the most infuriating part is how they decide anubis is bad (valid concerns, i do share some of them) but haven't talked about any possible alternative, even a temporary one, they can use to avoid overworking their two sysadmins. anubis is specially useful for sites like that, where they had very little admin power. trying to use gnu sites lately is a pain because they are often not-operational, which is way more disrupting than having to wait a bit for whatever challenge they could have

the whole post reads like an useless rant without any proper aim. if they are so interested on the free internet, they could probably try and come up with some alternative but the way they talk makes me think they are just ignorant of the modern hostile internet and just want to magically return to the past where this didn't happened without having to do any effort about it

A website using Anubis will respond to a request for a webpage with a free JavaScript program and not the page that was requested.

This is a legitimate critique though. Anubis requires the use of capital W Web Browsers (chromium, Firefox) in order to access the site. This effectively blocks users who A: dont want to run the computations of the JS program (which can't be circumvented due to the server side computing done) and B: users using web browsers without or with limited JS functionality that wouldn't meet the reqs of Anubis.

Anubis was created as an emergency stop valve on LLM scrapers, but I think having a solution which doesn't require Anubis is also valuable as well.

Malware is a terrible choice of words. Anubis isnt malware. It may provoke questions about the state of the Web but there's nothing malicious about protecting your digital infra when the vast majority of users browse with JS enabled and not doing so would take down your site or leave you with thousands of dollars in upkeep costs.

The FSF do give off the trot vibe and thank you for making that connection that I will never unsee. I think if they just posted what I wrote above they would get far less backlash.

The FSF is ideologically incapable of implementing bot management strategies because they value internet anonymity. Bot evasion strategies are literally just advanced ways of being anonymous. You can't tell if a person is a bot or not without violating their anonymity or internet freedom.

Anubis is a modest compromise. It checks if you can run JavaScript and blocks those who can't. It's not perfect. It'll block elinks/lynx users or a real person using curl. But it'll also block any bot that doesn't use a browser, which accounts for most of the volume.

The "cryptomining" and "malware" comparisons against Anubis or hyperbolic but sort of true. Proof of Work is the dumbest and most wasteful possible strategy to combat bots. It's not the hashing that stops bots, its the check if they can run JavaScript that does.

Anubis has a new javascriptless metarefresh which uses HTML to refresh the page after a few seconds. This is a much better solution than the computational proof of work, in my opinion. This line from the docs though is perplexing:

This is not enabled by default while this method is tested and its false positive rate is ascertained. Many modern scrapers use headless Google Chrome, so this will have a much higher false positive rate.

The false positive rate will be the same as proof of work minus however many bots run headless browser with JavaScript disabled. Proof of Work doesn't give you positives or negatives, it's a flat tax.

Can you elaborate a bit? The blog post is a tad overdramatic but doesn't seem to have anything particularly bad in it.

Sounds like they’d be fine with Anubis if it was opt-in instead of automatic. Their concerns are valid in that it runs an unwanted/non-consented payload and so fits a strict definition of malware. The browser is a user agent, so it should only do what the user wants it to do.

Like fuck off, to think I ever liked these guys

You might have liked them for the wrong reasons, this is the least surprising response they could have made lol. Either you share in their hard-line stance or you align with something lesser like open source. Copyleft is uncompromising by design.

what exactly is the issue here? the article is complaining about DDOS attacks from botnets and LLM scrapers, seems very reasonable to me