Comment on I wonder if it would be possible to force the AI crawlers to mine crypto

NaibofTabr@infosec.pub ⁨1⁩ ⁨day⁩ ago

• Flax_vert@feddit.uk ⁨1⁩ ⁨day⁩ ago

  Isn’t that what Anubis was doing? Making it run code so it wasn’t worthwhile, but people adjusted AI crawlers to run code?

  source

  • plz1@lemmy.world ⁨1⁩ ⁨day⁩ ago

    “Proof of work”. The AI crawlers don’t run Javascript (yet, I don’t think), so it’s basically a firewall to them.

    source

    • Aatube@kbin.melroy.org ⁨1⁩ ⁨day⁩ ago

      I'm fairly sure Anubis was made because some crawlers did run JavaScript

      source
    • Little8Lost@lemmy.world ⁨1⁩ ⁨day⁩ ago

      Some can from what i understood
      And not only JS but other code too like SQL
      I remember the somewhat recent case where someone vibecoded something and the AI viped the database

      source

      • Aatube@kbin.melroy.org ⁨1⁩ ⁨day⁩ ago

        That's a local AI agent not an online crawler

        source
  • NaibofTabr@infosec.pub ⁨1⁩ ⁨day⁩ ago

    There’s a functional difference between forcing a crawler to interact with code on your server that wastes its time, and getting it to download your code and run it on its own server - the issue being where the actual CPU/GPU/APU cycles happen. If they happen on your server then it’s not benefiting you at all, it’s costing you the same amount as just running the cryptominer directly would.

    Any halfway intelligent administrator would never allow an automated routine to download and run arbitrary code on their own system, it would be a massive security risk.

    source

    • lagoon8622@sh.itjust.works ⁨1⁩ ⁨day⁩ ago

      My understanding of Anubis is that it just leads the crawler into a never-ending cycle of URLs

      That’s not how Anubis works. You’re likely thinking of Nepenthes

      source
    • fruitycoder@sh.itjust.works ⁨1⁩ ⁨day⁩ ago

      “would never allow an automated routine to download arbitraru code” javascript and wasm being the leading tech to do exactly this. Make those essential for loading content and bypassing it would have to be bespoke solutions depending on the framework and implementations.

      source
• gigachad@piefed.social ⁨1⁩ ⁨day⁩ ago

  Maybe design kind of a captcha task for them?

  source

  • Little8Lost@lemmy.world ⁨1⁩ ⁨day⁩ ago

    neal.fun/not-a-robot/

    source

    • teegus@sh.itjust.works ⁨1⁩ ⁨day⁩ ago

      Apparently I have no idea what a vegetable is

      source

      • SpaceNoodle@lemmy.world ⁨1⁩ ⁨day⁩ ago

        I think Neal has no idea

        source

        • -> View More Comments
  • NaibofTabr@infosec.pub ⁨1⁩ ⁨day⁩ ago

    If you install a captcha as part of your web server, that code is running on your server.

    The crawler interacting with the captcha on your server will not result in cryptominer code running on its server.

    source

    • gigachad@piefed.social ⁨1⁩ ⁨day⁩ ago

      True, but it’s more about solving the captcha as in finding its solution. However, there is no solution, but only a never ending task of calculation (the mining). Of course this is highly hypothetical as I do not know anything about cryptomining (and I also don’t want to know more about it).

      source

      • NaibofTabr@infosec.pub ⁨1⁩ ⁨day⁩ ago

        Without getting into the technical details, the main cost offset of running a cryptominer is the electricity used. If the crawler performs cryptominer calculations on your server it will be of no benefit to you, because you will still have to pay the electricity bill, and really it’s not the crawler doing the calculations, it’s your own server hardware.

        source

        • -> View More Comments