I found that using a wildcard domain cert for HTTPS and an uncommon higher port number works just fine to avoid crawlers and scrapers. I also hide my ssh port behind WireGuard because I got annoyed with the bots filling up my logs with failed attempts. I’ve been doing that for nearly a year now and I have had no more issues with bots
I’m going off the assumption that the people who run crawlers and scrapers are going for known common ports for quick ease of access
I don’t feel the need to run anything extra such as Anubis either. The inconvenience of using an uncommon higher port number has been minimal and I still get to enjoy my tiny corner of the internet
Higher port? I suppose you just run things for yourself and never share them on the public internet then.
I share my site with only with people I know personally and they don’t seem to have any issue accessing my site
They don’t seem too bothered adding
:8000to the address. Also they are usually connecting at home or on their phone and are not frequently visiting it so the inconveniences are minimalMost people getting hammered by bots are running public facing websites. There a custom port is suspicious as heck.
A limited access service like yours is better served by a VPS or a simple login before everything.
I don’t understand how it’s suspicious if I am sharing my address with a custom port to people I know. I even take time to explain why I do it and in a way a nontechnical person would understand
The connection is still encrypted because I have a proper domain cert. There’s no warning or any other issue. I have spent more time securing my hardware/operating system/software than anything else, often taking priority over hosting more services
Do I really need to take all these extra steps like a VPS or a login for a basic blog generated from markdown files and a basic file server that has copies of my git repositories? Seems excessive when I already found a solution for myself that takes less effort and works to my satisfaction
I think there’s value in experimenting outside the current set standards and norms. Especially since corporations and states are obviously abusing the trust of these standards and norms for their own personal benefit
I personally feel like a small web/indie web can find their own their place again on the internet with a little creativity and a will to break away from the current norms. Trying to do more of the same will eventually lead to issues like burnout or ever growing frustration
I’m doing this for fun and for myself above all else. Experimenting with different, low effort approaches to the crawler/scraper issue is fun for me. Involving more outside services or adding more internal software does not sound like fun to me. It doesn’t sound like much fun for other people in this thread or by the original blog post either
It’s hard to post original work to share but also know it can just get scraped but I can’t give up personal websites. Social media looks so bland and seeing completely personalized blogs are the most enjoyable part to the internet now. Spending more time in niche spaces on the internet more than ever.
The AI scrapers and all the PITA they cause is one of the primary reasons I don’t host a blog site.
Indieweb suffers heavily due to this.
I host tons of open source projects on https://forge.sciactive.com/
Recently, it was getting absolutely hounded with tons of meaningless requests. I’m assuming they are just results of AI.
So, I put Anubis in front of it. Now images hosted there won’t load on other sites, people have to wait forever to see the code, and the experience on phones is even worse. Just because AI doesn’t respect anything, and the people who run it are too stupid to realize that.
This is why we can’t have nice things.
You can set a trap that isn’t in robots.txt or is forbidden there. Anyone who ignores your robots.txt is not friendly.
This makes a difference on Forgejo: https://github.com/go-gitea/gitea/pull/34024
Also, obviously, a caching reverse proxy. Forges and wikis are hard because the bots drill down into the thousands of version control pages that get generated on demand and cant be cached.
Just because AI doesn’t respect anything, and the people who run it are too stupid to realize that.
They’re perfectly capable of realizing it. How do you think it got built that way? They don’t respect anything, either.
True.
I host a few sites and I haven’t had a problem yet. Sure, logs suggest a majority of traffic is bots, but the cheap VPS I’m hosting on hasn’t melted so I haven’t been motivated to do anything about it.
Lemmy is particularly susceptible. Hosting a static site with a limited number of pages is fine. Lemmy needs to check all posts, find the votes, sort them, and compile the page. It does that for practically every page load, and so loading a page once is quite “expensive”.
Then add on to that the almost unlimited pages of content for bots to crawl through, bots just get caught endlessly scraping pages. Even powerful servers struggle, which is why most Lemmy instances have implemented some sort of protection against bots.
Why not just use more static pages?
4chan has been ‘static’ forever, the backend builds each page every ~15s, pages served to users are always static. It’s ‘justwerked’ for 20 years now on a shoestring.
Lemmy is built as a separate web app and back end that communicate via APIs. It makes it easy to support apps and alternate web interfaces, unlike Piefed which only started adding an API reasonably recently and doesn’t have a fraction of the eco system that Lemmy has.
But I think an important part is that Lemmy is explicitly customised for users. While bots are getting the same logged out version, the intent of Lemmy is not to be scraped by bots but it’s to be custom for each user. You’re supposed to log in, subscribe to communities you like, block people you don’t like, and have posts you’ve already seen hidden (if you set this in your settings).
Serving a custom page to each user based on their settings, blocks, and subscriptions isn’t really suited to static pages.
Sounds like 4chan rolled their own server-side page cache. It probably made more sense for 4chan to do that then, back when the internet was still pretty new.
Nowadays there are a few packages that perform a similar function, like Varnish. Varnish picks up requests from the internet and where possible, it returns the response as static HTML from its own cache.
There are other types of caching at different stages of the request lifecycle that can reduce the gap between dynamic and static website performance.
There were attempts to rewrite imageboard software with modern dynamic frameworks and caching infrastructure, but it scaled worse than oldschool index and thread html regeneration on post event, and was cancelled. The effort was called something like Infinity, by 8chan.
Back in the day people used Squid for that if they needed it.
I believe you, but the linked article is not about hosting Lemmy.
No it’s not, it was more of a tangential comment.
I think this is the photography site he’s talking about.
He mentioned “so many scrapers hit my site that it saturated my upload with generated content feeding the them.” which seemed unusual to me. I’m not sure why such a site would have a public upload. It doesn’t feel like a site that would have a technical challenge with the scrapers, but I also get the impression the main issue is the thought of hosting all his photos just for AI scrapers to train their image generation models.
saturated my upload
I interpreted that as LP having the site running in their basement, and responding to scrapers saturates their outgoing bandwidth.
It doesn’t need to. Like any similar site, it can cache a lot of that in databases like redis, or cache the rendered page in part or in whole.
Parts will be cached but it’s per instance. For a 100 user instance, what are the chances that a recent cache of All page 74 is available? Bots are crawling every page, and most pages are content from last month, last year, or 3 years ago.
I would expect Lemmy instances to have some limiters set for guest connections, especially for ones coming from datacenters. Like, it should be easy and senseful to only link and cache up to All page 10, or Hot page 5, and refuse guest loads of anything beyond that.
If I didn’t enjoy the cat & mouse of it, I’d definitely walk away from running a site. Just out of curiosity, I created an hourly graph today showing malicious bot, legitimate bot and human ratio graphs for one of my sites. The malicious hits make up around 80% hourly and human hits are usually well under 10%.
Yeah, internet is no longer the interesting place it used to be. Interesting, intriguing, exciting. Now it’s worse than going to a tax office… the day before taxes… On Christmas… 😂
We should all go back to HTML and web rings
And Usenet but with spam filters somehow
I am actually trying geminispace. It has nothing to do with google btw, but it’s quirky, it’s weird and I am actually getting some old internet vibes
I run a DaaS product Trace Jobs that serves job posting data.
My expectations are pretty low and am never disappointed. Self-hosting can be pretty affordable.
