Consider client API

[alexpdp7]

The Anubis no JavaScript page could embed an API endpoint manifest. This could be used in a browser extension to perform the proof of work without enabling JavaScript. The page could also display a command line sample that executes the proof of work and submits it, for simple browsers.

This would be convenient for us who want to use NoScript or browsers without JavaScript.

[Xe]

I'm not sure how disabling JavaScript and using a browser extension are related. From my understanding the usual function of browser extensions is to inject arbitrary JavaScript into webpages. Does that injected JavaScript bypass the "don't execute JavaScript" check?

[alexpdp7]

Oh, I use NoScript- I don't disable JS entirely in the browser.

Disabling JS in the browser does seem to trouble some extensions, yes.

But using NoScript, they work unimpeded as far as I know (never had an issue).

My understanding is that extensions can also run "outside the page". So in theory, an Anubis extension could inspect web pages, detect the Anubis manifest, perform the proof of work, and submit it without touching the page.

My other proposal would be to create a CLI tool like anubis-cli. The nojs Anubis page would show something like:

Run anubis-cli https://example.com/ v87d68fysd87vyd8nvy8vs to proceed.

, then anubis-cli would perform the proof of work, submit it to example.com, and then you'd be able to reload and proceed to the content.

A browser without any JS support could be patched to do the equivalent thing.

...

I'm not really sure if this can be done entirely safely, so that crawlers cannot benefit from the API themselves. (But I suspect you limit the amount of traffic that can flow through an Anubis session until you see a new proof of work?)

(Also, this is likely completely niche, and might not be worth the main developers' time. But I like putting the idea there so perhaps someone learns about it and implements something useful. I'm trying lately to use JS even less, and switch to terminal browsers...)

[PinguDEV-original]

I like the idea with the CLI client. Maybe then do stronger ratelimiting? So like less requests per minute or only 10mb per minute or something like that.

[Xe]

I think that this is out of scope for this project and risks ossifying or leaking the implementation of the check logic.

[alexpdp7]

I'm not sure I follow; I was proposing this because I saw "A no-JS solution is a work-in-progress." in the UI, and this is the only way I thought this could be done? (I'm very interested in hearing other thoughts!)

I think the whole point of using proof of work is that it can't be "fooled" even if it's a public algorithm. The main issue is some evil actor finds a better implementation that others cannot replicate, though.

(In any case, I'm already resigning to the fact that browsing without JS will be increasingly more difficult, and this project is of course not even slightly responsible about that.)

[Xe]

The solution I'm eyeing for no-JS support is one of these two things:

• Shipping a browser extension to run the challenges because even though people don't want to run JS on websites, JS in extensions seems to be more fine? I need to do more research and this would probably be delayed out until I can afford to work full time on this and other Techaro projects.
• Having the administrator set up some kind of authentication endpoint that Anubis uses to detect if a user is already "logged in" or not, and if not let them access a login page of some sort.

Both of these have not been thought out enough to give a proper answer here. If this was a closed source project the proof of work checks would be merely an implementation detail but we don't seem to be that lucky in this timeline. i want to avoid people relying on the exact implementation of the exact mechanism because right now the mechanism is weak in an effort to bait the AI bros into making a GPU accelerated workaround so I can change the algorithm slightly and lock them out forever.

[alexpdp7]

Oh, that's interesting. I think as long as the computation is done on the browser, it will always be easy to reverse engineer... but you seem to have interesting ideas that perhaps it's better not to discuss in public, so maybe it's best to leave it here, I will not poke further although I'm curious :D

I think we are proposing more or less the same thing- I use NoScript and I'd be fine with an extension- esp. if this is somehow standardized and I can just use one extension. I just think this can be extended to browsers that do not support extensions, nor JS.

(But this is sufficiently niche that I can stop here. I understand this is a side-project at the moment.)

[JasonLovesDoggo]

I will note that I think the extension is the better solution.

1. Most admins won't bother to setup this new route
2. Some sites don't even have a login feature
3. NoScript is a user level choice. It should be a user level fix imo