Hacker News Reader

Comment by visarga | Hacker News Reader

Like burning down you house so squatters can't use it. A poisoning attack that makes communication itself untrusted. Wondering if we will get to extreme reciprocal mistrust eventually.

This also reminds me of art images doctored to break models if they get into the training set, by applying invisible features with different semantics.

View on HN

Making requests in bad faith is also an attack on communication itself.

No? Not when the requests are served by a machine with the capacity to answer a hundred times more requests than are actually made. The only bad faith request for information is the one that wasted the answerer's time, which isn't usually happening here. It happens sometimes, but we're also trying to block the times that doesn't happen. Why?

requests are not served by just machine, there is also a huge network of wires spread across the globe for transmission. and getting bandwidth on that is pricey when AI crawler spams you

When any crawler spams you, but most bots do not spam you. They retrieve something at some reasonable rate.

Btw cloudflare considers any browser other than the last few versions of Firefox, Safari and Chrome to be a bot. Such as Pale Moon. It blew up on Hacker News when CF demanded the PM devs to sign an insane NDA to get unblocked.

We've got to stop with this.

Bad actors acting in bad faith, causing damage? Well... you know, it's just how they are... They have a right... to... Who's to say they're really bad? You know? I mean just look at that guy over there. What about him?

Good actors, fed up, responding in a way that doesn't cut the willful hostiles every bit of slack you can imagine, which potentially could maybe cause a little bit of damage, which would stop as soon the attack was over? Punish them, they'll ruin everything.

> Bad actors acting in bad faith, causing damage? Totally fine.

Who in this thread is saying this is totally fine?

Cloudflare, apparently.

The comment I responded to. I take it to be musing from the bailey.

Maybe I'm wrong, I don't know.

I'm just a person who keeps hearing, from every direction, "Won't someone please think of the assholes?"

---

Edit: My comment above used to say what was quoted. I changed it to be more precise about my issue with the comment I replied to.

I agree, but to be clear, the bad actor you're referring to is cloudflare and the good actor you're referring to is any actor seeking information on the internet.

When you say "reciprocal mistrust", what parties do you have in mind? Websites not trusting visitors and visitors ot trusting websites?

because the latter was already the case, and AI made it much worse. Any unfamiliar websife could be AI generated and therefore void of original cobtent and full of unverified facts.

Not quite - all the information on the fake pages is accurate and real, so it’s not an attempt to poison training data, just to waste resource. Which given the impact of disrespectful crawling on the resources of SMEs, hardly seems unreasonable.

It’s like in roller coaster tycoon, when you trap the guests on a ride by making the exit lead directly back into the queue.

Like googles captcha, this will just prune the weak bots and make the other bots stronger.

Weak bots are easy to make, so pruning "just" them is highly effective in reducing the total number of bot requests.

How do CAPTCHAs make other bots stronger?

The same way antibiotics make bacteria "stronger" - evading them is survival itself for some of the products and teams, so they will evade them. The arms race always continues. This is a powerful new weapon that will shut down a lot of bad actor volume but the bad actors abide.

Sure, the individual bots that adapt to solve the CAPTCHAs are stronger than before in the sense that there are pages they can crawl that their earlier versions could not. But the subset of pages that they can crawl hasn't increased in an absolute sense: For any page that they can crawl now, the old (CAPTCHA-free) version of that page could already be crawled by the old (non-CAPTCHA-solving) version of the bot. So in that sense, nothing is lost by adding CAPTCHAs to pages.

More like having a series of fake doors and rooms built out in front of your home, with most of them leading back outside and not into the home.

Something of a labyrinth for AI crawlers, if you will.

More like it being a store, not a house, inside being a complex maze of obnoxious ads, inhabited by performance artists who distract you so pickpockets can rob you - and because locals figured out blind people are immune to this, they started paying them to buy stuff for them, and now you retrofit the maze to have confusing tactile markings, as to direct blind people back out of the store.

The AI paranoia is getting out of hand. Worrying about bots spamming you is one thing, but discriminating on crawlers specifically because they're from AI companies - and conveniently omitting the difference between a bot that's crawling (and should obey robots.txt) vs. a bot that's acting as user agent (and should not care about robots.txt) - isn't just poisoning communication; it's setting the commons on fire.