Selfhosted

60366 readers

679 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

MODERATORS

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world

Non-Cloudflare AI blocking? (lemmy.sdf.org)

submitted 2 years ago by ctag@lemmy.sdf.org to c/selfhosted@lemmy.world

44 comments fedilink hide all child comments

Now that we know AI bots will ignore robots.txt and churn residential IP addresses to scrape websites, does anyone know of a method to block them that doesn't entail handing over your website to Cloudflare?

you are viewing a single comment's thread
view the rest of the comments

[–] Deckweiss@lemmy.world 7 points 2 years ago* (last edited 1 year ago) (2 children)

The only way I can think of is blacklisting everything by default, directing to a challanging proper captcha (can be selfhosted) and temporarily whitelisting proven human IPs.

When you try to "enumerate badness" and block all AI useragents and IP ranges, you'll always leave some new ones through and you'll never be done with adding them.

Only allow proven humans.

A captcha will inconvenience the users. If you just want to make it worse for the crawlers, let them spend compute ressources through something like https://altcha.org/ (which would still allow them to crawl your site, but make DDoSing very expensive) or AI honeypots.

[–] ctag@lemmy.sdf.org 4 points 1 year ago* (last edited 1 year ago) (1 children)

I hadn't heard of that before, thanks for the link.

I haven't read through the docs yet... But PoW makes me wonder what the work is and if it's cryptocurrency related.

Edit: Found it: https://altcha.org/docs/proof-of-work/

[–] jagged_circle@feddit.nl 1 points 1 year ago

Hashcash predates crypto currencies

[–] jagged_circle@feddit.nl 2 points 1 year ago (1 children)

Any reason you prefer this to mCAPTCHA?

[–] Deckweiss@lemmy.world 2 points 1 year ago

I didn't know about mCaptcha. Thanks for sharing.