If crowdsec works for you thats great but also its a corporate product

It’s also fully FLOSS with dozens of contributors (not to speak of the community-driven blocklists). If they make money with it, great.

not exactly a pure self hosted solution.

Why? I host it, I run it. It’s even in Debian Stable repos, but I choose their own more up-to-date ones.

Allow me to expand on the problem I was having. It wasnt just that I was getting a knock or two, its that I was getting 40 knocks every few seconds scraping every page and searching for a bunch that didnt exist that would allow exploit points in unsecured production vps systems.

• Again, a properly set up WAF will deal with this pronto
• You should not have exploit points in unsecured production systems, full stop.

On a computational level the constant network activity of bytes from webpage, zip files and images downloaded from scrapers pollutes traffic. Anubis stops this by trapping them in a landing page that transmits very little information from the server side.

• And instead you leave the computations to your clients. Which becomes a problem on slow hardware.
• Again, with a properly set up WAF there’s no “traffic pollution” or “downloading of zip files”.

Anubis uses a weighted priority which grades how legit a browser client is.

And apart from the user agent and a few other responses, all of which are easily spoofed, this means “do some javascript stuff on the local client” (there’s a link to an article here somewhere that explains this well) which will eat resources on the client’s machine, which becomes a real pita on e.g. smartphones.

Also, I use one of those less-than-legit, weird and non-regular browsers, and I am being punished by tools like this.

All the self hosters in my internet circle started adopting anubis so I wanted to try it. Anubis was relatively plug and play with prebuilt packages

edit: I feel like this part of OP’s argument needs to be pointed out, it explains so much:

All the self hosters in my internet circle started adopting anubis so I wanted to try it. Anubis was relatively plug and play with prebuilt packages

At the time of commenting, this post is 8h old. I read all the top comments, many of them critical of Anubis.

I run a small website and don’t have problems with bots. Of course I know what a DDOS is - maybe that’s the only use case where something like Anubis would help, instead of the strictly server-side solution I deploy?

I use CrowdSec (it seems to work with caddy btw). It took a little setting up, but it does the job.
(I think it’s quite similar to fail2ban in what it does, plus community-updated blocklists)

Am I missing something here? Why wouldn’t that be enough? Why do I need to heckle my visitors?

Despite all that I still had a problem with bots knocking on my ports spamming my logs.

By the time Anubis gets to work, the knocking already happened so I don’t really understand this argument.

If the system is set up to reject a certain type of requests, these are microsecond transactions of no (DDOS exception) harm.

which have become magnets for scams and drug-dealing.

And broke presidents

Debian: am I a joke to you?

(security upgrades are separate from everything else)

AFAICS the author is talking about UX getting worse, not actual breakage. He describes a classic case of platform decay.

Yet updates on commercial platforms* rarely allow you to separate between security upgrades and everything else.

Congrats you discovered Enshittification

edit: that term encapsulates more than just complaining how shitty everything is. It’s not a “petty gripe”.

Initially, vendors create high-quality offerings to attract users, then they degrade those offerings to better serve business customers (such as advertisers), and finally degrade their services to users and business customers to maximize profits for shareholders.

wikipedia

But most error messages are in plain English first (plus some numbers and codes).
No, they see white (gray actually) blocky text on a black background, they think the machine is broken and go into panic mode. Instead of reading.
Which is kinda what you said.

I just went through the comments … people are losing their shit. And as always whenever Germany is mentioned, Godwin’s Law is in full effect.
Apparently nobody remembers the very American and very similar youtube-dl takedown which ended in youtube-dl’s favor. tl;dr: website owners cannot tell people how to read their websites.

DON’T PANIC nothing has happened, and it won’t for years.

(edit: slight correction)

Axel Springer says that ad blockers threaten its revenue generation model and frames website execution inside web browsers as a copyright violation.

This is grounded in the assertion that a website’s HTML/CSS is a protected computer program that an ad blocker intervenes in the in-memory execution structures (DOM, CSSOM, rendering tree), this constituting unlawful reproduction and modification.

This is complete bullshit thought up by people who have no idea how computers work. It’s basically the failed youtube-dl DMCA takedown all over again. The (final?) ruling basically said that website owners cannot tell people how to read their websites.

BTW, Axel Springer products are the equivalent of FOX in America and they are often embroiled in lawsuits against them. Just saying.

I don’t care how rough the estimate is, LLMs are using insane amounts of power, and the message I’m getting here is that the newest incarnation uses even more.

BTW a lot of it seems to be just inefficient coding as Deepseek has shown.