"A web font that makes written content costly to scrape for AI training."

look inside

accessibility-breaking slop

@whitequark is it just a font that reassigns glyphs to the wrong codepoints?

@ratsnakegames it's a bit more complex in execution but something like that yeah

i don't think i will ever trust any "AI protection" measure built with Claude. that's just participating in a protection racket

@whitequark the only thing that is going to work is IP banning the scrapers anyway

@whitequark honest claude's protection racquet

@whitequark

That was the same feeling I got so thanks for confirming.

@jrdepriest it's not hidden or anything

@ariadne @whitequark

They're using some TV apps to turn TVs into a botnet.

@rl_dane @whitequark sounds unfortunate for those who have a TV in the botnet

@whitequark the unfortunate monkey’s paw

@whitequark i've seen some people do that for "copy protection" on PDFs and it sucks ass-balls

@whitequark a hell of our own design

@ariadne @whitequark

It's unfortunate for everyone, as it makes it very hard to block.

May the whole corporation Bright Data rot in piss.
@rl_dane @ariadne @whitequark

@JessTheUnstill @ariadne @whitequark

All those data brokers should be flat-out illegal.

@rl_dane @ariadne @whitequark They're literally botnet as a service, and yet somehow they aren't rotting in jail.

@JessTheUnstill @rl_dane @whitequark innovation!

@dysfun
Or is it honest cloudflare's? 🤔
@whitequark

@JessTheUnstill @ariadne @whitequark

Corporations are above the law. :/

@whitequark @ratsnakegames in a similar vein I was reading an article on some news site the other day and it threw up a modal “sign up to continue” popover, so I naturally turned on Reading View… to discover that everything in the article after the sign-up nag was gibberish, because the base text had all the letters in every word transposed/rotated in the alphabet, and presumably the JavaScript to decode it deliberately doesn’t run in reading mode.

@ariadne @whitequark Data point: In 2 days recently one server I help protect had connections from 60k different /20 network blocks. Often thousands simultaneously, all from different IPs.

Yes, I blocked them all. I then had to go back and unblock myself, 2 of my 6 fellow sysadmins, and 3 of 12 valued data contributors. I’m pretty sure we’re also blocking some legit visitors, but it was the only way to shed load.

@whitequark @ariadne

That doesn’t work either because a lot of scrapers are now (probably illegally) using tons of residential IP addresses with botnets, and that’s assuming there isn’t any blowback caused by the hellspawn that is the Network Address Translator meaning reusing IP addresses is just something a large chunk of the population gets to deal with.

@daemonspudguy @whitequark sounds like a lot of people with smart TVs are going to be banned then

@ariadne @whitequark IP bans are unlikely to work, the scraper bots use residential proxies often.

@bms @whitequark oh, they will. i do not care about refusing service to infected hosts.

@ariadne @whitequark Prevention is better than cure. Avoid mainstream X.509 CT-logging trust anchors, e.g. Let's Encrypt (yes, it's an ironic inversion of the very attacks the Pervasive Monitoring RFC was intended to protect people from). Use self-signed certificates and/or an alternate trust root. Host on IPv6.

@ariadne @whitequark

And a lot of people who lucked out and got on the IP address that their ISP makes them share with literally thousands of other people and one of them just happened to get hit with a botnet yes that person is me I was having to constantly appeal to get myself un-IP banned from places because at some point somewhere in the past one of the many people I shared an IP address with got us all banned and I basically had to plead with them to let me join anyways.

@daemonspudguy @whitequark damn, sounds like your ISP should give you IPv6 then

@ariadne @bms @whitequark The world needs a shared database for tracking residential proxies and info on how to use it with all the common web servers. If people find they're blocked from a big chunk of the Internet they might think about uninstalling the malware.

@mathew @ariadne @bms doubt cloudflare would go for this, except as an anticompetitive measure

@mathew @ariadne @bms @whitequark this already exists (dronebl)

@bms @whitequark @mathew @noisytoot yeah but dronebl isn't designed to scale to this level of abuse, is it? I certainly didn't have it in mind when I built it.

@ariadne @bms @whitequark @mathew @noisytoot Or even just level of traffic, like IRC doesn't mesures let's say hundred of new-IPs per seconds, right?

I think it's the kind of thing where you'd need to blocks in batches (btw I'm using IRC to share around abusive IPs and it hit "Excess Flood" quite few times, so wouldn't work for bigger hosts than me)

@noisytoot @bms @whitequark @mathew @lanodan I mean it did when I built DroneBL. it's why DNSBL was attractive for IRC abuse mitigation: it allowed for fast defense.

@rl_dane @ariadne @whitequark 'tis not very hard, because the bots are dumb.

1. Serve identifiable bots garbage, with poisoned urls
2. Anything that hits a poisoned url gets 12 hours on the firewall.

TVs gone!

You see, most bots follow a crawling queue. Fill it with urls you can identify, and you can IP ban them on first hit, regardless of how well they try to hide.

This got me down from 100mill requests/day to 3mill (could go below 1m, if I blocked more aggressively, but I want to keep their queues poisoned).

Poisoning a model is hard. But poisoning crawler queues is trivial, and makes 'em easy to block.

Fuck Blright Data & its ilk though.

@algernon @rl_dane @ariadne @whitequark You mean Iocaine?
At least, that has been the least intrusive and most effective method to ward off bots I found.

@firesphere

iocaine, or something similarly shaped, yes. The method is the important thing here, not the tool itself.

@rl_dane @ariadne @whitequark

@algernon @firesphere @rl_dane @ariadne @whitequark iocaine yes!

algernon, your contribution to the commons has been invaluable, do not undersell iocaine’s importance

@algernon @rl_dane @ariadne @whitequark yes, for now this works, but _only_ because the bots are dumb

http://vinyl-cache.org/tips/iocaine/index.html

@slink

They've been dumb for over a year now, despite increasingly more people deploying iocaine & other measures. With the AI companies running into scaling problems and whatnot, improving their crawlers is likely the last thing on their... uhhh... mind? Whatever they have that one would normally call a mind.

I expect this trick to continue working fine until the bubble bursts, at which point we can remove iocaine from the picture and live happily ever after!

(Thanks for the vinyl-cache link, by the way, I'll read through it, maybe it'll help me improve iocaine! If nothing else, it's something I can link to from the docs.)

@rl_dane @ariadne @whitequark