Comment on AI companies are violating a basic social contract of the web and and ignoring robots.txt

palordrolap@kbin.social ⁨1⁩ ⁨year⁩ ago

• lvxferre@mander.xyz ⁨1⁩ ⁨year⁩ ago

  Good old honeytrap. I’m not sure, but I think that it’s doable.

  Have a honeytrap page somewhere in your website. Make sure that legit users won’t access it. Disallow crawling those pages through robots.txt.

  Then if some crawler still access it, you could simply record it in the logs and ban the relevant IPs. Or you could be really nasty, and fill the page with poison - nonsensical text that would look like something that humans would write.

  source

  • CosmicTurtle@lemmy.world ⁨1⁩ ⁨year⁩ ago

    I think I used to do something similar with email spam traps. Not sure if it’s still around but basically you could help build NaCL lists by posting an email address on your website somewhere that was visible in the source code but not visible to normal users, like in a div that was way on the left side of the screen.

    Anyway, spammers that do regular expression searches for email addresses would email it and get their IPs added to naughty lists.

    I’d love to see something similar with robots.

    source

    • lvxferre@mander.xyz ⁨1⁩ ⁨year⁩ ago

      Yup, it’s the same approach as email spam traps. Except the naughty list, but… holy fuck that’s a great idea, if people can share their bot IP banlists with each other the damage to those web crawling businesses would be even bigger.

      source

      • Nighed@sffa.community ⁨11⁩ ⁨months⁩ ago

        but with all of the cloud resources now, you can switch through IP addresses without any trouble. hell, you could just browse by IP6 and not even worry with how cheap those are!

        source

        • -> View More Comments
  • thefactremains@lemmy.world ⁨1⁩ ⁨year⁩ ago

    Even better. Build a WordPress plugin to do this.

    source
  • KairuByte@lemmy.dbzer0.com ⁨11⁩ ⁨months⁩ ago

    I’m the idiot human that digs through robots.txt and the site map to see things that aren’t normally accessible by an end user.

    source
  • lol@discuss.tchncs.de ⁨1⁩ ⁨year⁩ ago

    [deleted]

    source

    • lvxferre@mander.xyz ⁨1⁩ ⁨year⁩ ago

      For banning: I’m not sure but I don’t think so. It seems to me that prefetching behaviour is dictated by a page linking another, to avoid any issue all that the site owner needs to do is to not prefetch links for the honeytrap.

      For poisoning: I’m fairly certain that it doesn’t. At most you’d prefetch a page full of rubbish.

      source
• Blackmist@feddit.uk ⁨1⁩ ⁨year⁩ ago

  “Help, my website no longer shows up in Google!”

  source
• PM_Your_Nudes_Please@lemmy.world ⁨11⁩ ⁨months⁩ ago

  Yeah, this is a pretty classic honeypot method. Basically make something available but inaccessible to the normal user. Then you know anyone who accesses it is not a normal user.

  I’ve even seen this done with Steam achievements before; There was a hidden game achievement which was only available via hacking. So anyone who used hacks immediately outed themselves with a rare achievement that was visible on their profile.

  source

  • Link@rentadrunk.org ⁨11⁩ ⁨months⁩ ago

    That’s a bit annoying as it means you can’t 100% the game as there will always be one achievement you can’t get.

    source

    • Omniraptor@lemm.ee ⁨11⁩ ⁨months⁩ ago

      perhaps not every game is meant to be 100% completed

      source
  • CileTheSane@lemmy.ca ⁨11⁩ ⁨months⁩ ago

    There are tools that just flag you as having gotten an achievement on Steam, you don’t even have to have the game open to do it. I’d hardly call that ‘hacking’.

    source
• Aatube@kbin.social ⁨1⁩ ⁨year⁩ ago

  robots.txt is purely textual; you can't run JavaScript or log anything. Plus, one who doesn't intend to follow robots.txt wouldn't query it.

  source

  • BrianTheeBiscuiteer@lemmy.world ⁨1⁩ ⁨year⁩ ago

    If it doesn’t get queried that’s the fault of the webscraper. You don’t need JS built into the robots.txt file either. Just add some line like:

    here-there-be-dragons.html
    

    Any client that hits that page (and maybe doesn’t pass a captcha check) gets banned. Or even better, they get a long stream of nonsense.

    source

    • 4am@lemm.ee ⁨1⁩ ⁨year⁩ ago

      server {

      name herebedragons.example.com; root /dev/random;

      }

      source

      • PlexSheep@feddit.de ⁨1⁩ ⁨year⁩ ago

        Nice idea! Better use /dev/urandom through, as that is non blocking. See here.

        source

        • -> View More Comments
      • aniki@lemm.ee ⁨1⁩ ⁨year⁩ ago

        I wonder if Nginx would just load random into memory and crash if you did this.

        source
    • gravitas_deficiency@sh.itjust.works ⁨1⁩ ⁨year⁩ ago

      I actually love the data-poisoning approach. I think that sort of strategy is going to be an unfortunately necessary part of the future of the web.

      source
  • ShitpostCentral@lemmy.world ⁨1⁩ ⁨year⁩ ago

    You’re second point is a good one, but you absolutely can log the IP which requested robots.txt. That’s just a standard part of any http server ever, no JavaScript needed.

    source

    • GenderNeutralBro@lemmy.sdf.org ⁨1⁩ ⁨year⁩ ago

      You’d probably have to go out of your way to avoid logging this. I’ve always seen such logs enabled by default when setting up web servers.

      source
  • ricecake@sh.itjust.works ⁨1⁩ ⁨year⁩ ago

    People not intending to follow it is the real reason not to bother, but it’s trivial to track who downloaded the file and then hit something they were asked not to.

    Like, 10 minutes work to do right. You don’t need js to do it at all.

    source
• Ultraviolet@lemmy.world ⁨11⁩ ⁨months⁩ ago

  Better yet, point the crawler to a massive text file of almost but not quite grammatically correct garbage to poison the model.

  source

  • odelik@lemmy.today ⁨11⁩ ⁨months⁩ ago

    Maybe one of the lorem ipsum generators could help.

    source
• nullPointer@programming.dev ⁨11⁩ ⁨months⁩ ago

  a bad-bot .htaccess trap.

  source