Introduction
In today's digital world, protecting online resources from automated attacks is crucial. Anubis, an HTTP proxy that limits access through proof-of-work, has been adopted by some to counter these threats. But who does Anubis actually stop?
What is Anubis?
Anubis is designed to be a virtual gatekeeper, imposing a computational challenge on clients before granting them access to resources. This proof-of-work mechanism aims to make access costly for bots while remaining feasible for human users. However, this approach raises questions about its real effectiveness.
The Limits of Anubis
In theory, Anubis should slow down automated attacks by making each access a computationally expensive process. Yet, as illustrated by the example of a developer using the anubis-fetch tool, bypassing these barriers is often trivial for AI-based tools. The main issue is that these tools can easily solve the proof-of-work and even make it more efficient through cookie caching.
Impact on Human Users
For human users, each interaction with Anubis involves additional delay, battery drain, and a degraded user experience. Less powerful devices or mobile users suffer more from this burden. Indeed, the proof-of-work becomes a digital "regressive tax" that weighs more heavily on those with fewer technological resources.
Cost Analysis
Consider a practical case: for a typical difficulty of 4, the felt user time to solve a proof-of-work can range from 1 to 5 seconds, with a non-negligible energy cost. If we extrapolate these figures on a global scale, the cumulative impact becomes significant, not even mentioning the energy consumed by bot farms to bypass these barriers.
Conclusion: Who Do We Really Stop?
Ultimately, Anubis seems to hinder legitimate users more than the attackers it is meant to neutralize. Developers and decision-makers must evaluate if the perceived benefits of this protection method outweigh its costs and downsides.
Call to Action
Let's discuss your project in 15 minutes. Let's evaluate together how to effectively protect your resources without harming user experience.