Top
Best
New

Posted by happosai 3 hours ago

Gentoo bugzilla closed due AI bot scraper overload(social.treehouse.systems)
97 points | 61 comments
mrweasel 2 hours ago|
While we're dealing with the same issue at work, I sometimes still wonder exactly who these scrapers are. OpenAI, Google, Anthropic and others are normally fairly well behaved (Minus Anthropic attempting to hide behind a browser-for-hire company). Mostly you can get IP range and user-agents for the large players, while it problems mostly stem from bots pretending to be Chrome.

Our largest offenders seems to be mostly limited to South-East Asia, so probably mostly Chinese AI projects, but that's speculation. I also don't recall ever seeing Grok IP ranges or a specific Grok UA, but that doesn't mean that they're hiding, perhaps they're just not interested.

pooploop64 6 minutes ago||
One of the defining characteristics of AI turned out to be utter and profound facelessness. The scraping, the data centers, the slop content, it's like it all comes from thin air. Nobody is talking about who is really doing all this or why, because it's always just coming from... somewhere else outside of our place.
marginalia_nu 2 hours ago|||
Most of the nonsense comes through botnets/residential proxies, so it's very hard to say.
shevy-java 2 hours ago||
Well, some websites claimed China is behind it, which could make sense (I would not know either way). At the same time, though, I kind of doubt your carte blanche here for all those companies. Why would you think none of them are responsible for the AI slop spam?

> Our largest offenders seems to be mostly limited to South-East Asia, so probably mostly Chinese AI projects, but that's speculation

Ok. So you also don't know. Well, I don't know either, but I don't make a speculation by claiming x, y, and z companies to be exempt. In my book they are all responsible.

coldbrewed 1 hour ago||
We see constant abuse from the Tencent ASN/associated ACE ASN, and I've memorized the china169 backbone asn as AS4837 because of thr nonstop crawlers splattered across their network ranges. It's not possible to ID the operator running the crawlers running from these networks but there's a clear signal of the origin of some of these entities.
capitainenemo 43 minutes ago||
Hedgewars had to lock down its bugzilla and repo too, for the exact same reason. So far the really simple method used (basic auth with the creds posted on the main site) seems to have resisted the scrapers. Presumably if they are too stupid to scrape correctly they are also too stupid to incorporate a trivial auth.
eYrKEC2 34 minutes ago||
I don't really understand why there is resistance to in-browser Anubis-style gating using crypto mining for public sites like this.

You mine crypto and my free service remains cost-neutral. Yes, that transfers some of the cost to you, but it is marginal.

You want to bang on my servers with the fury of a thousand madmen, then I'll scale up the servers and you can pay the marginal cost of your access.

Or micropayments, of course, but hard to get normal users to sign up for micropayments. Micropayments could of course be the way to bypass the crypto mining gate.

gruez 8 minutes ago||
>I don't really understand why there is resistance to in-browser Anubis-style gating using crypto mining for public sites like this.

But in the case of anubis it's not even used for crypto. It's just wasted.

>You mine crypto and my free service remains cost-neutral. Yes, that transfers some of the cost to you, but it is marginal.

No, the problem is time wasted. I don't care about the electricity cost. Spending 10s to solve a challenge on a 5W SoC translates to 0.0005 cents (yes, cents, not dollars). Meanwhile if I click on a link and it doesn't load in 5s, I'm seriously questioning the value of your blog or whatever, and will probably just close the tab.

rufasterisco 9 minutes ago||
Instead of punishing a criminal, you make everybody pay.

This is not only unfair to legitimate users having to pay.

It also needs to explain what actually happens when the Ddos succeeds (I know, you are talking about scrapers, but what’s the difference really?). Does that mean that the attacker just gets to shrug it off.

Don’t take my statements as facts, I just want to outline a few reason I could come up with that show a purely technical solution might not be enough.

Akin to “just use Cloudflare, it’s free”.

Yes it works but why conceding defeat and say “oh from now on you depend on a business to publish a server”?

ComputerPerson 2 hours ago||
There are definitely patterns you can use against the scrapers. This maintainer just didn't have time for it, which is understandable.

We direct scraper traffic to a bot-specific server using Cloudflare's load balancer, slowly analyzing traffic and adding conditions one at a time. No accidental scraper DDoS in a long time.

Most scrapers are relatively honest in some way shape or form.

gruez 4 minutes ago||
>We direct scraper traffic to a bot-specific server using Cloudflare's load balancer, slowly analyzing traffic and adding conditions one at a time. No accidental scraper DDoS in a long time.

What's the point of this compared to letting cloudflare handle everything automagically? Presumably whatever heuristics they come up with are going to be better than you can, given limited time and budget?

cogman10 2 hours ago|||
One thing that surpised me about gentoo is just how low budget it is as an operation. They are doing everything with a $12k budget. [1]

[1] https://www.gentoo.org/news/2026/01/05/new-year.html

ComputerPerson 9 minutes ago||
Basically volunteer-run. Which makes sense in this context; what gets worked on is mostly about what people want to work on.
sporp 1 hour ago|||
How did you implement this? My site's getting hammered, any tips would be appreciated
ComputerPerson 53 minutes ago||
What kind of uptime/expectations/etc. are you working with?

Scraper "attacks" don't take down our robot-specific server very often; it's safe for us to take heavy-handed approaches that sometimes redirect users there. 99% (made-up high number) of the time, the misdirected users don't realize anything is amiss.

Start by analyzing your traffic, specifically user agents. Look for "robot" or even "bot" in the user agent and load balance those to a robot-specific server. This can all be done within Cloudflare. The only code is the user agent condition. Note: I'm very open to input here if anyone reading notices that we're shooting ourselves in the feet. Based on our analysis, the remaining traffic is a good picture of our human users.

We have loads of other conditions, mostly balancing specific IP ranges for entities when we know exactly who they are, but this is a good start.

Symbiote 1 hour ago||
> Most scrapers are relatively honest in some way shape or form.

Did you miss a "dis" in there?

littlecranky67 2 hours ago||
It is time for micropayments integrated in the browser. Pay 5 cents to access each bug report. Not fun, it shouldn't be like this, but better than not having a bugtracker at all.
kangalioo 2 hours ago||
0.05 cents even. The beautiful thing is, minuscule amounts of micropayments are already enough to fix the incentives
comboy 1 hour ago||
Not sure it works, isn't it already like that if you have the cursed javascript-only pages? It's basically proof of work to access their content (and if you are scrapping en masse you likely also need some LLM getting involved)
port11 1 hour ago|||
I suppose the cost of hardware, network usage, and electricity is still under 0.05? I mean, we know the unit economics for LLMs don't make a ton of sense, except if enterprise customers really are what keeps the lights on.
tarpitt 1 hour ago||||
With micropayments, the server owner makes 1 million requests times 0.05 cents = ~$500

The status quo with those js PoW pages doesn't really benefit the server owner at all, it's wasted energy.

I mean proof of work is always wasted energy, but I figure it's better to kill two birds with one stone.

CoinHive was one example of this. (I think this is a correct link? https://github.com/cazala/coin-hive). Although I think ideally you would want to have some sort of browser plugin or app that runs on bare metal instead of a proof-of-work in the browser, because RandomX is designed such that it's slow when implemented in JS (https://github.com/tevador/RandomX/blob/master/doc/design.md)

littlecranky67 1 hour ago|||
Problem is I'd rather have the 0.05cents go to however runs the website (the bugtracker in this case) than go to the electricity company.
vlyan 1 hour ago|||
and do you happen to know a zero friction payment system that works internationally like the Internet itself does? because I promise you that unless you already have a captive audience, even a minuscule amount of friction to access your service will cost you an overwhelming percentage of organic human visitors.
tarpitt 1 hour ago|||
Something like Chaum's blind-signature based ecash, or GNU Taler would be ideal in terms of efficiency, but it's still centralized in distribution. Freenet currently uses something like this.

Another option I was thinking of would be a pretty inflationary (or demurrage) cryptocurrency in which you have some sort of RandomX or other CPU-bound PoW. A web server could act as a mining pool and use mining shares interchangibly with micropayments.

You could do this mining-share method with Monero right now, it's just that you have higher transaction size in Monero and no real analogue to Bitcoin's LN-based microtransactions. Also you would want the cryptocurrency to be more inflationary (or demurrage-based) to promote usage.

Monero's FCMP++ lays some groundwork for payment channels, but it still lacks the nessisary timelocks. Also there was DLSAG which could have enabled payment channels I think, but it's no longer relevant. I also insist that you would need to change the tokenomics to favor greater inflation (maybe you could make coinbase scale linearly with hashrate?), otherwise the miner reward would be economicially insufficient.

littlecranky67 58 minutes ago||
Lightning - a fast, instant, bitcoin layer 2 network - is perfectly sufficient for micropayments. Volatility is a no-issue in this case, as you can freely trade the 5 cents in realtime into other assets and minimize holding time of BTC. You will loose the spread, ofc.
port11 1 hour ago|||
Friction-free is a big ask. Brave tried something a while back with their Brave Payments, but of course no one trusts them and it’s not going anywhere.
pduggishetti 1 hour ago|||
I think it's gonna kill off the internet not just for bots but to whole class of lower income countries, especially for younger learners
thayne 56 minutes ago|||
Perhaps the biggest problem is 5 cents or less isn't enough to cover minimum transaction fees.
maelito 41 minutes ago||
Visa fees.
csomar 1 hour ago||
How many pages does the average software developer visit everyday? 1.000? Price at 0.001 per load and it’ll be completely impractical for crawlers but super cheap for the average connected human on earth.
pduggishetti 1 hour ago||
That would gate the internet to whole lower income countries
bluefirebrand 1 hour ago||
Aren't many of those countries basically being de-facto blocked by Cloudflare filtering out spam already anyways?

Genuine question, I'm not up to date on how Cloudflare operates right now

pmdr 1 hour ago||
There's a reddit thread from 9 years ago with people complaining the site blocking crawlers and thus not being indexed by search engines. So I'm not sure what they consider "overload." At this point they should dump the db on thepiratebay.
jpcom 1 hour ago||
What are they scraping the gentoo bugzilla for? I'm confused. Unless you're actively using Gentoo why would this be a resource? Very confusing. Also you'd think we'd have LLM BitTorrent by now, where if they want to scrape something we get a DHT hash for the content and share it with one another, rather than melt servers with the millionth request of the day.
mrweasel 7 minutes ago||
At this point they've mostly run out of material, so ANY type of content is valuable. Your small personal website, why would they scrape that? It's 10.000 additional words, wouldn't want to miss that. My Github repos.... got to get buggy code from somewhere I guess.

I get what you're asking, and I'm wondering the same. Not all sources are created equally and we see the results all the time. LLMs outputs nonsense all the time, like Flock cameras containing 5 grams of gold and ounces of copper, because they are completely on critical of their sources. Perhaps there's some weights that says: Kernel mailing list, MariaDB documentation and Microsofts Learning sites are 100% trust, Reddit 50%, 4Chan 10%, but I doubt it.

Anthropic might care a little bit, seeing as they scan books, but again, is it just all books? Because other than some flowery language I don't really see the point in scanning a 1970s paperback only spy novel.

xena 54 minutes ago|||
They're scraping everything. It doesn't matter what. It doesn't matter if it makes sense. They just scrape it all.
KennyBlanken 36 minutes ago|||
They're mining the written output of technical talent discussing troubleshooting, bug finding, patches, inter-dependencies, etc. It's an AI trainer's wet dream.

Also: where exactly are AI companies incentivized to be anything but shitty 'neighbors'?

Spam, DDoS attacks and other network abuse used to cause your hosting company or provider to call you and tell you to knock it off or you'll get disconnected, if your provider was reputable. If your provider wasn't reputable, it was likely a matter of time before they would get a nasty call from their upstream provider.

Now it just gets you a thank-you from the sales team for all the bandwidth you bought.

Meanwhile, do any of the cloud providers have any incentive to do anything about this? Hell no. They're making money off you having to ramp up extra or bigger instances. They're making money off the bandwidth. They're making money off the people doing the crawling, too. They're incentivized to do the exact opposite of effectively help you with your AI bot problem.

BoingBoomTschak 1 hour ago||
Lots of build failure detailed investigations and gcc/kernel expertise in debugging misbehaving or outright ICEs.

That's it, I guess?

maelito 43 minutes ago||
Indexers should pay for each request.

Maybe Taler could help ?

Gander5739 1 hour ago||
And people complain about cloudflare/anubis/etc. Unfortunately, it's looking like this is the alternative.
c-fe 3 hours ago|
going on a bit of a tangent here - some discussion there seems to be imply that AI bots mostly use IPv4s, which makes sense to me given that they are probably bots hosted by some cloud. Whereas IPv6 may be more organic traffic from e.g. mobile users (not in this case probably)... which made me think if at some point IPv6 may at some point win against IPv4 just because its more organic traffic (i.e. not from big tech cloud), leading to pages blocking IPv4? Just speculation on my side
Retr0id 2 hours ago||
The hardest-to-mitigate bot traffic tends to come from residential proxies, and most residential connections are still v4-only.

However, it is also easy to get large numbers of v6 addresses cheaply.

thayne 50 minutes ago|||
My residential ISP doesn't support IPv6 at all. If a site is ipv6 only, I can't reach it unless I use a VPN.
neuroticnews25 2 hours ago||
This is weird, every VPS I've rented in the last 8 years had IPv6, and some didn't even had IPv4.
TingPing 2 hours ago||
If a problematic bot is on any mainstream VPS it will just get shut down.
Symbiote 1 hour ago||
How would I shut down a bot on Digital Ocean making over a million requests a day?
coldbrewed 1 hour ago||
Send an email to the Digitalocean abuse email with the time ranges and origin IPs.
More comments...