Elektrine lite

← Feed

@tyler@typing.ink

Post #3502220

2026-06-30 19:19 UTC

@aphyr@woof.group @algernon@come-from.mad-scientist.club from a technical perspective, this take is really interesting to me. My impression is that Anubis is the service to actively block but iocaine is more about poisoning traffic, are you finding that bots 1) give up, 2) iocaine sinks traffic with negligible load, or 3) something else?

Replies (2)

  • @aphyr@woof.group 2026-06-30 19:20

    @tyler@typing.ink @algernon@come-from.mad-scientist.club Crawler request rate increases, but Iocaine is much more efficient than them hitting Mastodon, so it reduces our overall load by a big margin.

    Open ##3502221

  • @tyler@typing.ink @aphyr@woof.group The reason iocaine serves garbage is that it can serve poisoned (and later recognizable) URLs, to overload the crawler's queue. This way, when they come back riding remote controlled chromes, they'll hit poisoned URLs, and will end up in an infinite maze of garbage too. It's also possible to configure iocaine to block certain requests (temporarily firewalling the IP off for a time) - for example, when they hit a poisoned URL. This firewalling bit got my incoming dily requests down from ~100m/day to ~2.8m/day. So iocaine is perfectly capable of blocking these. But blocking them prevents poisoning the crawling queue, which reduces the effectiveness of poisoned URLs, so by default, poison's served. Said poison is also extremely cheap to generate (and will be even cheaper in the not too distant future), cheaper than serving a small static file from a filesystem even. Every crawler trapped in the maze is a crawler that isn't hitting your backend. With that said, I see two major differences between Anubis and iocaine: Anubis - usually - presents a proof of work, which both crawlers and humans need to bypass. Crawlers have more money to burn, and if they really want to, can bypass it (like they did against Codeberg). If a proof of work is presented, a crawler has a chance to get through. iocaine is passive, and uses various heuristics to catch crawlers. If it traps a bot, there is no way out. There's also no proof of work challenge for the human visitor, either. They both aim to do the same thing: reduce the load on services behind them. Their approach is wildly different, even if the goal's similar.

    Open ##3502223