weekly mazes so that everyone plays on the same mazes, and different look. Maybe I'll make an android app later. Link: https://bleuje.com/4dmaze/

Niko (Martin) :heart_ace:
@martinligabue@tsukihi.me
Niko (Martin) :heart_ace:
@martinligabue@tsukihi.me
Niko (Martin) :heart_ace:
@martinligabue@tsukihi.me
Niko (Martin) :heart_ace:
@martinligabue@tsukihi.me
ava@soon39c3[:ephone: LESB]:~:cursor_blinking::verifiedlesbian:
@star@fed.amazonawaws.com
:boost_requested: Pitching a new federation protocol

polyproto is an up-and-coming federation protocol with features like lossless account migration, resilience against loss of identity because of homeserver shutdown and tamper-resistant data exchange inherent to how it works under the hood.

The best part is that it doesn't re-invent the wheel, and builds on extremely well-known and widely used technologies such as X.509 (the technology powering all the SSL/TLS certificates—the thingies responsible for the padlock 🔒🔒 symbol in your browser), regular ol' digital signature schemes, JSON, HTTP and Websockets.

If you are so inclined, feel free to find out more at https://polyproto.org or feel free to https://polyproto.org/docs/protocols/core (which I have tried my best to write in a way that doesn't induce a deep sleep on the reader).

The project wants to eventually yield a federated, self-hosted Discord alternative *usable by everyone, not just computer nerds*, and hosts it's source code at https://codeberg.org/polyphony . It is not currently in any usable or demoable state, sadly, but that is being worked on.

Niko (Martin) :heart_ace:
@martinligabue@tsukihi.me